mirror of
https://github.com/kopia/kopia.git
synced 2026-01-25 14:58:00 -05:00
cbcd59f18e
* nit: replaced harcoded string constants with named constants * acl: added management of ACL entries * auth: implemented DefaultAuthorizer which uses ACLs if any entries are found in the system and falls back to LegacyAuthorizer if not * cli: switch to DefaultAuthorizer when starting server * cli: added ACL management * server: refactored authenticator + added refresh Authenticator is now an interface which also supports Refresh. * authz: refactored authorizer to be an interface + added Refresh() * server: refresh authentication and authorizer * e2e tests for ACLs * server: handling of SIGHUP to refresh authn/authz caches * server: reorganized flags to specify auth options: - removed '--allow-repository-users' - it's always on - one of --without-password, --server-password or --random-password can be specified to specify password for the UI user - htpasswd-file - can be specified to provide password for UI or remote users * cli: moved 'kopia user' to 'kopia server user' * server: allow all UI actions if no authenticator is set * acl: removed priority until we have a better understood use case for it * acl: added validation of allowed labels when adding ACL entries * site: added docs for ACLs
50 lines
1.1 KiB
Go
50 lines
1.1 KiB
Go
package cli
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/pkg/errors"
|
|
|
|
"github.com/kopia/kopia/internal/acl"
|
|
"github.com/kopia/kopia/internal/auth"
|
|
"github.com/kopia/kopia/repo"
|
|
)
|
|
|
|
var (
|
|
aclEnableCommand = aclCommands.Command("enable", "Enable ACLs and install default entries")
|
|
aclEnableReset = aclCommands.Flag("reset", "Reset all ACLs to default").Bool()
|
|
)
|
|
|
|
func runACLEnable(ctx context.Context, rep repo.RepositoryWriter) error {
|
|
entries, err := acl.LoadEntries(ctx, rep, nil)
|
|
if err != nil {
|
|
return errors.Wrap(err, "error loading ACL entries")
|
|
}
|
|
|
|
if len(entries) != 0 && !*aclEnableReset {
|
|
return errors.Errorf("ACLs already enabled")
|
|
}
|
|
|
|
if *aclEnableReset {
|
|
for _, e := range entries {
|
|
log(ctx).Infof("deleting previous ACL entry %v", e.ManifestID)
|
|
|
|
if err := rep.DeleteManifest(ctx, e.ManifestID); err != nil {
|
|
return errors.Wrap(err, "unable to delete previous ACL")
|
|
}
|
|
}
|
|
}
|
|
|
|
for _, e := range auth.DefaultACLs {
|
|
if err := acl.AddACL(ctx, rep, e); err != nil {
|
|
return errors.Wrap(err, "unable to add default ACL")
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func init() {
|
|
aclEnableCommand.Action(repositoryWriterAction(runACLEnable))
|
|
}
|