PR#1472: Remove kerberos realm safely - fm-orchestrator

fm-orchestrator

#1472 Remove kerberos realm safely

Closed 4 years ago by cqi. Opened 4 years ago by cqi.

cqi/fm-orchestrator fix-get-kerberos-username into master

Remove kerberos realm safely

Chenxiong Qi • 4 years ago

1a12150

module_build_service/auth.py

file modified

+1 -1

		`@@ -137,7 +137,7 @@`
		`raise Unauthorized("REMOTE_USER is not properly set in the request.")`

		`# Remove the realm`
		`- username, _ = remote_user.split("@")`
		`+ username = remote_user.split("@")[0]`

		`# If the user is part of the whitelist, then the group membership check is skipped`
		`if username in conf.allowed_users:`

cqi commented 4 years ago

Whatever the REMOTE_USER has realm like someone@REALM, it is safe to just
return the first element from value returned from split.

Signed-off-by: Chenxiong Qi cqi@redhat.com

mprahl commented 4 years ago

:thumbsup:

We should eventually refactor this to take into account the realm, but since this is deployed in an environment where we don't have more than one realm that a user can come from, this is fine for now. My only concern is that if there are multiple realms that are supported and users can come from either of those realms, users with the same names would be give the same permission and it would be difficult to audit which one did what.

cqi commented 4 years ago

This is not needed anymore.

Pull-Request has been closed by cqi

4 years ago