Nc iam roles ldap

docs/NooBaaNonContainerized/ldap_non_containerised.md

@@ -203,7 +203,7 @@ sudo node src/cmd/manage_nsfs.js account add \
   --new_buckets_path /private/tmp/noobaa-buckets
 ```
 
-2. Create a role with a Federated trust policy. `Principal.Federated` must match the LDAP URI in `ldap_config` (scheme is stripped when matching). Optional `Condition` blocks restrict by LDAP attributes such as `ou` or `memberOf`:
+2. Create a role with a Federated trust policy. `Principal.Federated` must be arn:aws:iam:::ldap-provider/<host>[:port]; host:port must match ldap_config.uri after :// (scheme is stripped when matching). Optional `Condition` blocks restrict by LDAP attributes such as `ou` or `memberOf`:
 
 ```bash
 export OWNER_ACCESS_KEY=<owner-access-key>
@@ -215,7 +215,7 @@ cat > /tmp/ldap-trust-policy.json <<'EOF'
   "Version": "2012-10-17",
   "Statement": [{
     "Effect": "Allow",
-    "Principal": { "Federated": "ldaps://127.0.0.1:1636" },
+    "Principal": { "Federated": "arn:aws:iam:::ldap-provider/127.0.0.1:1636" },
     "Action": "sts:AssumeRoleWithWebIdentity"
   }]
 }
@@ -437,7 +437,7 @@ ldapsearch -H "$LDAP_URI" -x \
 | Symptom | Check |
 | --- | --- |
 | `NO_SUCH_ROLE` | IAM role exists under the owner account (`CreateRole`); ARN owner id + role name match. For legacy: account has `role_config` and `role_name` matches. |
-| Access denied after LDAP bind | Trust policy `Principal.Federated` URI matches `ldap_config.uri` (scheme stripped). `Condition` (`ldap:ou` / `ldap:memberOf`) matches bind attributes. |
+| Access denied after LDAP bind | Trust policy `Principal.Federated` ARN matches `ldap_config.uri` (scheme stripped). `Condition` (`ldap:ou` / `ldap:memberOf`) matches bind attributes. |
 | `issue with LDAP authentication` | Wrong username/password; check `search_dn` and `dn_attribute` |
 
 ```bash

docs/design/iam_nc.md

@@ -342,13 +342,13 @@ Used when an external identity provider (LDAP etc.) authenticates the user. NooB
   "Version": "2012-10-17",
   "Statement": [{
     "Effect": "Allow",
-    "Principal": { "Federated": "ldap://127.0.0.1:1389" },
+    "Principal": { "Federated": "arn:aws:iam:::ldap-provider/127.0.0.1:1636" },
     "Action": "sts:AssumeRoleWithWebIdentity"
   }]
 }
 ```
 
-The `Federated` value must match the LDAP server URI in `/etc/noobaa-server/ldap_config`. Matching strips the `ldap://` / `ldaps://` prefix.
+The `Federated` value must be arn:aws:iam:::ldap-provider/<host>[:port] and host:port must match the LDAP server URI in `/etc/noobaa-server/ldap_config`. Matching strips the `ldap://` / `ldaps://` prefix.
 
