Authorization

Proof-of-concept (conceptual steps you can adapt to your deployment): Prerequisites: - Grafana instance with OpenFGA/Zanzana-based authorization (as in Grafana 12.4.x) and a resource hierarchy including folders and dashboards. - A user account (e.g., user:alice) and a folder or dashboard resource (e.g., fold1 or dashboards under a folder). - The system should support permission-management actions such as folders.permissions:read and folders.permissions:write (and their dashboard equivalents). Steps to reproduce (pre-fix behavior would lack propagation): 1) Grant a permission-management action to a user for a resource: - Action: folders.permissions:read (or folders.permissions:write) - Target: a folder (e.g., fold1) or a folder’s dashboards group (depending on scope) - This should enqueue a translation that propagates to underlying permission relations. 2) Check whether the user gains the corresponding get_permissions/set_permissions tuple on the underlying object: - Expected (post-fix): a tuple such as { user: "user:alice", relation: "get_permissions", object: "folder:fold1" } (or the equivalent group_resource object, depending on scope: e.g., group_resource:folder.grafana.app/folders). - And for write permissions: a tuple with relation set_permissions on the appropriate object. 3) Validate authorization behavior: - Query the policy engine to see if user:alice can get_permissions on folder:fold1 (or the grouped resource) after the grant. - Before the fix, this check would likely fail because the get_permissions tuple was not created due to the missing translation mapping. - After applying this fix, the check should pass, indicating proper propagation of the permission-management action. OpenFGA/OpenAPI-style example calls (adapt to your deployment): # 1) Grant permission-management action to user curl -X POST 'https://fga.example.org/stores/grafana/write/tuples' \ -H 'Content-Type: application/json' \ -d '{"tuples":[{"user":"user:alice","relation":"folders.permissions:read","object":"group_resource:folder.grafana.app/folders"}]}' # 2) Check for propagated get_permissions relation on the folder curl -X POST 'https://fga.example.org/stores/grafana/read/tuples/check' \ -H 'Content-Type: application/json' \ -d '{"tuple":{"user":"user:alice","relation":"get_permissions","object":"group_resource:folder.grafana.app/folders"}}' Expected: true after the fix; false before the fix (demonstrating the vulnerability existed).

diff --git a/pkg/services/authz/zanzana/common/translations.go b/pkg/services/authz/zanzana/common/translations.go index 8094231d6483c..25175852d25c4 100644 --- a/pkg/services/authz/zanzana/common/translations.go +++ b/pkg/services/authz/zanzana/common/translations.go @@ -78,6 +78,11 @@ var resourceTranslations = map[string]resourceTranslation{ "dashboards:write": newScopedMapping(RelationUpdate, dashboardGroup, dashboardResource, ""), "dashboards:create": newScopedMapping(RelationCreate, dashboardGroup, dashboardResource, ""), "dashboards:delete": newScopedMapping(RelationDelete, dashboardGroup, dashboardResource, ""), + // Permission management + "folders.permissions:read": newMapping(RelationGetPermissions, ""), + "folders.permissions:write": newMapping(RelationSetPermissions, ""), + "dashboards.permissions:read": newScopedMapping(RelationGetPermissions, dashboardGroup, dashboardResource, ""), + "dashboards.permissions:write": newScopedMapping(RelationSetPermissions, dashboardGroup, dashboardResource, ""), // Action sets "folders:view": newMapping(RelationSetView, ""), "folders:edit": newMapping(RelationSetEdit, ""), @@ -96,6 +101,9 @@ var resourceTranslations = map[string]resourceTranslation{ "dashboards:write": newMapping(RelationUpdate, ""), "dashboards:create": newMapping(RelationCreate, ""), "dashboards:delete": newMapping(RelationDelete, ""), + // Permission management + "dashboards.permissions:read": newMapping(RelationGetPermissions, ""), + "dashboards.permissions:write": newMapping(RelationSetPermissions, ""), // Action sets "dashboards:view": newMapping(RelationSetView, ""), "dashboards:edit": newMapping(RelationSetEdit, ""), diff --git a/pkg/services/authz/zanzana/common/tuple_test.go b/pkg/services/authz/zanzana/common/tuple_test.go index ecb4d6e9dd1af..722694e8e8578 100644 --- a/pkg/services/authz/zanzana/common/tuple_test.go +++ b/pkg/services/authz/zanzana/common/tuple_test.go @@ -77,6 +77,84 @@ func TestTranslateToResourceTuple(t *testing.T) { Object: "group_resource:folder.grafana.app/folders", }, }, + { + testName: "folders.permissions:write for all folders", + subject: "user:1", + action: "folders.permissions:write", + kind: "folders", + name: "*", + expected: &openfgav1.TupleKey{ + User: "user:1", + Relation: "set_permissions", + Object: "group_resource:folder.grafana.app/folders", + }, + }, + { + testName: "folders.permissions:read for a specific folder", + subject: "user:1", + action: "folders.permissions:read", + kind: "folders", + name: "fold1", + expected: &openfgav1.TupleKey{ + User: "user:1", + Relation: "get_permissions", + Object: "folder:fold1", + }, + }, + { + testName: "dashboards.permissions:write for all dashboards in a folder", + subject: "user:1", + action: "dashboards.permissions:write", + kind: "folders", + name: "fold1", + expected: &openfgav1.TupleKey{ + User: "user:1", + Relation: "resource_set_permissions", + Object: "folder:fold1", + Condition: &openfgav1.RelationshipCondition{ + Name: "subresource_filter", + Context: &structpb.Struct{ + Fields: map[string]*structpb.Value{ + "subresources": structpb.NewListValue(&structpb.ListValue{ + Values: []*structpb.Value{structpb.NewStringValue("dashboard.grafana.app/dashboards")}, + }), + }, + }, + }, + }, + }, + { + testName: "dashboards.permissions:write for all dashboards in folders kind", + subject: "user:1", + action: "dashboards.permissions:write", + kind: "folders", + name: "*", + expected: &openfgav1.TupleKey{ + User: "user:1", + Relation: "set_permissions", + Object: "group_resource:dashboard.grafana.app/dashboards", + }, + }, + { + testName: "dashboards.permissions:read for a specific dashboard", + subject: "user:1", + action: "dashboards.permissions:read", + kind: "dashboards", + name: "dash1", + expected: &openfgav1.TupleKey{ + User: "user:1", + Relation: "get_permissions", + Object: "resource:dashboard.grafana.app/dashboards/dash1", + Condition: &openfgav1.RelationshipCondition{ + Name: "group_filter", + Context: &structpb.Struct{ + Fields: map[string]*structpb.Value{ + "group_resource": structpb.NewStringValue("dashboard.grafana.app/dashboards"), + }, + }, + }, + }, + }, } for _, test := range tests {