coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Map platform-root group to platform operator
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 26s
Details

Browse source
This commit is contained in:
tegwick 2026-07-29 21:30:56 +02:00
parent 41d2e1d1f6
commit 90a20783e5
2 changed files with 34 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/internal/adapters/lldap/adapter.go
View file

@ -316,8 +316,11 @@ func mapEntryToUser(entry *ldap.Entry) domain.User {
func identityEnvelopeFromGroups(groups []string) (string, []string) { func identityEnvelopeFromGroups(groups []string) (string, []string) {
tenants := make(map[string]bool) tenants := make(map[string]bool)
admins := make(map[string]bool) admins := make(map[string]bool)
platformOperator := false
for _, group := range groups { for _, group := range groups {
switch { switch {
case group == "net-kingdom-admins":
platformOperator = true
case strings.HasPrefix(group, "tenant:") && strings.HasSuffix(group, ":users"): case strings.HasPrefix(group, "tenant:") && strings.HasSuffix(group, ":users"):
tenants[strings.TrimSuffix(group, ":users")] = true tenants[strings.TrimSuffix(group, ":users")] = true
case strings.HasPrefix(group, "tenant:") && strings.HasSuffix(group, ":admins"): case strings.HasPrefix(group, "tenant:") && strings.HasSuffix(group, ":admins"):
@ -326,6 +329,12 @@ func identityEnvelopeFromGroups(groups []string) (string, []string) {
admins[tenant] = true admins[tenant] = true
} }
} }
// Preserve the established bootstrap/platform-root group as an explicit
// platform control-plane identity. Tenant envelopes must never narrow or
// ambiguously reinterpret platform authority.
if platformOperator {
return "tenant:platform", []string{"user", "platform-operator"}
}
if len(tenants) != 1 { if len(tenants) != 1 {
return "", []string{} return "", []string{}
} }

25
src/internal/adapters/lldap/adapter_test.go
View file

@ -167,6 +167,31 @@ func TestLookupUser_IgnoresAmbiguousTenantGroups(t *testing.T) {
} }
} }
func TestLookupUser_MapsEstablishedPlatformAdminGroup(t *testing.T) {
conn := &mockConn{
searchFn: func(req *ldap.SearchRequest) (*ldap.SearchResult, error) {
return singleEntryResult(
"uid=platform-root,ou=people,dc=test,dc=local",
"platform-root", "Platform", "Root", "root@example.test",
[]string{
"cn=net-kingdom-admins,ou=groups,dc=test,dc=local",
"cn=net-kingdom-users,ou=groups,dc=test,dc=local",
},
), nil
},
}
user, err := makeAdapter(testConfig(), conn).LookupUser(context.Background(), "platform-root")
if err != nil {
t.Fatal(err)
}
if user.Tenant != "tenant:platform" {
t.Fatalf("tenant = %q", user.Tenant)
}
if len(user.Roles) != 2 || user.Roles[1] != "platform-operator" {
t.Fatalf("roles = %v", user.Roles)
}
}
func TestLookupUser_DisplayName_FallsBackToSN(t *testing.T) { func TestLookupUser_DisplayName_FallsBackToSN(t *testing.T) {
dn := "uid=bob,ou=users,dc=netkingdom,dc=local" dn := "uid=bob,ou=users,dc=netkingdom,dc=local"
conn := &mockConn{ conn := &mockConn{