mirror of
https://github.com/Velocidex/velociraptor.git
synced 2026-10-12 02:09:59 +00:00
Mike Cohen
50bc93ae47
Most of the time people want the OIDC automated roles to be able to remove access from users, which was not the way it was implemented previously (roles were set by OIDC as the minimum role but users could be given higher roles). This PR also adds claims from the ID token which can be used on Azure to add custom claims in addition to te access token.
58 lines
1.2 KiB
Go
58 lines
1.2 KiB
Go
package acls
|
|
|
|
import (
|
|
"reflect"
|
|
"sort"
|
|
|
|
acl_proto "www.velocidex.com/golang/velociraptor/acls/proto"
|
|
"www.velocidex.com/golang/velociraptor/utils"
|
|
)
|
|
|
|
func ACLEqual(a, b *acl_proto.ApiClientACL) bool {
|
|
sort.Strings(a.Roles)
|
|
sort.Strings(b.Roles)
|
|
|
|
return utils.StringSliceEq(a.Roles, b.Roles) && a == b
|
|
}
|
|
|
|
func CopyACL(old *acl_proto.ApiClientACL) *acl_proto.ApiClientACL {
|
|
res := *old
|
|
res.Roles = utils.CopySlice(old.Roles)
|
|
return &res
|
|
}
|
|
|
|
// Merge the new ACL into the old
|
|
func MergeACL(old, new *acl_proto.ApiClientACL) *acl_proto.ApiClientACL {
|
|
old = CopyACL(old)
|
|
|
|
old.Roles = utils.DeduplicateStringSlice(append(old.Roles, new.Roles...))
|
|
|
|
// Now set the individual ACLs
|
|
old_value := reflect.Indirect(reflect.ValueOf(old))
|
|
new_value := reflect.Indirect(reflect.ValueOf(new))
|
|
|
|
res_type := old_value.Type()
|
|
for i := 0; i < res_type.NumField(); i++ {
|
|
field := res_type.Field(i)
|
|
if !field.IsExported() {
|
|
continue
|
|
}
|
|
|
|
if field.Type.Kind() != reflect.Bool {
|
|
continue
|
|
}
|
|
|
|
old_value := old_value.FieldByName(field.Name)
|
|
old_bool := old_value.Interface().(bool)
|
|
if !old_bool {
|
|
new_value := new_value.FieldByName(field.Name)
|
|
new_bool := new_value.Interface().(bool)
|
|
if new_bool {
|
|
old_value.SetBool(true)
|
|
}
|
|
}
|
|
}
|
|
|
|
return old
|
|
}
|