feat: Add way to forbid an oidc authorization access item in list

oxyno-zeta · oxyno-zeta · commit 099c26afc782 · 2024-08-16T23:13:12.000+02:00
diff --git a/docs/configuration/structure.md b/docs/configuration/structure.md
@@ -424,11 +424,12 @@ This authentication method should be used only with a software like [Oauth2-prox
 
 ## HeaderOIDCAuthorizationAccesses
 
-| Key    | Type    | Required               | Default | Description                                    |
-| ------ | ------- | ---------------------- | ------- | ---------------------------------------------- |
-| group  | String  | Required without email | None    | Group name                                     |
-| email  | String  | Required without group | None    | Email                                          |
-| regexp | Boolean | No                     | `false` | Consider group or email as regexp for matching |
+| Key       | Type    | Required               | Default | Description                                                                                                                                                                      |
+| --------- | ------- | ---------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| group     | String  | Required without email | None    | Group name                                                                                                                                                                       |
+| email     | String  | Required without group | None    | Email                                                                                                                                                                            |
+| regexp    | Boolean | No                     | `false` | Consider group or email as regexp for matching                                                                                                                                   |
+| forbidden | Boolean | No                     | `false` | This will consider anything matching group or email as a forbidden matching (regex enabled or not). This have been done because there isn't way to do a negative match on regex. |
 
 ## ResourceBasic
 
diff --git a/docs/feature-guide/authorization-accesses.md b/docs/feature-guide/authorization-accesses.md
@@ -156,3 +156,42 @@ Accesses will be:
 - Jean Dupont: authorized
 - Astérix: authorized
 - Obélix: forbidden
+
+### Forbidden case
+
+<!-- prettier-ignore-start -->
+!!! note
+
+    This have been done because there isn't any way of doing a negative match on regex. The only way is to match a regex with a forbidden flag enabled.
+<!-- prettier-ignore-end -->
+
+Example of authorization accesses configuration:
+
+```yaml
+targets:
+  target1:
+    resources:
+      - path: /*
+        provider: provider1
+        oidc:
+          authorizationAccesses:
+            - email: asterix@fake.com
+              regex: true
+              forbidden: true
+            - email: .*@fake.com
+              regex: true
+     bucket:
+       ...
+```
+
+We consider those users:
+
+- Jean Dupont with `jean.dupont@fake.com` email
+- Astérix with `asterix@fake.com` email
+- Obélix with `obelix@another.com` email
+
+Accesses will be:
+
+- Jean Dupont: authorized
+- Astérix: forbidden because it is marked as forbidden and it is the first in the list
+- Obélix: forbidden
diff --git a/pkg/s3-proxy/authx/authorization/header-oidc.go b/pkg/s3-proxy/authx/authorization/header-oidc.go
@@ -21,27 +21,27 @@ func isHeaderOIDCAuthorizedBasic(groups []string, email string, authorizationAcc
 				for _, grp := range groups {
 					// Try matching for group regexp
 					if item.GroupRegexp.MatchString(grp) {
-						return true
+						return !item.Forbidden
 					}
 				}
 			}
 
 			// Check email case
 			if item.Email != "" && item.EmailRegexp.MatchString(email) {
-				return true
+				return !item.Forbidden
 			}
 		} else {
 			// Not a regex case
 			// Check group case
 			if item.Group != "" {
 				result := funk.Contains(groups, item.Group)
 				if result {
-					return true
+					return !item.Forbidden
 				}
 			}
 			// Check email case
 			if item.Email != "" && item.Email == email {
-				return true
+				return !item.Forbidden
 			}
 		}
 	}
diff --git a/pkg/s3-proxy/authx/authorization/header-oidc_test.go b/pkg/s3-proxy/authx/authorization/header-oidc_test.go
@@ -176,6 +176,42 @@ func Test_isHeaderOIDCAuthorizedBasic(t *testing.T) {
 			},
 			want: true,
 		},
+		{
+			name: "should be forbidden if email regexp is matching but forbidden",
+			args: args{
+				groups: make([]string, 0),
+				email:  "email@valid.test",
+				authorizationAccesses: []*config.HeaderOIDCAuthorizationAccess{
+					{
+						Regexp:      true,
+						Email:       ".*@valid.test",
+						EmailRegexp: regexp.MustCompile(".*@valid.test"),
+						Forbidden:   true,
+					},
+				},
+			},
+			want: false,
+		},
+		{
+			name: "should be forbidden if email regexp is matching but forbidden but second have ok for groups",
+			args: args{
+				groups: []string{"grp1"},
+				email:  "email@valid.test",
+				authorizationAccesses: []*config.HeaderOIDCAuthorizationAccess{
+					{
+						Regexp:      true,
+						Email:       ".*@valid.test",
+						EmailRegexp: regexp.MustCompile(".*@valid.test"),
+						Forbidden:   true,
+					},
+					{
+						Regexp: true,
+						Group:  "grp1",
+					},
+				},
+			},
+			want: false,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/pkg/s3-proxy/config/config.go b/pkg/s3-proxy/config/config.go
@@ -210,9 +210,10 @@ type OIDCAuthConfig struct {
 type HeaderOIDCAuthorizationAccess struct {
 	GroupRegexp *regexp.Regexp `json:"-"`
 	EmailRegexp *regexp.Regexp `json:"-"`
-	Group       string         `json:"group"  mapstructure:"group"  validate:"required_without=Email"`
-	Email       string         `json:"email"  mapstructure:"email"  validate:"required_without=Group"`
-	Regexp      bool           `json:"regexp" mapstructure:"regexp"`
+	Group       string         `json:"group"     mapstructure:"group"     validate:"required_without=Email"`
+	Email       string         `json:"email"     mapstructure:"email"     validate:"required_without=Group"`
+	Regexp      bool           `json:"regexp"    mapstructure:"regexp"`
+	Forbidden   bool           `json:"forbidden" mapstructure:"forbidden"`
 }
 
 // BasicAuthConfig Basic auth configurations.

Original file line number	Diff line number	Diff line change
`@@ -21,27 +21,27 @@ func isHeaderOIDCAuthorizedBasic(groups []string, email string, authorizationAcc`
`21`	`21`	`for _, grp := range groups {`
`22`	`22`	`// Try matching for group regexp`
`23`	`23`	`if item.GroupRegexp.MatchString(grp) {`
`24`		`- return true`
	`24`	`+ return !item.Forbidden`
`25`	`25`	`}`
`26`	`26`	`}`
`27`	`27`	`}`
`28`	`28`
`29`	`29`	`// Check email case`
`30`	`30`	`if item.Email != "" && item.EmailRegexp.MatchString(email) {`
`31`		`- return true`
	`31`	`+ return !item.Forbidden`
`32`	`32`	`}`
`33`	`33`	`} else {`
`34`	`34`	`// Not a regex case`
`35`	`35`	`// Check group case`
`36`	`36`	`if item.Group != "" {`
`37`	`37`	`result := funk.Contains(groups, item.Group)`
`38`	`38`	`if result {`
`39`		`- return true`
	`39`	`+ return !item.Forbidden`
`40`	`40`	`}`
`41`	`41`	`}`
`42`	`42`	`// Check email case`
`43`	`43`	`if item.Email != "" && item.Email == email {`
`44`		`- return true`
	`44`	`+ return !item.Forbidden`
`45`	`45`	`}`
`46`	`46`	`}`
`47`	`47`	`}`