stackstorm / st2-rbac-backend Goto Github PK

View Code? Open in Web Editor NEW

5.0 11.0 12.0 558 KB

RBAC backend for StackStorm (previously part of EWC aka StackStorm Enteprise)

Home Page: https://docs.stackstorm.com/latest/rbac.html

License: Apache License 2.0

Makefile 1.57% Python 98.43%

st2 stackstorm rbac backend python

st2-rbac-backend's Introduction

RBAC Backend for StackStorm

The RBAC backend started as part of StackStorm core repo and then moved out into a separate repo for enterprise purposes. Some enterprise features such as RBAC has been made open sourced as part of the donation to Linux Foundation in 2019.

NOTE: Due to the original code structure and the code originally living as part of the open source StackStorm/st2 repo, some of the utility RBAC code is still part of the open source repo (that code is of little use without the permission resolving classes which contain majority of the business logic though).

Installation

NOTE: This happens automatically when using bwc installer script.

Make sure the backend Python package is installed inside StackStorm virtualenv (/opt/stackstorm/st2/) 2: Edit StackStorm config (/etc/st2/st2.conf):

...
[rbac]
enable = True
backend = default
...
3. Restart all the services - ``sudo st2ctl restart``

## Running Lint Checks and Tests

To run lint checks and unit tests you can use ``lint`` and  ``unit-tests`` make targets.
This will clone ``StackStorm/st2`` repo into ``/tmp/st2``, install StackStorm dependencies in
a purpose built virtual environment and add all StackStorm Python packages from
``/tmp/st2``  into ``PYTHONPATH`` for those make targets.

```bash
make lint
make unit-tests

If virtual environment is already created and all the dependencies installed, you can skip dependency steps by simply running lint and tests:

make .lint
make .unit-tests

If you want to test those changes against a specific version of StackStorm/st2 repo, you can set ST2_REPO_BRANCH environment variable. For example:

ST2_REPO_BRANCH=my-super-feature make unit-tests

Keep in mind that you can also simply symlink your working copy of StackStorm/st2 repo to /tmp/st2. This way you can test changes with your work which hasn't been committed / pushed upstream yet.

Copyright, License, and Contributors Agreement

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this work except in compliance with the License. You may obtain a copy of the License in the LICENSE file, or at:

http://www.apache.org/licenses/LICENSE-2.0

By contributing you agree that these contributions are your own (or approved by your employer) and you grant a full, complete, irrevocable copyright license to all users and developers of the project, present and future, pursuant to the license of the project.

st2-rbac-backend's People

Contributors

Stargazers

Watchers

Forkers

extremenetworks amanda11 sagar-orchestral jorson-chen ankita-orchestral nzlosh lynxye isabella232 mamercad vaidyanath filemagic

st2-rbac-backend's Issues

Failed to import pip: No module named 'pip' error while installing st2-rbac-backend

Full error:

Collecting st2-rbac-backend
  Cloning https://github.com/StackStorm/st2-rbac-backend.git (to revision master) to /tmp/pip-install-uiium15i/st2-rbac-backend_0a2a4584a2ba46e584e078cd4bc7fe30
  Running command git clone -q https://github.com/StackStorm/st2-rbac-backend.git /tmp/pip-install-uiium15i/st2-rbac-backend_0a2a4584a2ba46e584e078cd4bc7fe30
  Resolved https://github.com/StackStorm/st2-rbac-backend.git to commit 15111880591283b520570b6752edef994bc272e8
  Installing build dependencies: started
  Installing build dependencies: finished with status 'done'
  Getting requirements to build wheel: started
  Getting requirements to build wheel: finished with status 'error'
  ERROR: Command errored out with exit status 1:
   command: /root/virtualenv/bin/python /root/virtualenv/lib/python3.6/site-packages/pip/_vendor/pep517/in_process/_in_process.py get_requires_for_build_wheel /tmp/tmp5zm3l78q
       cwd: /tmp/pip-install-uiium15i/st2-rbac-backend_0a2a4584a2ba46e584e078cd4bc7fe30
  Complete output (4 lines):
  Failed to import pip: No module named 'pip'

Also noticed CI had failed on that err:
https://app.circleci.com/pipelines/github/StackStorm/st2-rbac-backend/815/workflows/fa9a2e96-e11a-4f28-9066-4cb121d2651f/jobs/2472
https://app.circleci.com/pipelines/github/StackStorm/st2-rbac-backend/815/workflows/fa9a2e96-e11a-4f28-9066-4cb121d2651f/jobs/2473

