fix(busniss): admin checker for ldap case (#1731)

tkestack · Dec 28, 2021 · be9b946 · be9b946
1 parent 79e2aba
commit be9b946
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 2 deletions.
diff --git a/pkg/auth/util/user.go b/pkg/auth/util/user.go
@@ -32,9 +32,11 @@ import (
 
 	"github.com/casbin/casbin/v2"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/util/errors"
+	authversionedclient "tkestack.io/tke/api/client/clientset/versioned/typed/auth/v1"
 )
 
 const (
@@ -245,10 +247,23 @@ func SetAdministrator(enforcer *casbin.SyncedEnforcer, localIdentity *auth.Local
 	}
 }
 
-func IsPlatformAdministrator(user authv1.User) bool {
+func IsPlatformAdministrator(authClient authversionedclient.AuthV1Interface, user authv1.User) bool {
 	if user.Spec.Extra != nil && user.Spec.Extra[administratorKey] == "true" {
 		return true
 	}
+	if authClient != nil {
+		idp, err := authClient.IdentityProviders().Get(context.TODO(), user.Spec.TenantID, metav1.GetOptions{})
+		if err != nil {
+			log.Errorf("get IdentityProviders failed: %v", err)
+			return false
+		}
+		administrators := idp.Spec.Administrators
+		for _, admin := range administrators {
+			if admin == user.Spec.Name {
+				return true
+			}
+		}
+	}
 	return false
 }
 

diff --git a/pkg/business/registry/util/auth.go b/pkg/business/registry/util/auth.go
@@ -70,7 +70,7 @@ func FilterWithUser(ctx context.Context,
 			if user.Spec.Name == userName {
 				log.Info("user", log.Any("user", user))
 				userID = user.Name
-				if authutil.IsPlatformAdministrator(user) {
+				if authutil.IsPlatformAdministrator(authClient, user) {
 					isAdmin = true
 				}
 				break