mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-09-13 06:09:21 -04:00
Introducing gowrap as a build-time tool to generate interface delegate structs from templates: * added as a 'make go-generate' target in services/graph, * added as a build-time dependency in .bingo/ Introduce an LDAP client abstraction interface to be able to wrap the go-ldap client API with metrics transparently (and possibly hooks and such in the future), in order to use delegation patterns to measure the time LDAP (client) operations take to finish, as well as to track their results (success, failure, not-found). Has two implementations that are generated using gowrap: * a go-ldap adapter implementation that directly delegates to a go-ldap connection * a time measuring and metrics collecting implementation that delegates to another LdapClient The metrics collecting one is disabled by default, can be enabled with GRAPH_LDAP_METRICS_DISABLE=false It collects durations of outbound LDAP client operations into a histogram, as well as the number of concurrent outbound LDAP operations in a gauge (via an atomic int and a gauge function, as that performs best). Add an HTTP middleware that measures how long Graph HTTP API requests take, storing taken time into a histogram along with labels for * method, * path pattern (from the chi routes), * Graph API version prefix, * Graph API resource name, * and the resulting status code. It also tracks the number of concurrent inbound Graph API HTTP requests using a gauge (also using an atomic int and a gauge function). Disabled by default, can be enabled with GRAPH_HTTP_METRICS_DISABLE=false Add Backend and EducationBackend delegate implementations that measure execution time on the level of the higher API call operations there (CreateUser, DeleteUser, ..., CreateSchool, ...), generated using gowrap. Disabled by default, can be enabled with GRAPH_IDENTITY_BACKEND_METRICS_DISABLE=false Also added a small k6 script to produce some read-only load on the Graph API, for a casual test of the metrics, as well as k6 in mise.toml. Make an internal changes to how singular LDAP entry searches work in the LDAP identity backends: * check whether searches for a singular entry returns more than one result, in which case a new error TooManyResults is returned, instead of leaving that undetected, blindly taking the first result, and potentially risking data inconsistencies Improve the loggers in identity backends by adding attributes for their request targets (Reva gateway address or LDAP URI, respectively). Also add a "backend" attribute for all Graph API logs (set to "ldap" or "cs3"), to help debug potential issues, and remove them from all the logger debug calls at the beginning of each LDAP-related function as those should really be part of the logger and set beforehand. The LDAP identity backend logger also has two new attributes to help debugging with logs: * write (bool): whether write operations are enabled * refint (bool): whether refint is enabled or not Also adds a dedicated counter metric for user password change operations. Minor campfire improvements: * add a constructor func for the CS3 backend * add a constructor func for the LDAP backend * in the LDAP identity backend, in searchLDAPEntryByFilter (used by all search/get public functions), errors that occur when performing LDAP SEARCH operations were blindly mapped to a ItemNotFound error, instead of being analyzed as it could be caused by a technical error * in the requireadmin middleware, add debug logging to explain why a request is denied * when an LDAP password change fails because the user entry was not found in LDAP, we now have a log message that tracks that
278 lines
11 KiB
Go
278 lines
11 KiB
Go
package identity
|
|
|
|
import (
|
|
"context"
|
|
"net/url"
|
|
"time"
|
|
|
|
"github.com/CiscoM31/godata"
|
|
gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
|
|
cs3group "github.com/cs3org/go-cs3apis/cs3/identity/group/v1beta1"
|
|
cs3user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
|
|
cs3rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
|
|
libregraph "github.com/opencloud-eu/libre-graph-api-go"
|
|
"github.com/opencloud-eu/opencloud/pkg/log"
|
|
"github.com/opencloud-eu/opencloud/pkg/shared"
|
|
"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
|
|
"github.com/opencloud-eu/opencloud/services/graph/pkg/odata"
|
|
"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
|
|
)
|
|
|
|
var (
|
|
errNotImplemented = errorcode.New(errorcode.NotSupported, "not implemented")
|
|
)
|
|
|
|
type CS3 struct {
|
|
Config *shared.Reva
|
|
Logger *log.Logger
|
|
GatewaySelector pool.Selectable[gateway.GatewayAPIClient]
|
|
}
|
|
|
|
var _ Backend = &CS3{}
|
|
|
|
func NewCS3Backend(config *shared.Reva, gatewaySelector pool.Selectable[gateway.GatewayAPIClient], logger *log.Logger) (*CS3, error) {
|
|
logger = &log.Logger{Logger: logger.With().
