Disable API Key Access for users, accounts and domains #9741

abh1sar · 2024-09-27T13:05:11Z

Description

This PR implements the feature which give Root Admin the ability to Disable Api-key/Secret-key access at different granularities (User/Account/Domain/Global)
Spec : https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=323488155
Doc PR : apache/cloudstack-documentation#446

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

Edit form :

User view :

Event logging :

How Has This Been Tested?

Local value should always take precedence unless it is set to Inherit.
Tested the following matrix. Result denotes if Api key access was allowed for the User or not.

User	Account	Domain	Global	Result
Inherit	Inherit	Inherit	Enabled	Enabled
Inherit	Inherit	Inherit	Disabled	Disabled
Inherit	Inherit	Enabled	Disabled	Enabled
Inherit	Disabled	Enabled	Enabled	Disabled
Disabled	Enabled	Enabled	Enabled	Disabled
Enabled	Inherit	Inherit	Disabled	Enabled

Tested that apikeyaccess parameter in updateUser, updateAccount, listUsers and listAccounts is not shown to anyone else apart from the Root Admin.
Tested that api.key.access configuration is not editable by the domain admin.

How did you try to break this feature and the system with this change?

…l setting

codecov · 2024-09-27T13:16:17Z

Codecov Report

Attention: Patch coverage is 35.65217% with 148 lines in your changes missing coverage. Please review.

Project coverage is 16.01%. Comparing base (58138f2) to head (564d2b4).
Report is 1 commits behind head on 4.20.

Files with missing lines	Patch %	Lines
...ava/com/cloud/upgrade/dao/Upgrade42000to42010.java	10.52%	34 Missing ⚠️
...c/main/java/com/cloud/user/dao/AccountDaoImpl.java	0.00%	14 Missing ⚠️
.../cloud/configuration/ConfigurationManagerImpl.java	0.00%	13 Missing ⚠️
...ain/java/com/cloud/api/query/QueryManagerImpl.java	57.14%	7 Missing and 5 partials ⚠️
...n/java/org/apache/cloudstack/api/ApiConstants.java	47.05%	9 Missing ⚠️
...c/main/java/com/cloud/user/AccountManagerImpl.java	80.00%	7 Missing and 1 partial ⚠️
...ne/schema/src/main/java/com/cloud/user/UserVO.java	0.00%	6 Missing ⚠️
...ck/api/command/admin/account/UpdateAccountCmd.java	0.00%	5 Missing ⚠️
...loudstack/api/command/admin/user/ListUsersCmd.java	0.00%	5 Missing ⚠️
...schema/src/main/java/com/cloud/user/AccountVO.java	16.66%	5 Missing ⚠️
... and 12 more

Additional details and impacted files

@@             Coverage Diff              @@
##               4.20    #9741      +/-   ##
============================================
+ Coverage     15.98%   16.01%   +0.03%     
- Complexity    12753    12776      +23     
============================================
  Files          5631     5633       +2     
  Lines        492702   492958     +256     
  Branches      59737    59769      +32     
============================================
+ Hits          78755    78962     +207     
- Misses       405219   405230      +11     
- Partials       8728     8766      +38

Flag	Coverage Δ
uitests	`4.03% <ø> (-0.01%)`	⬇️
unittests	`16.85% <35.65%> (+0.03%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

weizhouapache · 2024-09-27T13:19:31Z

server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java

@@ -955,6 +955,11 @@ public Configuration updateConfiguration(final UpdateCfgCmd cmd) throws InvalidP
            category = config.getCategory();
        }

+        if ("System".equals(category) && !_accountMgr.isRootAdmin(caller.getId())) {


maybe define a constant "System" somewhere

weizhouapache · 2024-09-27T13:20:08Z

api/src/main/java/org/apache/cloudstack/api/command/admin/account/UpdateAccountCmd.java

@@ -70,6 +71,9 @@ public class UpdateAccountCmd extends BaseCmd {
    @Parameter(name = ApiConstants.ACCOUNT_DETAILS, type = CommandType.MAP, description = "Details for the account used to store specific parameters")
    private Map details;

+    @Parameter(name = ApiConstants.API_KEY_ACCESS, type = CommandType.STRING, description = "Determines if Api key access for this user is enabled, disabled or inherits the value from its parent, the domain level setting \"api.key.access\"", since = "4.20.1.0", authorized = {RoleType.Admin})


is it targetted 4.20.1 ?

