mtodor · Apr 28, 2022 · Apr 20, 2022 · Apr 20, 2022 · Apr 21, 2022 · Apr 21, 2022
@@ -14,6 +14,7 @@ import (
 	"github.com/golang/protobuf/jsonpb"
 	"github.com/pkg/errors"
 	v1 "github.com/stackrox/rox/generated/api/v1"
+	"github.com/stackrox/rox/pkg/auth"
 	"github.com/stackrox/rox/pkg/auth/authproviders/idputil"
 	"github.com/stackrox/rox/pkg/auth/tokens"
 	"github.com/stackrox/rox/pkg/errox"
@@ -279,10 +280,10 @@ func (r *registryImpl) providersHTTPHandler(w http.ResponseWriter, req *http.Req
 		r.error(w, err, typ, clientState, testMode)
 		return
 	}
+
 	userRoles := userInfo.GetRoles()
 	if len(userRoles) == 0 {
-		err := errox.GenericNoValidRole()
-		r.error(w, err, typ, clientState, testMode)
+		r.error(w, auth.ErrNoValidRole, typ, clientState, testMode)
 		return
 	}
 

@@ -15,10 +15,10 @@ import (
 
 	pkgErrors "github.com/pkg/errors"
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/auth"
 	"github.com/stackrox/rox/pkg/auth/authproviders/idputil"
 	perm "github.com/stackrox/rox/pkg/auth/permissions"
 	"github.com/stackrox/rox/pkg/auth/tokens"
-	"github.com/stackrox/rox/pkg/errox"
 	"github.com/stackrox/rox/pkg/grpc/requestinfo"
 	"github.com/stackrox/rox/pkg/testutils/roletest"
 	"github.com/stretchr/testify/assert"
@@ -238,9 +238,7 @@ func (s *registryProviderCallbackTestSuite) TestAuthenticationRejectsUserWithout
 	redirectURLFragments, _ := url.ParseQuery(redirectURL.Fragment)
 	s.assert.Equal(s.registry.redirectURL, redirectURL.Path, "callback activated for user without role "+
 		"should redirect to the registry redirect URL")
-	callbackError := fmt.Errorf("access for this user is not authorized: %w, please contact your system administrator",
-		errox.NoValidRole)
-	s.assert.Equal(callbackError.Error(), redirectURLFragments.Get("error"),
+	s.assert.Equal(auth.ErrNoValidRole.Error(), redirectURLFragments.Get("error"),
 		"callback activated for user without role should issue an explicit message")
 }
 

@@ -0,0 +1,11 @@
+package auth
+
+import "github.com/stackrox/rox/pkg/errox"
+
+var (
+	// ErrNoValidRole indicates that though user credentials have been
+	// provided, they do not specify a valid role. This usually happens because
+	// of misconfigured access control. The effect is similar to NoCredentials.
+	ErrNoValidRole = errox.NoCredentials.New("access for this user is not authorized: no valid role," +
+		" please contact your system administrator")
+)
diff --git a/pkg/errox/errors.go b/pkg/errox/errors.go
@@ -31,11 +31,6 @@ var (
 	// been provided. The request can not be processed.
 	NoCredentials = makeSentinel("credentials not found")
 
-	// NoValidRole indicates that though user credentials have been provided,
-	// they do not specify a valid role. This usually happens because of
-	// misconfigured access control. The effect is similar to NoCredentials.
-	NoValidRole = makeSentinel("no valid role")
-
 	// NotAuthorized indicates that valid credentials have been provided but are
 	// insufficient for processing the request.
 	NotAuthorized = makeSentinel("not authorized")
@@ -46,9 +41,3 @@ var (
 
 	// When adding a new error please update the translators in this package (gRPC, etc.).
 )
-
-// GenericNoValidRole wraps NoValidRole with a generic error message.
-func GenericNoValidRole() error {
-	return NoValidRole.New("access for this user is not authorized: no valid role," +
-		" please contact your system administrator")
-}
diff --git a/pkg/errox/grpc/mapping.go b/pkg/errox/grpc/mapping.go
@@ -25,8 +25,6 @@ func RoxErrorToGRPCCode(err error) codes.Code {
 		return codes.Internal
 	case errors.Is(err, errox.NoCredentials):
 		return codes.Unauthenticated
-	case errors.Is(err, errox.NoValidRole):
-		return codes.Unauthenticated
 	case errors.Is(err, errox.NotAuthorized):
 		return codes.PermissionDenied
 	case errors.Is(err, errox.NoAuthzConfigured):

diff --git a/pkg/grpc/authn/interceptor.go b/pkg/grpc/authn/interceptor.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 
+	"github.com/stackrox/rox/pkg/auth"
 	"github.com/stackrox/rox/pkg/contextutil"
 	"github.com/stackrox/rox/pkg/errox"
 	"github.com/stackrox/rox/pkg/grpc/requestinfo"
@@ -33,7 +34,7 @@ func (u contextUpdater) updateContext(ctx context.Context) (context.Context, err
 	if id != nil {
 		// Only service identities can have no roles assigned.
 		if len(id.Roles()) == 0 && id.Service() == nil {
-			return context.WithValue(ctx, identityErrorContextKey{}, errox.GenericNoValidRole()), nil
+			return context.WithValue(ctx, identityErrorContextKey{}, auth.ErrNoValidRole), nil
 		}
 		return context.WithValue(ctx, identityContextKey{}, id), nil
 	}

diff --git a/pkg/grpc/authz/user/role.go b/pkg/grpc/authz/user/role.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/stackrox/rox/pkg/auth"
 	"github.com/stackrox/rox/pkg/auth/permissions/utils"
 	"github.com/stackrox/rox/pkg/errox"
 	"github.com/stackrox/rox/pkg/grpc/authn"
@@ -30,7 +31,7 @@ func (p *roleChecker) Authorized(ctx context.Context, _ string) error {
 
 func (p *roleChecker) checkRole(roleNames []string) error {
 	if len(roleNames) == 0 {
-		return errox.NoValidRole
+		return auth.ErrNoValidRole
 	}
 
 	for _, roleName := range roleNames {