|
|
// Str("backend", "cs3"). // already added upstream
|
|
Str("gateway", config.Address).
|
|
Logger(),
|
|
}
|
|
|
|
return &CS3{
|
|
Config: config,
|
|
GatewaySelector: gatewaySelector,
|
|
Logger: logger,
|
|
}, nil
|
|
}
|
|
|
|
// CreateUser implements the Backend Interface. It's currently not supported for the CS3 backend
|
|
func (i *CS3) CreateUser(ctx context.Context, user libregraph.User) (*libregraph.User, error) {
|
|
return nil, errNotImplemented
|
|
}
|
|
|
|
// DeleteUser implements the Backend Interface. It's currently not supported for the CS3 backend
|
|
func (i *CS3) DeleteUser(ctx context.Context, nameOrID string) error {
|
|
return errNotImplemented
|
|
}
|
|
|
|
// UpdateUser implements the Backend Interface. It's currently not supported for the CS3 backend
|
|
func (i *CS3) UpdateUser(ctx context.Context, nameOrID string, user libregraph.UserUpdate) (*libregraph.User, error) {
|
|
return nil, errNotImplemented
|
|
}
|
|
|
|
// GetUser implements the Backend Interface.
|
|
func (i *CS3) GetUser(ctx context.Context, nameOrId string, _ *godata.GoDataRequest) (*libregraph.User, error) {
|
|
logger := i.Logger.SubloggerWithRequestID(ctx)
|
|
logger.Debug().Str("backend", "cs3").Msg("GetUser")
|
|
gatewayClient, err := i.GatewaySelector.Next()
|
|
if err != nil {
|
|
logger.Error().Str("backend", "cs3").Err(err).Msg("could not get gatewayClient")
|
|
return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
|
|
}
|
|
|
|
// Try to get the user by username first
|
|
res, err := gatewayClient.GetUserByClaim(ctx, &cs3user.GetUserByClaimRequest{
|
|
Claim: "username", // FIXME add consts to reva
|
|
Value: nameOrId,
|
|
})
|
|
|
|
switch {
|
|
case err != nil:
|
|
logger.Error().Str("backend", "cs3").Err(err).Str("nameOrId", nameOrId).Msg("error sending get user by claim id grpc request: transport error")
|
|
return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
|
|
case res.GetStatus().GetCode() == cs3rpc.Code_CODE_OK:
|
|
return CreateUserModelFromCS3(res.GetUser()), nil
|
|
case res.GetStatus().GetCode() == cs3rpc.Code_CODE_NOT_FOUND:
|
|
// If the user was not found by username, try to get it by user ID
|
|
default:
|
|
logger.Debug().Str("backend", "cs3").Err(err).Str("nameOrId", nameOrId).Msg("error sending get user by claim id grpc request")
|
|
return nil, errorcode.New(errorcode.GeneralException, res.GetStatus().GetMessage())
|
|
|
|
}
|
|
|
|
// If the user was not found by username, try to get it by user ID
|
|
res, err = gatewayClient.GetUserByClaim(ctx, &cs3user.GetUserByClaimRequest{
|
|
Claim: "userid", // FIXME add consts to reva
|
|
Value: nameOrId,
|
|
})
|
|
switch {
|
|
case err != nil:
|
|
logger.Error().Str("backend", "cs3").Err(err).Str("nameOrId", nameOrId).Msg("error sending get user by claim id grpc request: transport error")
|
|
return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
|
|
case res.GetStatus().GetCode() != cs3rpc.Code_CODE_OK:
|
|
if res.GetStatus().GetCode() == cs3rpc.Code_CODE_NOT_FOUND {
|
|
return nil, errorcode.New(errorcode.ItemNotFound, res.GetStatus().GetMessage())
|
|
}
|
|
logger.Debug().Str("backend", "cs3").Err(err).Str("nameOrId", nameOrId).Msg("error sending get user by claim id grpc request")
|
|
return nil, errorcode.New(errorcode.GeneralException, res.GetStatus().GetMessage())
|
|
}
|
|
|
|
return CreateUserModelFromCS3(res.GetUser()), nil
|
|
}
|
|
|
|
// GetUsers implements the Backend Interface.