RBAC breaks when "backend" parameter not set

Testing was done in docker version 3.4dev

If you dont set the RBAC "backend" parameter the apps fail complaining that the "backend" needs to be set to default. By default this should just be set to default if its not specified in the config.

500 on actionalias help endpoint with action_alias_help permission grant

Calling the action alias help endpoint results in 500 when RBAC is enabled and the action_alias_help permission grant if specified in a role.

St2 version: st2 3.3.0, on Python 3.6.8

OS: CentOS Linux release 8.2.2004 (Core)

RBAC: master branch

Role: chatbot.yaml

---
    name: "chatbot"
    description: "Mr. Chatbot"
    enabled: true
    permission_grants:
        -
            resource_uid: "action:packs:show"
            permission_types:
               - "action_execute"
        -
            permission_types:
               - "action_list"
               - "rule_list"
               - "action_alias_help"

assignment: bot.yaml

---
username: "bot
roles:
- "chatbot"

st2api.log :

2021-02-08 15:24:46,700 140311874581616 INFO logging [-] f9a6d8e1-17c6-4fcc-8615-f01b8dc204e2 - GET /v1/actionalias/help with query={'x-auth-token': '********'} (method='GET',path='/v1/actionalias/help',remote_addr='127.0.0.1',query={'x-auth-token': '********'},request_id='f9a6d8e1-17c6-4fcc-8615-f01b8dc204e2')
2021-02-08 15:24:46,714 140311874581616 ERROR router [-] Failed to call controller function "help" for operation "st2api.controllers.v1.actionalias:action_alias_controller.help": 'NoneType' object has no attribute 'name'
Traceback (most recent call last):
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2common/router.py", line 516, in __call__
    resp = func(**kw)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2api/controllers/v1/actionalias.py", line 105, in help
    aliases_resp = super(ActionAliasController, self)._get_all(**kwargs)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2api/controllers/resource.py", line 564, in _get_all
    requester_user=requester_user)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2api/controllers/resource.py", line 184, in _get_all
    limit = validate_limit_query_param(limit=limit, requester_user=requester_user)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2api/controllers/resource.py", line 625, in validate_limit_query_param
    user_is_admin = rbac_utils.user_is_admin(user_db=requester_user)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2_rbac_backend-3.4.dev0-py3.6.egg/st2rbac_backend/utils.py", line 194, in user_is_admin
    is_system_admin = RBACUtils.user_is_system_admin(user_db=user_db)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2_rbac_backend-3.4.dev0-py3.6.egg/st2rbac_backend/utils.py", line 214, in user_is_system_admin
    return RBACUtils.user_has_role(user_db=user_db, role=SystemRole.SYSTEM_ADMIN)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2_rbac_backend-3.4.dev0-py3.6.egg/st2rbac_backend/utils.py", line 232, in user_has_role
    user_role_dbs = rbac_service.get_roles_for_user(user_db=user_db)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2_rbac_backend-3.4.dev0-py3.6.egg/st2rbac_backend/service.py", line 87, in get_roles_for_user
    queryset = UserRoleAssignment.query(user=user_db.name)
AttributeError: 'NoneType' object has no attribute 'name'
2021-02-08 15:24:46,715 140311874581616 ERROR error_handling [-] API call failed: 'NoneType' object has no attribute 'name'
Traceback (most recent call last):
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2common/middleware/error_handling.py", line 49, in __call__
    return self.app(environ, start_response)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2common/middleware/streaming.py", line 48, in __call__
    return self.app(environ, start_response)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2common/router.py", line 599, in as_wsgi
    resp = self(req)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2common/router.py", line 524, in __call__
    raise e
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2common/router.py", line 516, in __call__
    resp = func(**kw)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2api/controllers/v1/actionalias.py", line 105, in help
    aliases_resp = super(ActionAliasController, self)._get_all(**kwargs)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2api/controllers/resource.py", line 564, in _get_all