 ##### LDAP group / attribute conditions
 
@@ -366,7 +366,7 @@ Condition keys use the `ldap:<attribute>` format. NooBaa strips the `ldap:` pref
   "Version": "2012-10-17",
   "Statement": [{
     "Effect": "Allow",
-    "Principal": { "Federated": "ldap://127.0.0.1:1389" },
+    "Principal": { "Federated": "arn:aws:iam:::ldap-provider/127.0.0.1:1636" },
     "Action": "sts:AssumeRoleWithWebIdentity",
     "Condition": {
       "StringEquals": { "ldap:ou": "Delivering Crew" }
@@ -382,7 +382,7 @@ Condition keys use the `ldap:<attribute>` format. NooBaa strips the `ldap:` pref
   "Version": "2012-10-17",
   "Statement": [{
     "Effect": "Allow",
-    "Principal": { "Federated": "ldap://127.0.0.1:1389" },
+    "Principal": { "Federated": "arn:aws:iam:::ldap-provider/127.0.0.1:1636" },
     "Action": "sts:AssumeRoleWithWebIdentity",
     "Condition": {
       "ForAnyValue:StringEquals": {
@@ -403,7 +403,7 @@ Condition keys use the `ldap:<attribute>` format. NooBaa strips the `ldap:` pref
   "Version": "2012-10-17",
   "Statement": [{
     "Effect": "Allow",
-    "Principal": { "Federated": "ldap://127.0.0.1:1389" },
+    "Principal": { "Federated": "arn:aws:iam:::ldap-provider/127.0.0.1:1636" },
     "Action": "sts:AssumeRoleWithWebIdentity",
     "Condition": {
       "StringEquals": { "ldap:ou": "Delivering Crew" },
@@ -423,15 +423,15 @@ Condition keys use the `ldap:<attribute>` format. NooBaa strips the `ldap:` pref
   "Statement": [
     {
       "Effect": "Allow",
-      "Principal": { "Federated": "ldap://127.0.0.1:1389" },
+      "Principal": { "Federated": "arn:aws:iam:::ldap-provider/127.0.0.1:1636" },
       "Action": "sts:AssumeRoleWithWebIdentity",
       "Condition": {
         "StringEquals": { "ldap:ou": "Delivering Crew" }
       }
     },
     {
       "Effect": "Allow",
-      "Principal": { "Federated": "ldap://127.0.0.1:1389" },
+      "Principal": { "Federated": "arn:aws:iam:::ldap-provider/127.0.0.1:1636" },
       "Action": "sts:AssumeRoleWithWebIdentity",
       "Condition": {
         "ForAnyValue:StringEquals": {
@@ -492,7 +492,7 @@ NooBaa STS
         │       └─ look up role entity via config_fs / AccountSpaceFS
         │          [Phase 2: look up standalone role entity by owner_id, role_name]
         ├─► 5. [TODO] Evaluate trust policy
-        │       ├─ Principal fit  (Federated URI match / "*" / AWS ARN)
+        │       ├─ Principal fit  (Federated ldap-provider ARN match / "*" / AWS ARN)
         │       ├─ Action fit     (sts:AssumeRoleWithWebIdentity)
         │       └─ Condition fit  (e.g. ldap:ou == "Engineering")
         └─► 6. Issue temporary credentials (AccessKeyId + SecretAccessKey + SessionToken)
@@ -599,7 +599,7 @@ Phase 2 — append `iam_role_policies`:
 ### Code Changes
 
 1. Implement all role CRUD methods in `src/sdk/accountspace_fs.js` and `config_fs.js`
-2. Add support for `Principal.Federated` in trust-policy evaluation (`_is_principal_fit()` / access policy utils) — LDAP URI match and OIDC/`iss` match
+2. Add support for `Principal.Federated` in trust-policy evaluation (`_is_principal_fit()` / access policy utils) — LDAP ARN match and OIDC/`iss` match
 3. Load `assume_role_policy_document` from role entity via `config_fs` / **role cache** (same pattern as account cache)
 4. Implement LDAP and Keycloak condition evaluation for trust policy (`_is_identity_condition_fit`) — including `ldap:ou` / `ldap:memberOf`
 5. Schema changes for roles (`name`, `owner`, `assume_role_policy_document`, …)

src/api/common_api.js

@@ -117,6 +117,11 @@ module.exports = {
             enum: ['DISABLED', 'SUSPENDED', 'ENABLED']
         },
 