Yes, is that ok?

abh1sar · 2024-09-30T19:02:23Z

@blueorangutan package

blueorangutan · 2024-09-30T19:04:04Z

@abh1sar a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2024-09-30T20:05:55Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 11245

abh1sar · 2024-10-01T08:09:47Z

@blueorangutan test

blueorangutan · 2024-10-01T08:12:07Z

@abh1sar a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

sureshanaparti · 2024-10-01T12:47:58Z

engine/schema/src/main/resources/META-INF/db/schema-41910to42000.sql

+    ADD COLUMN `api_key_access` boolean;
+
+ALTER TABLE `cloud`.`account`
+    ADD COLUMN `api_key_access` boolean;


use IDEMPOTENT_ADD_COLUMN call to add columns

server/src/main/java/com/cloud/user/AccountManagerImpl.java

server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java

sureshanaparti · 2024-10-01T12:57:43Z

engine/schema/src/main/resources/META-INF/db/schema-41910to42000.sql

@@ -425,3 +425,9 @@ INSERT IGNORE INTO `cloud`.`guest_os_hypervisor` (uuid, hypervisor_type, hypervi

 CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vm_instance', 'delete_protection', 'boolean DEFAULT FALSE COMMENT "delete protection for vm" ');
 CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.volumes', 'delete_protection', 'boolean DEFAULT FALSE COMMENT "delete protection for volumes" ');
+


targeted for 4.20.1? add these changes in engine/schema/src/main/resources/META-INF/db/schema-42000to42010.sql

Will create the new schema file once 4.20.0 is cut. Keeping this PR in draft until then

…rated

…as well

…r correctly

abh1sar · 2024-12-01T19:41:29Z

@blueorangutan package

blueorangutan · 2024-12-01T19:42:04Z

@abh1sar a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2024-12-01T20:45:42Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 11671

abh1sar · 2024-12-01T20:50:18Z

@blueorangutan test matrix

blueorangutan · 2024-12-01T20:52:04Z

@abh1sar a [SL] Trillian-Jenkins matrix job (EL8 mgmt + EL8 KVM, Ubuntu22 mgmt + Ubuntu22 KVM, EL8 mgmt + VMware 7.0u3, EL9 mgmt + XCP-ng 8.2 ) has been kicked to run smoke tests

github-actions · 2024-12-02T07:17:21Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

abh1sar · 2024-12-02T09:08:21Z

Added Database upgrade path for 42000to42010.

blueorangutan · 2024-12-02T12:29:01Z

[SF] Trillian test result (tid-11828)
Environment: kvm-ubuntu22 (x2), Advanced Networking with Mgmt server u22
Total time taken: 54241 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr9741-t11828-kvm-ubuntu22.zip
Smoke tests completed. 141 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

blueorangutan · 2024-12-02T12:37:50Z

[SF] Trillian test result (tid-11827)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 54290 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr9741-t11827-kvm-ol8.zip
Smoke tests completed. 141 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