    requester_user=requester_user)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2api/controllers/resource.py", line 184, in _get_all
    limit = validate_limit_query_param(limit=limit, requester_user=requester_user)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2api/controllers/resource.py", line 625, in validate_limit_query_param
    user_is_admin = rbac_utils.user_is_admin(user_db=requester_user)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2_rbac_backend-3.4.dev0-py3.6.egg/st2rbac_backend/utils.py", line 194, in user_is_admin
    is_system_admin = RBACUtils.user_is_system_admin(user_db=user_db)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2_rbac_backend-3.4.dev0-py3.6.egg/st2rbac_backend/utils.py", line 214, in user_is_system_admin
    return RBACUtils.user_has_role(user_db=user_db, role=SystemRole.SYSTEM_ADMIN)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2_rbac_backend-3.4.dev0-py3.6.egg/st2rbac_backend/utils.py", line 232, in user_has_role
    user_role_dbs = rbac_service.get_roles_for_user(user_db=user_db)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2_rbac_backend-3.4.dev0-py3.6.egg/st2rbac_backend/service.py", line 87, in get_roles_for_user
    queryset = UserRoleAssignment.query(user=user_db.name)
AttributeError: 'NoneType' object has no attribute 'name' (_exception_class='AttributeError',_exception_message="'NoneType' object has no attribute 'name'",_exception_data={})
2021-02-08 15:24:46,715 140311874581616 INFO logging [-] f9a6d8e1-17c6-4fcc-8615-f01b8dc204e2 - 500 46 15.714ms (method='GET',path='/v1/actionalias/help',remote_addr='127.0.0.1',status=500,runtime=15.714,content_length=46,request_id='f9a6d8e1-17c6-4fcc-8615-f01b8dc204e2')

Endpoint: GET/api/v1/actionalias/help (using user name / password and auth-token).

Result: 500: {'faultstring': 'Internal Server Error'}

Can't seem to load a simple role

Hi! It looks like the role loading procedure is broken.. If I try to load this role (using master):

# sample RBAC role file, see https://docs.stackstorm.com/rbac.html#defining-roles-and-permission-grants
---
name: "sample"
description: "Example Role which contains no permission grants and serves for demonstration purposes"
permission_grants:
  - resource_uid: "action:core:echo"
    permission_types:
      - "action_execute"

it simply doesnt work!

root@a24bf10f204e:/opt/stackstorm# st2-apply-rbac-definitions --config-file /etc/st2/st2.docker.conf
Loading RBAC definitions
2022-07-26 20:29:53,876 INFO [-] Connecting to database "st2" @ "mongo:27017" as user "None".
2022-07-26 20:29:53,880 INFO [-] Successfully connected to database "st2" @ "mongo:27017" as user "None".
2022-07-26 20:29:54,083 INFO [-] Loading role definitions from "/opt/stackstorm/rbac/roles/"
Traceback (most recent call last):
  File "/usr/bin/st2-apply-rbac-definitions", line 15, in <module>
    sys.exit(apply_rbac_definitions.main(sys.argv[1:]))
  File "/opt/stackstorm/st2/lib/python3.8/site-packages/st2rbac_backend/cmd/apply_rbac_definitions.py", line 60, in main
    apply_definitions()
  File "/opt/stackstorm/st2/lib/python3.8/site-packages/st2rbac_backend/cmd/apply_rbac_definitions.py", line 42, in apply_definitions
    result = loader.load()
  File "/opt/stackstorm/st2/lib/python3.8/site-packages/st2rbac_backend/loader.py", line 61, in load
    result["roles"] = self.load_role_definitions()
  File "/opt/stackstorm/st2/lib/python3.8/site-packages/st2rbac_backend/loader.py", line 79, in load_role_definitions
    role_definition_api = self.load_role_definition_from_file(file_path=file_path)
  File "/opt/stackstorm/st2/lib/python3.8/site-packages/st2rbac_backend/loader.py", line 159, in load_role_definition_from_file
    role_definition_api = role_definition_api.validate()
  File "/opt/stackstorm/st2/lib/python3.8/site-packages/st2common/models/api/rbac.py", line 170, in validate
    cleaned = super(RoleDefinitionFileFormatAPI, self).validate()
  File "/opt/stackstorm/st2/lib/python3.8/site-packages/st2common/models/api/base.py", line 75, in validate
    cleaned = util_schema.validate(
  File "/opt/stackstorm/st2/lib/python3.8/site-packages/st2common/util/schema/__init__.py", line 370, in validate
    instance = assign_default_values(instance=instance, schema=schema)
  File "/opt/stackstorm/st2/lib/python3.8/site-packages/st2common/util/schema/__init__.py", line 255, in assign_default_values
    instance[property_name] = assign_default_values(
  File "/opt/stackstorm/st2/lib/python3.8/site-packages/st2common/util/schema/__init__.py", line 249, in assign_default_values