+        identity_type: {
+            type: 'string',
+            enum: ['ACCOUNT', 'USER', 'ROLE']
+        },
+
         assume_role_policy: {
             type: 'object',
             required: ['statement'],

src/endpoint/iam/iam_utils.js

@@ -6,7 +6,8 @@ const s3_utils = require('../s3/s3_utils');
 const { IamError } = require('./iam_errors');
 const { AWS_IAM_PATH_REGEXP, AWS_IAM_LIST_MARKER, AWS_IAM_ACCESS_KEY_INPUT_REGEXP, AWS_POLICY_NAME_REGEXP,
     AWS_POLICY_DOCUMENT_REGEXP, AWS_POLICY_SID_REGEXP, AWS_ROLE_NAME_REGEXP, AWS_ROLE_DESCRIPTION_REGEXP,
-    AWS_OIDC_PROVIDER_ARN_REGEXP } = require('../../util/string_utils');
+    AWS_OIDC_PROVIDER_ARN_REGEXP, AWS_LDAP_PROVIDER_ARN_REGEXP
+} = require('../../util/string_utils');
 const iam_constants = require('./iam_constants');
 const { RpcError } = require('../../rpc');
 const validation_utils = require('../../util/validation_utils');
@@ -1121,8 +1122,9 @@ function _validate_policy_document_iam_structure(policy_document) {
  * Specifically:
  *  - Version must be '2012-10-17' or '2008-10-17'.
  *  - Statement must be a non-empty array.
- *  - Principal.Federated entries, when present, must conform to the OIDC-provider ARN format:
- *      eg: arn:aws:iam::<12-digit-account-id>:oidc-provider/<provider-url> or arn:aws:iam:::oidc-provider/<provider-url>
+ *  - Principal.Federated entries, when present, must conform to the OIDC-provider or LDAP-provider ARN format:
+ *      - OIDC ARN: arn:aws:iam::<12-digit-account-id>:oidc-provider/<provider-url> or arn:aws:iam:::oidc-provider/<provider-url>
+ *      - LDAP ARN: arn:aws:iam::<account-id?>:ldap-provider/<host>[:port]
  *
  * @param {object} policy_document - parsed trust policy JSON
  */
@@ -1149,10 +1151,13 @@ function _validate_assume_role_policy_document_iam_structure(policy_document) {
         if (federated !== undefined) {
             const entries = Array.isArray(federated) ? federated : [federated];
             for (const entry of entries) {
-                if (typeof entry !== 'string' || !AWS_OIDC_PROVIDER_ARN_REGEXP.test(entry)) {
+                const is_oidc = typeof entry === 'string' && AWS_OIDC_PROVIDER_ARN_REGEXP.test(entry);
+                const is_ldap = typeof entry === 'string' && AWS_LDAP_PROVIDER_ARN_REGEXP.test(entry);
+                if (!is_oidc && !is_ldap) {
                     throw_malformed_policy_document_error(
                         'Invalid Federated principal. ' +
-                        'Expected format: arn:aws:iam::<12-digit-account-id>:oidc-provider/<provider-url>'
+                        'Expected format: arn:aws:iam::<12-digit-account-id>:oidc-provider/<provider-url> ' +
+                        'or arn:aws:iam::<account-id>:ldap-provider/<host>[:port] '
                     );
                 }
             }

src/endpoint/sts/sts_rest.js

@@ -117,8 +117,7 @@ async function authenticate_request(req) {
         signature_utils.authenticate_request_by_service(req, req.sts_sdk);
         if (req.op_name === 'post_assume_role_with_web_identity') {
             const web_identity_info = access_policy_utils.fetch_web_identity_info(req);
-            const is_ldap_request = web_identity_info.username;
-            if (is_ldap_request) {
+            if (access_policy_utils._is_ldap_web_identity(web_identity_info)) {
                 // fetch LDAP identity info
                 req.sts_sdk.identity_info = await req.sts_sdk.authenticate_web_identity(req);
             }

src/manage_nsfs/manage_nsfs_cli_errors.js

@@ -251,10 +251,10 @@ ManageCLIError.AccountDeleteForbiddenHasBuckets = Object.freeze({
     http_code: 403,
 });
 
