[BUG] EAuth for netapi not regexing group/usernames
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
Per https://docs.saltproject.io/en/latest/topics/eauth/index.html#matching-syntax the username/group names can be:
exact matches, shell glob patterns or regular expressions
This is not the case for netapi EAuth. Only exact matching is performed.
I am using CherryPy, but being that the issue is in the sum_permissions function in the netapi init, I suspect this issue is present for all netapi modules.
Setup
e.g. assuming correct ldap eauth, and a group 'FooBaz' and 'BarBaz', the following external_auth configuration:
external_auth:
ldap:
'.*Baz%':
- '*':
- 'state\.apply'
- '@runner':
- 'auth\.mk_token':
args: []
kwargs:
'username': '.*'
'password': '.*'
'eauth': '^(pam|ldap|token)$'
functionality will actually fail for a user, whether they are in FooBaz, BarBaz, or both groups.
Expected functionality works perfectly fine if the same block is replicated for each explicit group, however:
external_auth:
ldap:
'FooBaz%':
- '*':
- 'state\.apply'
- '@runner':
- 'auth\.mk_token':
args: []
kwargs:
'username': '.*'
'password': '.*'
'eauth': '^(pam|ldap|token)$'
'BarBaz%':
- '*':
- 'state\.apply'
- '@runner':
- 'auth\.mk_token':
args: []
kwargs:
'username': '.*'
'password': '.*'
'eauth': '^(pam|ldap|token)$'
Please be as specific as possible and give set-up details.
- on-prem machine
- VM (KVM)
- VM running on a cloud service, please be explicit and add details
- container (Kubernetes, Docker, containerd, etc. please specify)
- or a combination, please be explicit
- jails if it is FreeBSD
- classic packaging
- onedir packaging
- used bootstrap to install
Steps to Reproduce the behavior
See above.
Expected behavior
Behavior matches documentation.
Screenshots
N/A
Versions Report
salt --versions-report
(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)Salt Version:
Salt: 3006.5
Python Version:
Python: 3.10.13 (main, Nov 15 2023, 04:34:27) [GCC 11.2.0]
Dependency Versions:
cffi: 1.14.6
cherrypy: unknown
dateutil: 2.8.1
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
Jinja2: 3.1.2
libgit2: 1.6.4
looseversion: 1.0.2
M2Crypto: Not Installed
Mako: Not Installed
msgpack: 1.0.2
msgpack-pure: Not Installed
mysql-python: Not Installed
packaging: 22.0
pycparser: 2.21
pycrypto: Not Installed
pycryptodome: 3.9.8
pygit2: 1.12.1
python-gnupg: 0.4.8
PyYAML: 6.0.1
PyZMQ: 23.2.0
relenv: 0.14.2
smmap: Not Installed
timelib: 0.2.4
Tornado: 4.5.3
ZMQ: 4.3.4
System Versions:
dist: almalinux 8.9 Midnight Oncilla
locale: utf-8
machine: x86_64
release: 4.18.0-513.9.1.el8_9.x86_64
system: Linux
version: AlmaLinux 8.9 Midnight Oncilla
Additional context
As mentioned above, literal/exact checking is performed ONLY rather than "exact matches, shell glob patterns or regular expressions".
This is exceptionally apparent here:
https://github.com/saltstack/salt/blob/73922a7469e951ebbe68911c827f8933f8a55176/salt/netapi/__init__.py#L56
which is the only check performed whatsoever as far as I can determine.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in salt/netapi/init.py, especially the sum_permissions function and the exact membership check linked in the report. Compare its behavior with the matching syntax documented for external_auth, then run the relevant netapi and authentication tests. Done means group and username entries support the documented exact, shell-glob, and regular-expression matching across netapi modules.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100