    array_instance = instance.get(property_name, None)
AttributeError: 'list' object has no attribute 'get'

And there's apparently the same behavior in the tests.. is this something expected?

Thanks!

RBAC permissions don't seem to be hierarchical as documentation has made it to be

I have a user with a role assigned as this:

name: "my_role"
permission_grants:
  -
    resource_uid: "pack:<my special pack>"
    permission_types:
      - "pack_all"
      - "sensor_type_all"
      - "action_all"
      - "action_alias_all"
      - "rule_all"

In the documentation under pack its lead to believe that action_all will allow the execution of any action under that pack but this is not the case.

from st2api.log

2021-10-06 09:56:21,637 140650525596712 ERROR router [-] Failed to call controller function "post" for operation "st2api.controllers.v1.actionexecutions:action_execution_rerun_controller.post": User "<user>" doesn't have required permission "action_execute" on resource "action:<my special pack>:<my action>"
Traceback (most recent call last):
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2common/router.py", line 621, in __call__
    resp = func(**kw)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2api/controllers/v1/actionexecutions.py", line 675, in post
    show_secrets=show_secrets,
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2api/controllers/v1/actionexecutions.py", line 130, in _handle_schedule_execution
    permission_type=permission_type,
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/st2rbac_backend/utils.py", line 127, in assert_user_has_resource_db_permission
    permission_type=permission_type)
st2common.exceptions.rbac.ResourceAccessDeniedError: User "<user>" doesn't have required permission "action_execute" on resource "action:<my special pack>:<my action>"

So action_all is ignored with the pack resource.

Migrate from CircleCI to GH Actions

CircleCI is getting queued, especially during the releases.

Switch to GH Actions for the native experience.

Only .yaml files are loaded, not .yml

Files using the .yml file extension are not picked up by the RBAC backend, even though they are valid YAML files and that is a valid YAML file extension.

2021-05-11 15:33:16,873 INFO [-] Loading role definitions from "/opt/stackstorm/rbac/roles/"
2021-05-11 15:33:16,873 INFO [-] Loading user role assignments from "/opt/stackstorm/rbac/assignments/"
2021-05-11 15:33:16,874 INFO [-] Loading group to role map definitions from "/opt/stackstorm/rbac/mappings/"
2021-05-11 15:33:16,874 INFO [-] Synchronizing roles...

After renaming to use .yaml:

2021-05-11 15:33:36,197 INFO [-] Loading role definitions from "/opt/stackstorm/rbac/roles/"
2021-05-11 15:33:36,197 INFO [-] Loading user role assignments from "/opt/stackstorm/rbac/assignments/"
2021-05-11 15:33:36,197 INFO [-] Loading group to role map definitions from "/opt/stackstorm/rbac/mappings/"
2021-05-11 15:33:36,197 DEBUG [-] Loading group to role mapping from: /opt/stackstorm/rbac/mappings/stormers.yaml
2021-05-11 15:33:36,263 INFO [-] Synchronizing roles...

st2-apply-rbac-definitions not created when going 2.10.4 -> 3.0.1

If a user installs EWC 2.10.4, and upgrades to 3.0.1 using yum, it will include the new st2-rbac-backend package.

However, it does not create /opt/stackstorm/st2/bin/st2-apply-rbac-definitions. It does create the symlink at /usr/bin/st2-apply-rbac-definitions, but does not create the target.

Looking at the st2 virtualenv, it reports that st2-enterprise-rbac-backend is installed.

Workaround is to do this:

PIP=/opt/stackstorm/st2/bin/pip
WHEELSDIR=/opt/stackstorm/share/wheels
${PIP} uninstall st2-enterprise-rbac-backend
${PIP} install --find-links ${WHEELSDIR} --no-index --quiet --upgrade st2-enterprise-rbac-backend

New installs of 3.0.1 are unaffected.

RBAC permissions to allow user to only list actions for certain packs

This issue arose from the discussions in StackStorm/st2docs#1107 in regard to the behaviour in the example in the documentation.

In the current example the user had permissions

permission_grants:
    -
        resource_uid: "pack:example"
        permission_types:
           - "pack_all"
           - "sensor_type_all"
           - "rule_all"
           - "action_all"

With this permission the user was unable to run "st2 action list" or "st2 action list -p example".