* cli changes to update user/account, list by apikeyaccess, domain level setting * UI changes for updating user/account and searchfilter in listview * make the api parameters and setting accessible only to root admin * revert changes to ui/package-lock.json * minor changes to description strings * UT for ApiServer and AccountManagerImpl classes * fix pre-commit failure * Added a constant for the string System * UT for searchForUsers and searchForAccounts * Fix marvin test error * Update schema to use idempotent add column * Fix `updateTemplatePermission` when the UI is set to a language other than English (apache#9766) * Fix updateTemplatePermission UI in non-english language * Improve fix --------- Co-authored-by: Lucas Martins <lucas.martins@scclouds.com.br> * Added user name uuid to logging * Add events when api key access is changed via api or config setting * fix the userid for api key access update event * Fix ut failure after event logging * Convert drop down to radio-button in edit user and account * Add ApiKeyAccess status in User InfoCard for Users if Api key is generated * Return apiKeyAccess in user and account response only for Root Admin * fixed noredist build failure * Show apikeyaccess on the left panel in the user view for root admins as well * don't show divider if apiKeyAccess is not shown to user * Fix events generated to set Username, Account and Domain of the caller correctly * cli changes to update user/account, list by apikeyaccess, domain level setting * UI changes for updating user/account and searchfilter in listview * make the api parameters and setting accessible only to root admin * revert changes to ui/package-lock.json * minor changes to description strings * UT for ApiServer and AccountManagerImpl classes * fix pre-commit failure * Added a constant for the string System * UT for searchForUsers and searchForAccounts * Fix marvin test error * Update schema to use idempotent add column * Added user name uuid to logging * Add events when api key access is changed via api or config setting * fix the userid for api key access update event * Fix ut failure after event logging * Convert drop down to radio-button in edit user and account * Add ApiKeyAccess status in User InfoCard for Users if Api key is generated * Return apiKeyAccess in user and account response only for Root Admin * fixed noredist build failure * Show apikeyaccess on the left panel in the user view for root admins as well * don't show divider if apiKeyAccess is not shown to user * Fix events generated to set Username, Account and Domain of the caller correctly * Added DB upgrade path from 42000 to 42010 --------- Co-authored-by: Daan Hoogland <daan@onecht.net> Co-authored-by: Lucas Martins <56271185+lucas-a-martins@users.noreply.github.com> Co-authored-by: Lucas Martins <lucas.martins@scclouds.com.br>

abh1sar added 6 commits September 25, 2024 17:17

cli changes to update user/account, list by apikeyaccess, domain leve…

ceed660

…l setting

UI changes for updating user/account and searchfilter in listview

2f276e6

make the api parameters and setting accessible only to root admin

ad4171a

revert changes to ui/package-lock.json

09bf1a0

minor changes to description strings

2869b13

UT for ApiServer and AccountManagerImpl classes

67c9c62

boring-cyborg bot added component:api component:UI labels Sep 27, 2024

abh1sar added this to the 4.20.1.0 milestone Sep 27, 2024

fix pre-commit failure

aadf4cb

weizhouapache reviewed Sep 27, 2024

View reviewed changes

abh1sar and others added 5 commits September 27, 2024 19:41

Merge branch 'main' into apikey

31eb378

Added a constant for the string System

048642d

Merge branch 'apikey' of https://github.com/abh1sar/cloudstack into apik

b7085e6

UT for searchForUsers and searchForAccounts

aa6bc35

Merge branch 'main' into apikey

65dde8e

abh1sar requested review from harikrishna-patnala and weizhouapache September 30, 2024 09:33

abh1sar added 2 commits September 30, 2024 17:31

Fix marvin test error

f736d77

Merge branch 'apikey' of https://github.com/abh1sar/cloudstack into apik

51be0cb

sureshanaparti reviewed Oct 1, 2024

View reviewed changes

server/src/main/java/com/cloud/user/AccountManagerImpl.java Show resolved Hide resolved

sureshanaparti reviewed Oct 1, 2024

View reviewed changes

server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java Show resolved Hide resolved

