grpc
/
grpc-java
mirror of https://github.com/grpc/grpc-java.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rbac: fix status code PERMISSION_DENIED (#8578) 

RBAC should fail with PERMISSION_DENIED, fix https://github.com/grpc/grpc-java/issues/8576
This commit is contained in:
yifeizhuang 2021-10-06 11:02:42 -07:00 committed by GitHub
parent 2e84b0f20a
commit e939bf6fb8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
xds/src/main/java/io/grpc/xds/RbacFilter.java
View File

@ -177,14 +177,13 @@ final class RbacFilter implements Filter, ServerInterceptorBuilder {
final ServerCall<ReqT, RespT> call, final ServerCall<ReqT, RespT> call,
final Metadata headers, ServerCallHandler<ReqT, RespT> next) { final Metadata headers, ServerCallHandler<ReqT, RespT> next) {
AuthDecision authResult = authEngine.evaluate(headers, call); AuthDecision authResult = authEngine.evaluate(headers, call);
if (logger.isLoggable(Level.FINER)) { if (logger.isLoggable(Level.FINE)) {
logger.log(Level.FINER, logger.log(Level.FINE,
"Authorization result for serverCall {0}: {1}, matching policy: {2}.", "Authorization result for serverCall {0}: {1}, matching policy: {2}.",
new Object[]{call, authResult.decision(), authResult.matchingPolicyName()}); new Object[]{call, authResult.decision(), authResult.matchingPolicyName()});
} }
if (GrpcAuthorizationEngine.Action.DENY.equals(authResult.decision())) { if (GrpcAuthorizationEngine.Action.DENY.equals(authResult.decision())) {
Status status = Status.UNAUTHENTICATED.withDescription( Status status = Status.PERMISSION_DENIED.withDescription("Access Denied");
"Access Denied, matching policy: " + authResult.matchingPolicyName());
call.close(status, new Metadata()); call.close(status, new Metadata());
return new ServerCall.Listener<ReqT>(){}; return new ServerCall.Listener<ReqT>(){};
} }

3
xds/src/test/java/io/grpc/xds/RbacFilterTest.java
View File

@ -256,7 +256,8 @@ public class RbacFilterTest {
verify(mockHandler, never()).startCall(eq(mockServerCall), any(Metadata.class)); verify(mockHandler, never()).startCall(eq(mockServerCall), any(Metadata.class));
ArgumentCaptor<Status> captor = ArgumentCaptor.forClass(Status.class); ArgumentCaptor<Status> captor = ArgumentCaptor.forClass(Status.class);
verify(mockServerCall).close(captor.capture(), any(Metadata.class)); verify(mockServerCall).close(captor.capture(), any(Metadata.class));
assertThat(captor.getValue().getCode()).isEqualTo(Status.UNAUTHENTICATED.getCode()); assertThat(captor.getValue().getCode()).isEqualTo(Status.PERMISSION_DENIED.getCode());
assertThat(captor.getValue().getDescription()).isEqualTo("Access Denied");
verify(mockServerCall).getAttributes(); verify(mockServerCall).getAttributes();
verifyNoMoreInteractions(mockServerCall); verifyNoMoreInteractions(mockServerCall);