improve identity provider plugin

Signed-off-by: hongming <talonwan@yunify.com>

pkg/apiserver/apiserver.go

@@ -20,6 +20,10 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"kubesphere.io/kubesphere/pkg/apiserver/authorization/rbac"
+	"kubesphere.io/kubesphere/pkg/models/auth"
+	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/loginrecord"
+	"kubesphere.io/kubesphere/pkg/models/resources/v1alpha3/user"
 	"net/http"
 	rt "runtime"
 	"time"
@@ -167,9 +171,15 @@ func (s *APIServer) PrepareRun(stopCh <-chan struct{}) error {
 // Installation happens before all informers start to cache objects, so
 //   any attempt to list objects using listers will get empty results.
 func (s *APIServer) installKubeSphereAPIs() {
-	imOperator := im.NewOperator(s.KubernetesClient.KubeSphere(), s.InformerFactory, s.Config.AuthenticationOptions)
-	amOperator := am.NewOperator(s.InformerFactory, s.KubernetesClient.KubeSphere(), s.KubernetesClient.Kubernetes())
-	rbacAuthorizer := authorizerfactory.NewRBACAuthorizer(amOperator)
+	imOperator := im.NewOperator(s.KubernetesClient.KubeSphere(),
+		user.New(s.InformerFactory.KubeSphereSharedInformerFactory(),
+			s.InformerFactory.KubernetesSharedInformerFactory()),
+		loginrecord.New(s.InformerFactory.KubeSphereSharedInformerFactory()),
+		s.Config.AuthenticationOptions)
+	amOperator := am.NewOperator(s.KubernetesClient.KubeSphere(),
+		s.KubernetesClient.Kubernetes(),
+		s.InformerFactory)
+	rbacAuthorizer := rbac.NewRBACAuthorizer(amOperator)
 
 	urlruntime.Must(configv1alpha2.AddToContainer(s.container, s.Config))
 	urlruntime.Must(resourcev1alpha3.AddToContainer(s.container, s.InformerFactory))
@@ -187,20 +197,22 @@ func (s *APIServer) installKubeSphereAPIs() {
 		s.Config.MultiClusterOptions.ProxyPublishService,
 		s.Config.MultiClusterOptions.ProxyPublishAddress,
 		s.Config.MultiClusterOptions.AgentImage))
-	urlruntime.Must(iamapi.AddToContainer(s.container, imOperator,
-		am.NewOperator(s.InformerFactory, s.KubernetesClient.KubeSphere(), s.KubernetesClient.Kubernetes()),
+	urlruntime.Must(iamapi.AddToContainer(s.container, imOperator, amOperator,
 		group.New(s.InformerFactory, s.KubernetesClient.KubeSphere(), s.KubernetesClient.Kubernetes()),
-		s.Config.AuthenticationOptions))
+		rbacAuthorizer))
 
 	urlruntime.Must(oauth.AddToContainer(s.container, imOperator,
-		im.NewTokenOperator(
+		auth.NewTokenOperator(
 			s.CacheClient,
 			s.Config.AuthenticationOptions),
-		im.NewPasswordAuthenticator(
+		auth.NewPasswordAuthenticator(
 			s.KubernetesClient.KubeSphere(),
 			s.InformerFactory.KubeSphereSharedInformerFactory().Iam().V1alpha2().Users().Lister(),
 			s.Config.AuthenticationOptions),
-		im.NewLoginRecorder(s.KubernetesClient.KubeSphere()),
+		auth.NewOAuth2Authenticator(s.KubernetesClient.KubeSphere(),
+			s.InformerFactory.KubeSphereSharedInformerFactory().Iam().V1alpha2().Users().Lister(),
+			s.Config.AuthenticationOptions),
+		auth.NewLoginRecorder(s.KubernetesClient.KubeSphere()),
 		s.Config.AuthenticationOptions))
 	urlruntime.Must(servicemeshv1alpha2.AddToContainer(s.container))
 	urlruntime.Must(networkv1alpha2.AddToContainer(s.container, s.Config.NetworkOptions.WeaveScopeHost))
@@ -211,7 +223,7 @@ func (s *APIServer) installKubeSphereAPIs() {
 		s.KubernetesClient.KubeSphere(),
 		s.S3Client,
 		s.Config.DevopsOptions.Host,
-		am.NewOperator(s.InformerFactory, s.KubernetesClient.KubeSphere(), s.KubernetesClient.Kubernetes())))
+		amOperator))
 	urlruntime.Must(devopsv1alpha3.AddToContainer(s.container,
 		s.DevopsClient,
 		s.KubernetesClient.Kubernetes(),
@@ -285,7 +297,7 @@ func (s *APIServer) buildHandlerChain(stopCh <-chan struct{}) {
 		excludedPaths := []string{"/oauth/*", "/kapis/config.kubesphere.io/*", "/kapis/version"}
 		pathAuthorizer, _ := path.NewAuthorizer(excludedPaths)
 		amOperator := am.NewReadOnlyOperator(s.InformerFactory)
-		authorizers = unionauthorizer.New(pathAuthorizer, authorizerfactory.NewRBACAuthorizer(amOperator))
+		authorizers = unionauthorizer.New(pathAuthorizer, rbac.NewRBACAuthorizer(amOperator))
 	}
 