The only way the user could list the actions in the pack was to add the global action_list permission, and then they were able to list the actions in that and all other packs.

See the comments in the existing issue from @satellite-no StackStorm/st2docs#1107 (comment), and @amanda11 StackStorm/st2docs#1107 (comment) about two different possibilities of how the permissions could be viewed/altered to support restricting the list to certain packs.

Unable to assign default role to all users

There is no option available to assign default role to all users. Each user configuration needs to be created separately and this is not practical when we have large number of users.

Add CIs to cover upgrade scenarios

Add CIs to cover the following upgrade scenarios.

RBAC disabled before upgrade -> RBAC disabled after upgrade
RBAC enabled before upgrade -> RBAC enabled and same configuration after upgrade

The current st2_pkg_upgrade_e2e_test workflow handles case 2 by default and we can probably refactor it to also run case 1 as a separate test.

RBAC not working with LDAP

I've been following this document here for setting up RBAC over the LDAP auth. However, this never worked even after trying different combinations.

Here is what my configs look like.

~]# grep rbac /etc/st2/st2.conf -A2
[rbac]
sync_remote_groups = True

~]# cat /opt/stackstorm/rbac/mappings/stormers.yaml
---
  group: "cn=GROUP_NAME,ou=groups,o=ldaporg"
  roles:
    - "observer"

configs seems to be registered well in the DB, after running st2-apply-rbac-definitions

    > use st2
    switched to db st2
    > db.group_to_role_mapping_d_b.find()
    { "_id" : ObjectId("62deaa7b77bfe684352d1d3a"), "group" : "cn=GROUP_NAME,ou=groups,o=ldaporg", "roles" : [ "observer" ], "source" : "mappings/stormers.yaml", "enabled" : true }

Proving that my user is part of the LDAP group.

  ~ % ldapsearch -H ldap://ldap.myorg.net:389 -x -ZZ -LLL -b ou=Users,o=ldaporg "cn=my_username"
  dn: cn=my_username,ou=Users,o=ldaporg
  memberOf: cn=GROUP_NAME,ou=Groups,o=ldaporg

When I login using my LDAP, I'm suppose to have only observer level privileges but I'm still getting the admin level privileges granted for some reason. There are no RBAC related traces in logs even after enabling DEBUG. Any other suggestions ?

cheers.

RBAC

Hi, can I ask you something?
does RBAC have to be LDAP based

Move RBAC into st2 codebase

EWC (previously StackStorm Enterprise) was opensourced with RBAC is now free & open.

Instead of having a dedicated RBAC package in this repository, move RBAC code to st2 codebase so rbac could be just easily enabled/disabled via st2.conf

Change License to OpenSource

Currently the repository LICENSE file in repo and packages lists Extreme Workflow Composer EULA, including Homepage: https://www.extremenetworks.com/product/workflow-composer/, EWC naming and other Extreme Networks references.
This should be changed to Apache 2 OSS license.

Additionally, every file needs a new Apache 2 license/copyright header instead of Extreme proprietary.

Discussion for updating/fixing the RBAC system

Moving StackStorm/st2#5204 to here

The RBAC system for StackStorm is unnecessarily complex and needs some kind of updating. Just wanted to open some dialog for thoughts on how to update/fix this to make it more simple and intuitive to use.

In #5303 it was suggested to maybe use oso but I think this is in beta at the moment at least its stated as such on pypi. I've also looked at some other packages I wont name here just yet, but they all use a unix-like filesystem method for doing this. Not sure if this is a good or bad thing.
There was also the discussion of using ACL over RBAC. I'm not exactly sure of the difference here holistically. Maybe programmatically its different that I'm not exactly understanding?
With the new system I think the yaml files should maybe go away? I say this because with yaml files it gives the potential for anyone to make changes to the app's permissions when it should be an admin within the app that makes these decisions. Any root user could edit these files without the actual stakeholders knowing about it. While I like the idea of configuration as code - which is how I use Tower to sync our RBAC files across all our clusters - most apps manage users within the app itself and not outside the app.

action_view not included by default on action_execute

This issue is triaged on st2 v3.1. The action_view permission is not implicitly granted to user with action_execution permission.