-ManageCLIError.AccountDeleteForbiddenHasIAMAccounts = Object.freeze({
-    code: 'AccountDeleteForbiddenHasIAMAccounts',
-    message: 'Cannot delete account that is owner of IAM accounts. ' +
-        'You must delete all IAM accounts before deleting the root account',
+ManageCLIError.AccountDeleteForbiddenHasIAMUsers = Object.freeze({
+    code: 'AccountDeleteForbiddenHasIAMUsers',
+    message: 'Cannot delete account that is owner of IAM users. ' +
+        'You must delete all IAM users before deleting the root account',
     http_code: 403,
 });
 
@@ -604,7 +604,7 @@ const NSFS_CLI_ERROR_EVENT_MAP = {
     AccountAccessKeyAlreadyExists: NoobaaEvent.ACCOUNT_ALREADY_EXISTS,
     AccountNameAlreadyExists: NoobaaEvent.ACCOUNT_ALREADY_EXISTS,
     AccountDeleteForbiddenHasBuckets: NoobaaEvent.ACCOUNT_DELETE_FORBIDDEN,
-    AccountDeleteForbiddenHasIAMAccounts: NoobaaEvent.ACCOUNT_DELETE_FORBIDDEN,
+    AccountDeleteForbiddenHasIAMUsers: NoobaaEvent.ACCOUNT_DELETE_FORBIDDEN,
     AccountDeleteForbiddenHasIAMRoles: NoobaaEvent.ACCOUNT_DELETE_FORBIDDEN,
     BucketAlreadyExists: NoobaaEvent.BUCKET_ALREADY_EXISTS,
     BucketSetForbiddenBucketOwnerNotExists: NoobaaEvent.BUCKET_OWNER_NOT_EXISTS,

src/manage_nsfs/manage_nsfs_validations.js

@@ -659,7 +659,7 @@ async function validate_account_args(config_fs, data, action, is_flag_iam_operat
  */
 async function validate_account_resources_before_deletion(config_fs, data) {
     await validate_account_not_owns_buckets(config_fs, data);
-    // If it is root account (not owned by other account) then we check that it doesn't owns IAM accounts
+    // If it is root account (not owned by other account) then we check that it doesn't owns IAM users
     if (data.owner === undefined) {
         await check_if_root_account_does_not_have_IAM_users(config_fs, data, ACTIONS.DELETE);
         await validate_account_not_owns_roles(config_fs, data);
@@ -739,7 +739,7 @@ async function check_if_root_account_does_not_have_IAM_users(config_fs, account_
         if (is_root_account_owns_user) {
             const detail_msg = `Account ${account_to_check.name} has IAM account ${account_data.name}`;
             if (action === ACTIONS.DELETE) {
-                throw_cli_error(ManageCLIError.AccountDeleteForbiddenHasIAMAccounts, detail_msg);
+                throw_cli_error(ManageCLIError.AccountDeleteForbiddenHasIAMUsers, detail_msg);
             }
             // else it is called with action ACTIONS.UPDATE
             throw_cli_error(ManageCLIError.AccountCannotBeRootAccountsManager, detail_msg);

src/sdk/accountspace_fs.js

@@ -942,7 +942,7 @@ class AccountSpaceFS {
             _id: generate_id(),
             name: params.role_name,
             email: params.role_name,
-            type: 'role',
+            identity_type: 'ROLE',
             owner: requesting_account._id,
             iam_path: params.iam_path || IAM_DEFAULT_PATH,
             creation_date: new Date().toISOString(),

