diff --git a/pkg/auth/authproviders/registry_httphandler.go b/pkg/auth/authproviders/registry_httphandler.go index 3f6eb48e4fcce..f95612ba0c0af 100644 --- a/pkg/auth/authproviders/registry_httphandler.go +++ b/pkg/auth/authproviders/registry_httphandler.go @@ -14,6 +14,7 @@ import ( "github.com/golang/protobuf/jsonpb" "github.com/pkg/errors" v1 "github.com/stackrox/rox/generated/api/v1" + "github.com/stackrox/rox/pkg/auth" "github.com/stackrox/rox/pkg/auth/authproviders/idputil" "github.com/stackrox/rox/pkg/auth/tokens" "github.com/stackrox/rox/pkg/errox" @@ -279,10 +280,10 @@ func (r *registryImpl) providersHTTPHandler(w http.ResponseWriter, req *http.Req r.error(w, err, typ, clientState, testMode) return } + userRoles := userInfo.GetRoles() if len(userRoles) == 0 { - err := errox.GenericNoValidRole() - r.error(w, err, typ, clientState, testMode) + r.error(w, auth.ErrNoValidRole, typ, clientState, testMode) return } diff --git a/pkg/auth/authproviders/registry_httphandler_test.go b/pkg/auth/authproviders/registry_httphandler_test.go index a7f0ecce24f01..c583dfe1845fd 100644 --- a/pkg/auth/authproviders/registry_httphandler_test.go +++ b/pkg/auth/authproviders/registry_httphandler_test.go @@ -15,10 +15,10 @@ import ( pkgErrors "github.com/pkg/errors" "github.com/stackrox/rox/generated/storage" + "github.com/stackrox/rox/pkg/auth" "github.com/stackrox/rox/pkg/auth/authproviders/idputil" perm "github.com/stackrox/rox/pkg/auth/permissions" "github.com/stackrox/rox/pkg/auth/tokens" - "github.com/stackrox/rox/pkg/errox" "github.com/stackrox/rox/pkg/grpc/requestinfo" "github.com/stackrox/rox/pkg/testutils/roletest" "github.com/stretchr/testify/assert" @@ -238,9 +238,7 @@ func (s *registryProviderCallbackTestSuite) TestAuthenticationRejectsUserWithout redirectURLFragments, _ := url.ParseQuery(redirectURL.Fragment) s.assert.Equal(s.registry.redirectURL, redirectURL.Path, "callback activated for user without role "+ "should redirect to the registry redirect URL") - callbackError := fmt.Errorf("access for this user is not authorized: %w, please contact your system administrator", - errox.NoValidRole) - s.assert.Equal(callbackError.Error(), redirectURLFragments.Get("error"), + s.assert.Equal(auth.ErrNoValidRole.Error(), redirectURLFragments.Get("error"), "callback activated for user without role should issue an explicit message") } diff --git a/pkg/auth/error.go b/pkg/auth/error.go new file mode 100644 index 0000000000000..4c6d97c9a3370 --- /dev/null +++ b/pkg/auth/error.go @@ -0,0 +1,11 @@ +package auth + +import "github.com/stackrox/rox/pkg/errox" + +var ( + // ErrNoValidRole indicates that though user credentials have been + // provided, they do not specify a valid role. This usually happens because + // of misconfigured access control. The effect is similar to NoCredentials. + ErrNoValidRole = errox.NoCredentials.New("access for this user is not authorized: no valid role," + + " please contact your system administrator") +) diff --git a/pkg/errox/errors.go b/pkg/errox/errors.go index 6270aa3c58aa4..ebe7d403705e3 100644 --- a/pkg/errox/errors.go +++ b/pkg/errox/errors.go @@ -31,11 +31,6 @@ var ( // been provided. The request can not be processed. NoCredentials = makeSentinel("credentials not found") - // NoValidRole indicates that though user credentials have been provided, - // they do not specify a valid role. This usually happens because of - // misconfigured access control. The effect is similar to NoCredentials. - NoValidRole = makeSentinel("no valid role") - // NotAuthorized indicates that valid credentials have been provided but are // insufficient for processing the request. NotAuthorized = makeSentinel("not authorized") @@ -46,9 +41,3 @@ var ( // When adding a new error please update the translators in this package (gRPC, etc.). ) - -// GenericNoValidRole wraps NoValidRole with a generic error message. -func GenericNoValidRole() error { - return NoValidRole.New("access for this user is not authorized: no valid role," + - " please contact your system administrator") -} diff --git a/pkg/errox/grpc/mapping.go b/pkg/errox/grpc/mapping.go index c311c815644d9..d28317a855afa 100644 --- a/pkg/errox/grpc/mapping.go +++ b/pkg/errox/grpc/mapping.go @@ -25,8 +25,6 @@ func RoxErrorToGRPCCode(err error) codes.Code { return codes.Internal case errors.Is(err, errox.NoCredentials): return codes.Unauthenticated - case errors.Is(err, errox.NoValidRole): - return codes.Unauthenticated case errors.Is(err, errox.NotAuthorized): return codes.PermissionDenied case errors.Is(err, errox.NoAuthzConfigured): diff --git a/pkg/grpc/authn/interceptor.go b/pkg/grpc/authn/interceptor.go index b17eb7629d402..a86ff3fcc8ba7 100644 --- a/pkg/grpc/authn/interceptor.go +++ b/pkg/grpc/authn/interceptor.go @@ -4,6 +4,7 @@ import ( "context" "errors" + "github.com/stackrox/rox/pkg/auth" "github.com/stackrox/rox/pkg/contextutil" "github.com/stackrox/rox/pkg/errox" "github.com/stackrox/rox/pkg/grpc/requestinfo" @@ -33,7 +34,7 @@ func (u contextUpdater) updateContext(ctx context.Context) (context.Context, err if id != nil { // Only service identities can have no roles assigned. if len(id.Roles()) == 0 && id.Service() == nil { - return context.WithValue(ctx, identityErrorContextKey{}, errox.GenericNoValidRole()), nil + return context.WithValue(ctx, identityErrorContextKey{}, auth.ErrNoValidRole), nil } return context.WithValue(ctx, identityContextKey{}, id), nil } diff --git a/pkg/grpc/authz/user/role.go b/pkg/grpc/authz/user/role.go index ddca033e78173..107a6ff7b3ea7 100644 --- a/pkg/grpc/authz/user/role.go +++ b/pkg/grpc/authz/user/role.go @@ -4,6 +4,7 @@ import ( "context" "fmt" + "github.com/stackrox/rox/pkg/auth" "github.com/stackrox/rox/pkg/auth/permissions/utils" "github.com/stackrox/rox/pkg/errox" "github.com/stackrox/rox/pkg/grpc/authn" @@ -30,7 +31,7 @@ func (p *roleChecker) Authorized(ctx context.Context, _ string) error { func (p *roleChecker) checkRole(roleNames []string) error { if len(roleNames) == 0 { - return errox.NoValidRole + return auth.ErrNoValidRole } for _, roleName := range roleNames {