saltstack / saltstack/salt

[BUG] EAuth for netapi not regexing group/usernames

Open
#65,845 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
Per https://docs.saltproject.io/en/latest/topics/eauth/index.html#matching-syntax the username/group names can be:

exact matches, shell glob patterns or regular expressions

This is not the case for netapi EAuth. Only exact matching is performed.

I am using CherryPy, but being that the issue is in the sum_permissions function in the netapi init, I suspect this issue is present for all netapi modules.

Setup
e.g. assuming correct ldap eauth, and a group 'FooBaz' and 'BarBaz', the following external_auth configuration:

external_auth:
  ldap:
    '.*Baz%':
      - '*':
        - 'state\.apply'
      - '@runner':
        - 'auth\.mk_token':
            args: []
            kwargs:
              'username': '.*'
              'password': '.*'
              'eauth': '^(pam|ldap|token)$'

functionality will actually fail for a user, whether they are in FooBaz, BarBaz, or both groups.

Expected functionality works perfectly fine if the same block is replicated for each explicit group, however:

external_auth:
  ldap:
    'FooBaz%':
      - '*':
        - 'state\.apply'
      - '@runner':
        - 'auth\.mk_token':
            args: []
            kwargs:
              'username': '.*'
              'password': '.*'
              'eauth': '^(pam|ldap|token)$'
    'BarBaz%':
      - '*':
        - 'state\.apply'
      - '@runner':
        - 'auth\.mk_token':
            args: []
            kwargs:
              'username': '.*'
              'password': '.*'
              'eauth': '^(pam|ldap|token)$'

Please be as specific as possible and give set-up details.

  • on-prem machine
  • VM (KVM)
  • VM running on a cloud service, please be explicit and add details
  • container (Kubernetes, Docker, containerd, etc. please specify)
  • or a combination, please be explicit
  • jails if it is FreeBSD
  • classic packaging
  • onedir packaging
  • used bootstrap to install

Steps to Reproduce the behavior
See above.

Expected behavior
Behavior matches documentation.

Screenshots
N/A

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
Salt Version:
          Salt: 3006.5

Python Version:
        Python: 3.10.13 (main, Nov 15 2023, 04:34:27) [GCC 11.2.0]

Dependency Versions:
          cffi: 1.14.6
      cherrypy: unknown
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 3.1.2
       libgit2: 1.6.4
  looseversion: 1.0.2
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.0.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     packaging: 22.0
     pycparser: 2.21
      pycrypto: Not Installed
  pycryptodome: 3.9.8
        pygit2: 1.12.1
  python-gnupg: 0.4.8
        PyYAML: 6.0.1
         PyZMQ: 23.2.0
        relenv: 0.14.2
         smmap: Not Installed
       timelib: 0.2.4
       Tornado: 4.5.3
           ZMQ: 4.3.4

System Versions:
          dist: almalinux 8.9 Midnight Oncilla
        locale: utf-8
       machine: x86_64
       release: 4.18.0-513.9.1.el8_9.x86_64
        system: Linux
       version: AlmaLinux 8.9 Midnight Oncilla

Additional context
As mentioned above, literal/exact checking is performed ONLY rather than "exact matches, shell glob patterns or regular expressions".

This is exceptionally apparent here:
https://github.com/saltstack/salt/blob/73922a7469e951ebbe68911c827f8933f8a55176/salt/netapi/__init__.py#L56
which is the only check performed whatsoever as far as I can determine.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in salt/netapi/init.py, especially the sum_permissions function and the exact membership check linked in the report. Compare its behavior with the matching syntax documented for external_auth, then run the relevant netapi and authentication tests. Done means group and username entries support the documented exact, shell-glob, and regular-expression matching across netapi modules.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.