src/sdk/sts_sdk.js

@@ -154,7 +154,7 @@ class StsSDK {
      * @param {Object} req - Request object
      */
     async get_assumed_ldap_user(req) {
-        const ldap_auth_result = await this.authenticate_web_identity(req);
+        const ldap_auth_result = this.identity_info || await this.authenticate_web_identity(req);
         const role_config = await this._assume_role(req.body.role_arn);
         dbg.log0('sts_sdk.get_assumed_role_with_web_identity res', 'account.role_config: ', role_config);
         return {

src/server/system_services/schemas/nsfs_account_schema.js

@@ -126,10 +126,9 @@ module.exports = {
         assume_role_policy_document: {
             $ref: 'common_api#/definitions/iam_trust_policy_document',
         },
-        type: {
+        identity_type: {
             // to make consistent with containerized
-            type: 'string',
-            enum: ['account', 'user', 'role'],
+            $ref: 'common_api#/definitions/identity_type',
         }
     }
 };

src/test/integration_tests/api/sts/test_sts.js

@@ -863,7 +863,7 @@ mocha.describe('Assume role with web indentity tests', function() {
             RoleArn: `arn:aws:sts::ldap:role/${user_a}`,
             RoleSessionName: 'just_a_dummy_session_name',
             WebIdentityToken: bad_signed_wit
-        })), stsErr.AccessDeniedException.code, stsErr.AccessDeniedException.message);
+        })), stsErr.InvalidIdentityToken.code, 'invalid signature');
     });
 
     mocha.it('anonymous user a with missing password - should be rejected', async function() {

src/test/integration_tests/nc/cli/test_nc_account_cli.test.js

@@ -1763,7 +1763,7 @@ describe('manage nsfs cli account flow', () => {
             expect(JSON.parse(res.stdout).error.code).toBe(ManageCLIError.MissingAccountNameFlag.code);
         });
 
-        it('should fail - cli account delete - root account has IAM accounts', async function() {
+        it('should fail - cli account delete - root account has IAM users', async function() {
             const { name, type } = defaults;
             const accounts_details = await config_fs.get_account_by_name(name, config_fs_account_options);
             const account_id = accounts_details._id;
@@ -1780,7 +1780,7 @@ describe('manage nsfs cli account flow', () => {
             const action = ACTIONS.DELETE;
             const account_options2 = { config_root, name };
             const res = await exec_manage_cli(type, action, account_options2);
-            expect(JSON.parse(res.stdout).error.code).toBe(ManageCLIError.AccountDeleteForbiddenHasIAMAccounts.code);
+            expect(JSON.parse(res.stdout).error.code).toBe(ManageCLIError.AccountDeleteForbiddenHasIAMUsers.code);
         });
 
         it('should fail - cli account delete - account has IAM roles, then succeed after role delete', async function() {

src/test/unit_tests/nsfs/test_accountspace_fs.test.js

@@ -1081,7 +1081,7 @@ describe('Accountspace_FS tests', () => {
                 expect(role_config_file.name).toBe(dummy_role1.role_name);
                 expect(role_config_file._id).toBe(res.role_id);
                 expect(role_config_file.owner).toBe(owner_account_id);
-                expect(role_config_file.type).toBe('role');
+                expect(role_config_file.identity_type).toBe('ROLE');
                 expect(role_config_file.assume_role_policy_document).toEqual(dummy_role1.assume_role_policy_document);
             });
 
@@ -1307,11 +1307,9 @@ describe('Accountspace_FS tests', () => {
 
                 const res = await accountspace_fs.list_roles({}, account_sdk);
                 const role_names = res.members.map(m => m.role_name);
-                expect(role_names).not.toEqual(expect.arrayContaining([
-                    dummy_role1.role_name,
-                    dummy_role2.role_name,
-                    dummy_role3.role_name,
-                ]));
+                expect(role_names).not.toContain(dummy_role1.role_name);
+                expect(role_names).not.toContain(dummy_role2.role_name);
+                expect(role_names).not.toContain(dummy_role3.role_name);
             });
         });
     });