|
|
func (i *CS3) GetUsers(ctx context.Context, oreq *godata.GoDataRequest) ([]*libregraph.User, error) {
|
|
logger := i.Logger.SubloggerWithRequestID(ctx)
|
|
logger.Debug().Str("backend", "cs3").Msg("GetUsers")
|
|
gatewayClient, err := i.GatewaySelector.Next()
|
|
if err != nil {
|
|
logger.Error().Str("backend", "cs3").Err(err).Msg("could not get gatewayClient")
|
|
return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
|
|
}
|
|
|
|
search, err := odata.GetSearchValues(oreq.Query)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
res, err := gatewayClient.FindUsers(ctx, &cs3user.FindUsersRequest{
|
|
// FIXME presence match is currently not implemented, an empty search currently leads to
|
|
// Unwilling To Perform": Search Error: error parsing filter: (&(objectclass=posixAccount)(|(cn=*)(displayname=*)(mail=*))), error: Present filter match for cn not implemented
|
|
Filters: []*cs3user.Filter{
|
|
{
|
|
Type: cs3user.Filter_TYPE_QUERY,
|
|
Term: &cs3user.Filter_Query{
|
|
Query: search,
|
|
},
|
|
},
|
|
},
|
|
})
|
|
switch {
|
|
case err != nil:
|
|
logger.Error().Str("backend", "cs3").Err(err).Str("search", search).Msg("error sending find users grpc request: transport error")
|
|
return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
|
|
case res.GetStatus().GetCode() != cs3rpc.Code_CODE_OK:
|
|
if res.GetStatus().GetCode() == cs3rpc.Code_CODE_NOT_FOUND {
|
|
return nil, errorcode.New(errorcode.ItemNotFound, res.GetStatus().GetMessage())
|
|
}
|
|
logger.Debug().Str("backend", "cs3").Err(err).Str("search", search).Msg("error sending find users grpc request")
|
|
return nil, errorcode.New(errorcode.GeneralException, res.GetStatus().GetMessage())
|
|
}
|
|
|
|
users := make([]*libregraph.User, 0, len(res.GetUsers()))
|
|
|
|
for _, user := range res.GetUsers() {
|
|
users = append(users, CreateUserModelFromCS3(user))
|
|
}
|
|
|
|
return users, nil
|
|
}
|
|
|
|
// FilterUsers implements the Backend Interface. It's currently not supported for the CS3 backend
|
|
func (i *CS3) FilterUsers(_ context.Context, _ *godata.GoDataRequest, _ *godata.ParseNode) ([]*libregraph.User, error) {
|
|
return nil, errNotImplemented
|
|
}
|
|
|
|
// UpdateLastSignInDate implements the Backend Interface. It's currently not supported for the CS3 backend
|
|
func (i *CS3) UpdateLastSignInDate(ctx context.Context, userID string, timestamp time.Time) error {
|
|
return errNotImplemented
|
|
}
|
|
|
|
// GetGroups implements the Backend Interface.
|
|
func (i *CS3) GetGroups(ctx context.Context, oreq *godata.GoDataRequest) ([]*libregraph.Group, error) {
|
|
logger := i.Logger.SubloggerWithRequestID(ctx)
|
|
logger.Debug().Str("backend", "cs3").Msg("GetGroups")
|
|
gatewayClient, err := i.GatewaySelector.Next()
|
|
if err != nil {
|
|
logger.Error().Str("backend", "cs3").Err(err).Msg("could not get gatewayClient")
|
|
return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
|
|
}
|
|
|
|
search, err := odata.GetSearchValues(oreq.Query)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
res, err := gatewayClient.FindGroups(ctx, &cs3group.FindGroupsRequest{
|
|
// FIXME presence match is currently not implemented, an empty search currently leads to
|
|
// Unwilling To Perform": Search Error: error parsing filter: (&(objectclass=posixAccount)(|(cn=*)(displayname=*)(mail=*))), error: Present filter match for cn not implemented
|
|
Filters: []*cs3group.Filter{
|
|
{
|
|
Type: cs3group.Filter_TYPE_QUERY,
|
|
Term: &cs3group.Filter_Query{
|
|
Query: search,
|
|
},
|
|
},
|
|
},
|
|
})
|
|
|
|
switch {
|
|
case err != nil:
|
|
logger.Error().Str("backend", "cs3").Err(err).Str("search", search).Msg("error sending find groups grpc request: transport error")
|
|
return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
|
|
case res.Status.Code != cs3rpc.Code_CODE_OK:
|
|
if res.Status.Code == cs3rpc.Code_CODE_NOT_FOUND {
|
|
return nil, errorcode.New(errorcode.ItemNotFound, res.Status.Message)
|
|
}
|
|
logger.Debug().Str("backend", "cs3").Err(err).Str("search", search).Msg("error sending find groups grpc request")
|
|
return nil, errorcode.New(errorcode.GeneralException, res.Status.Message)
|
|
}
|
|
|
|
groups := make([]*libregraph.Group, 0, len(res.GetGroups()))
|
|
|
|
for _, group := range res.GetGroups() {
|
|
groups = append(groups, CreateGroupModelFromCS3(group))
|
|
}
|
|
|
|
return groups, nil
|
|
}
|
|
|
|
// CreateGroup implements the Backend Interface. It's currently not supported for the CS3 backend
|
|
func (i *CS3) CreateGroup(ctx context.Context, group libregraph.Group) (*libregraph.Group, error) {
|
|
return nil, errNotImplemented
|
|
}
|
|
|
|
// GetGroup implements the Backend Interface.