 	handler = filters.WithAuthorization(handler, authorizers)
@@ -295,12 +307,16 @@ func (s *APIServer) buildHandlerChain(stopCh <-chan struct{}) {
 		handler = filters.WithMultipleClusterDispatcher(handler, clusterDispatcher)
 	}
 
-	loginRecorder := im.NewLoginRecorder(s.KubernetesClient.KubeSphere())
+	loginRecorder := auth.NewLoginRecorder(s.KubernetesClient.KubeSphere())
 	// authenticators are unordered
 	authn := unionauth.New(anonymous.NewAuthenticator(),
-		basictoken.New(basic.NewBasicAuthenticator(im.NewPasswordAuthenticator(s.KubernetesClient.KubeSphere(), s.InformerFactory.KubeSphereSharedInformerFactory().Iam().V1alpha2().Users().Lister(), s.Config.AuthenticationOptions))),
-		bearertoken.New(jwttoken.NewTokenAuthenticator(im.NewTokenOperator(s.CacheClient, s.Config.AuthenticationOptions), s.InformerFactory.KubeSphereSharedInformerFactory().Iam().V1alpha2().Users().Lister())))
-	handler = filters.WithAuthentication(handler, authn, loginRecorder)
+		basictoken.New(basic.NewBasicAuthenticator(auth.NewPasswordAuthenticator(s.KubernetesClient.KubeSphere(),
+			s.InformerFactory.KubeSphereSharedInformerFactory().Iam().V1alpha2().Users().Lister(),
+			s.Config.AuthenticationOptions), loginRecorder)),
+		bearertoken.New(jwttoken.NewTokenAuthenticator(auth.NewTokenOperator(s.CacheClient,
+			s.Config.AuthenticationOptions),
+			s.InformerFactory.KubeSphereSharedInformerFactory().Iam().V1alpha2().Users().Lister())))
+	handler = filters.WithAuthentication(handler, authn)
 	handler = filters.WithRequestInfo(handler, requestInfoResolver)
 	s.Server.Handler = handler
 }

pkg/apiserver/authentication/authenticators/basic/basic.go

@@ -18,10 +18,13 @@ package basic
 
 import (
 	"context"
+	"k8s.io/klog"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	"kubesphere.io/kubesphere/pkg/apiserver/request"
+	"kubesphere.io/kubesphere/pkg/models/auth"
 
 	"k8s.io/apiserver/pkg/authentication/authenticator"
 	"k8s.io/apiserver/pkg/authentication/user"
-	"kubesphere.io/kubesphere/pkg/models/iam/im"
 )
 
 // TokenAuthenticator implements kubernetes token authenticate interface with our custom logic.
@@ -30,28 +33,36 @@ import (
 // and group from user.AllUnauthenticated. This helps requests be passed along the handler chain,
 // because some resources are public accessible.
 type basicAuthenticator struct {
-	authenticator im.PasswordAuthenticator
+	authenticator auth.PasswordAuthenticator
+	loginRecorder auth.LoginRecorder
 }
 
-func NewBasicAuthenticator(authenticator im.PasswordAuthenticator) authenticator.Password {
+func NewBasicAuthenticator(authenticator auth.PasswordAuthenticator, loginRecorder auth.LoginRecorder) authenticator.Password {
 	return &basicAuthenticator{
 		authenticator: authenticator,
+		loginRecorder: loginRecorder,
 	}
 }
 