sureshanaparti reviewed Oct 1, 2024

View reviewed changes

abh1sar added 12 commits December 1, 2024 23:32

Add events when api key access is changed via api or config setting

7b54a6f

fix the userid for api key access update event

6854ff4

Fix ut failure after event logging

3499240

Convert drop down to radio-button in edit user and account

c759691

Add ApiKeyAccess status in User InfoCard for Users if Api key is gene…

554d0c9

…rated

Return apiKeyAccess in user and account response only for Root Admin

f64c0e6

fixed noredist build failure

7bb3b6e

Show apikeyaccess on the left panel in the user view for root admins …

1ec4c1f

…as well

don't show divider if apiKeyAccess is not shown to user

2fadea9

Fix events generated to set Username, Account and Domain of the calle…

a099946

…r correctly

Merge branch 'apikey' of https://github.com/abh1sar/cloudstack into apik

0b508e0

Added DB upgrade path from 42000 to 42010

4da3265

github-actions bot added the status:has-conflicts label Dec 2, 2024

Merge remote-tracking branch 'upstream/4.20' into apik

564d2b4

github-actions bot removed the status:has-conflicts label Dec 2, 2024

abh1sar marked this pull request as ready for review December 2, 2024 09:07

abh1sar marked this pull request as draft December 2, 2024 10:39

rohityadavcloud marked this pull request as ready for review December 3, 2024 06:30

rohityadavcloud approved these changes Dec 3, 2024

View reviewed changes

rohityadavcloud merged commit d17de83 into apache:4.20 Dec 3, 2024
26 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Disable API Key Access for users, accounts and domains #9741

Disable API Key Access for users, accounts and domains #9741

abh1sar commented Sep 27, 2024 •

edited

Loading

codecov bot commented Sep 27, 2024 •

edited

Loading

weizhouapache Sep 27, 2024

abh1sar Sep 28, 2024

weizhouapache Sep 27, 2024

abh1sar Sep 28, 2024

abh1sar commented Sep 30, 2024

blueorangutan commented Sep 30, 2024

blueorangutan commented Sep 30, 2024

abh1sar commented Oct 1, 2024

blueorangutan commented Oct 1, 2024

sureshanaparti Oct 1, 2024

abh1sar Oct 3, 2024

sureshanaparti Oct 1, 2024

abh1sar Oct 3, 2024

abh1sar commented Dec 1, 2024

blueorangutan commented Dec 1, 2024

blueorangutan commented Dec 1, 2024

abh1sar commented Dec 1, 2024

blueorangutan commented Dec 1, 2024

github-actions bot commented Dec 2, 2024

abh1sar commented Dec 2, 2024

blueorangutan commented Dec 2, 2024

blueorangutan commented Dec 2, 2024

		@@ -425,3 +425,9 @@ INSERT IGNORE INTO `cloud`.`guest_os_hypervisor` (uuid, hypervisor_type, hypervi

		CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vm_instance', 'delete_protection', 'boolean DEFAULT FALSE COMMENT "delete protection for vm" ');
		CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.volumes', 'delete_protection', 'boolean DEFAULT FALSE COMMENT "delete protection for volumes" ');

Disable API Key Access for users, accounts and domains #9741

Disable API Key Access for users, accounts and domains #9741

Conversation

abh1sar commented Sep 27, 2024 • edited Loading

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

codecov bot commented Sep 27, 2024 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abh1sar commented Sep 30, 2024

blueorangutan commented Sep 30, 2024

blueorangutan commented Sep 30, 2024

abh1sar commented Oct 1, 2024

blueorangutan commented Oct 1, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abh1sar commented Dec 1, 2024

blueorangutan commented Dec 1, 2024

blueorangutan commented Dec 1, 2024

abh1sar commented Dec 1, 2024

blueorangutan commented Dec 1, 2024

github-actions bot commented Dec 2, 2024

abh1sar commented Dec 2, 2024

blueorangutan commented Dec 2, 2024

blueorangutan commented Dec 2, 2024

abh1sar commented Sep 27, 2024 •

edited

Loading

codecov bot commented Sep 27, 2024 •

edited

Loading