|
|
func (i *CS3) GetGroup(ctx context.Context, groupID string, queryParam url.Values) (*libregraph.Group, error) {
|
|
logger := i.Logger.SubloggerWithRequestID(ctx)
|
|
logger.Debug().Str("backend", "cs3").Msg("GetGroup")
|
|
gatewayClient, err := i.GatewaySelector.Next()
|
|
if err != nil {
|
|
logger.Error().Str("backend", "cs3").Err(err).Msg("could not get gatewayClient")
|
|
return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
|
|
}
|
|
|
|
res, err := gatewayClient.GetGroupByClaim(ctx, &cs3group.GetGroupByClaimRequest{
|
|
Claim: "group_id", // FIXME add consts to reva
|
|
Value: groupID,
|
|
})
|
|
|
|
switch {
|
|
case err != nil:
|
|
logger.Error().Str("backend", "cs3").Err(err).Str("groupid", groupID).Msg("error sending get group by claim id grpc request: transport error")
|
|
return nil, errorcode.New(errorcode.ServiceNotAvailable, err.Error())
|
|
case res.Status.Code != cs3rpc.Code_CODE_OK:
|
|
if res.Status.Code == cs3rpc.Code_CODE_NOT_FOUND {
|
|
return nil, errorcode.New(errorcode.ItemNotFound, res.Status.Message)
|
|
}
|
|
logger.Debug().Str("backend", "cs3").Err(err).Str("groupid", groupID).Msg("error sending get group by claim id grpc request")
|
|
return nil, errorcode.New(errorcode.GeneralException, res.Status.Message)
|
|
}
|
|
|
|
return CreateGroupModelFromCS3(res.GetGroup()), nil
|
|
}
|
|
|
|
// DeleteGroup implements the Backend Interface. It's currently not supported for the CS3 backend
|
|
func (i *CS3) DeleteGroup(ctx context.Context, id string) error {
|
|
return errNotImplemented
|
|
}
|
|
|
|
// UpdateGroupName implements the Backend Interface. It's currently not supported for the CS3 backend
|
|
func (i *CS3) UpdateGroupName(ctx context.Context, groupID string, groupName string) error {
|
|
return errNotImplemented
|
|
}
|
|
|
|
// GetGroupMembers implements the Backend Interface. It's currently not supported for the CS3 backend
|
|
func (i *CS3) GetGroupMembers(ctx context.Context, groupID string, _ *godata.GoDataRequest) ([]*libregraph.User, error) {
|
|
return nil, errNotImplemented
|
|
}
|
|
|
|
// AddMembersToGroup implements the Backend Interface. It's currently not supported for the CS3 backend
|
|
func (i *CS3) AddMembersToGroup(ctx context.Context, groupID string, memberID []string) error {
|
|
return errNotImplemented
|
|
}
|
|
|
|
// RemoveMemberFromGroup implements the Backend Interface. It's currently not supported for the CS3 backend
|
|
func (i *CS3) RemoveMemberFromGroup(ctx context.Context, groupID string, memberID string) error {
|
|
return errNotImplemented
|
|
}
|