chore(auth): ci security enhancement (#655)

ideal-world · Mar 22, 2024 · b06b979 · b06b979
1 parent 0438b5a
commit b06b979
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 1 deletion.
diff --git a/support/auth/src/dto/auth_kernel_dto.rs b/support/auth/src/dto/auth_kernel_dto.rs
@@ -322,6 +322,7 @@ pub struct ResAuthInfo {
     pub groups: Option<String>,
     pub apps: Option<String>,
     pub tenants: Option<String>,
+    pub ak: Option<String>,
     pub st: Option<i64>,
     pub et: Option<i64>,
 }

diff --git a/support/auth/src/serv/auth_kernel_serv.rs b/support/auth/src/serv/auth_kernel_serv.rs
@@ -464,6 +464,13 @@ pub async fn do_auth(ctx: &AuthContext) -> TardisResult<Option<ResContainerLeafI
                 }
             }
         }
+        if let Some(matched_aks) = &auth.ak {
+            if let Some(iam_ak) = &ctx.ak {
+                if matched_aks.contains(&format!("#{iam_ak}#")) || matched_aks.contains(&"#*#".to_string()) {
+                    return Ok(Some(matched_res));
+                }
+            }
+        }
     } else {
         return Ok(Some(matched_res));
     }

diff --git a/support/iam/src/console_interface/api/iam_ci_cert_api.rs b/support/iam/src/console_interface/api/iam_ci_cert_api.rs
@@ -33,7 +33,7 @@ pub struct IamCiLdapCertApi;
 /// # Interface Console Manage Cert API
 ///
 /// Allow Management Of aksk (an authentication method between applications)
-#[poem_openapi::OpenApi(prefix_path = "/ci/manage", tag = "bios_basic::ApiTag::Interface")]
+#[poem_openapi::OpenApi(prefix_path = "/private/ci/manage", tag = "bios_basic::ApiTag::Interface")]
 impl IamCiCertManageApi {
     /// Add aksk Cert
     #[oai(path = "/aksk", method = "post")]