 func (t *basicAuthenticator) AuthenticatePassword(ctx context.Context, username, password string) (*authenticator.Response, bool, error) {
-
-	providedUser, err := t.authenticator.Authenticate(username, password)
-
+	authenticated, provider, err := t.authenticator.Authenticate(username, password)
 	if err != nil {
+		if t.loginRecorder != nil && err == auth.IncorrectPasswordError {
+			var sourceIP, userAgent string
+			if requestInfo, ok := request.RequestInfoFrom(ctx); ok {
+				sourceIP = requestInfo.SourceIP
+				userAgent = requestInfo.UserAgent
+			}
+			if err := t.loginRecorder.RecordLogin(username, iamv1alpha2.BasicAuth, provider, sourceIP, userAgent, err); err != nil {
+				klog.Errorf("Failed to record unsuccessful login attempt for user %s, error: %v", username, err)
+			}
+		}
 		return nil, false, err
 	}
-
 	return &authenticator.Response{
 		User: &user.DefaultInfo{
-			Name:   providedUser.GetName(),
-			UID:    providedUser.GetUID(),
-			Groups: append(providedUser.GetGroups(), user.AllAuthenticated),
+			Name:   authenticated.GetName(),
+			Groups: append(authenticated.GetGroups(), user.AllAuthenticated),
 		},
 	}, true, nil
 }

pkg/apiserver/authentication/authenticators/jwttoken/jwt_token.go

@@ -18,13 +18,13 @@ package jwttoken
 
 import (
 	"context"
-
 	"k8s.io/apiserver/pkg/authentication/authenticator"
 	"k8s.io/apiserver/pkg/authentication/user"
 	"k8s.io/klog"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	"kubesphere.io/kubesphere/pkg/models/auth"
 
 	iamv1alpha2listers "kubesphere.io/kubesphere/pkg/client/listers/iam/v1alpha2"
-	"kubesphere.io/kubesphere/pkg/models/iam/im"
 )
 
 // TokenAuthenticator implements kubernetes token authenticate interface with our custom logic.
@@ -33,11 +33,11 @@ import (
 // and group from user.AllUnauthenticated. This helps requests be passed along the handler chain,
 // because some resources are public accessible.
 type tokenAuthenticator struct {
-	tokenOperator im.TokenManagementInterface
+	tokenOperator auth.TokenManagementInterface
 	userLister    iamv1alpha2listers.UserLister
 }
 
-func NewTokenAuthenticator(tokenOperator im.TokenManagementInterface, userLister iamv1alpha2listers.UserLister) authenticator.Token {
+func NewTokenAuthenticator(tokenOperator auth.TokenManagementInterface, userLister iamv1alpha2listers.UserLister) authenticator.Token {
 	return &tokenAuthenticator{
 		tokenOperator: tokenOperator,
 		userLister:    userLister,
@@ -51,6 +51,16 @@ func (t *tokenAuthenticator) AuthenticateToken(ctx context.Context, token string
 		return nil, false, err
 	}
 
+	if providedUser.GetName() == iamv1alpha2.PreRegistrationUser {
+		return &authenticator.Response{
+			User: &user.DefaultInfo{
+				Name:   providedUser.GetName(),
+				Extra:  providedUser.GetExtra(),
+				Groups: providedUser.GetGroups(),
+			},
+		}, true, nil
+	}
+
 	dbUser, err := t.userLister.Get(providedUser.GetName())
 	if err != nil {
 		return nil, false, err
@@ -58,8 +68,7 @@ func (t *tokenAuthenticator) AuthenticateToken(ctx context.Context, token string
 
 	return &authenticator.Response{
 		User: &user.DefaultInfo{
-			Name:   providedUser.GetName(),
-			UID:    providedUser.GetUID(),
+			Name:   dbUser.GetName(),
 			Groups: append(dbUser.Spec.Groups, user.AllAuthenticated),
 		},
 	}, true, nil

pkg/apiserver/authentication/identityprovider/aliyunidaas/idaas.go

@@ -20,15 +20,19 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"github.com/mitchellh/mapstructure"
 	"io/ioutil"
 
 	"golang.org/x/oauth2"
-	"gopkg.in/yaml.v3"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
 )
 
-type AliyunIDaaS struct {
+func init() {
+	identityprovider.RegisterOAuthProvider(&idaasProviderFactory{})
+}
+
+type aliyunIDaaS struct {
 	// ClientID is the application's ID.
 	ClientID string `json:"clientID" yaml:"clientID"`
 
@@ -39,7 +43,7 @@ type AliyunIDaaS struct {
 	// URLs. These are constants specific to each server and are
 	// often available via site-specific packages, such as
 	// google.Endpoint or github.Endpoint.
-	Endpoint Endpoint `json:"endpoint" yaml:"endpoint"`
+	Endpoint endpoint `json:"endpoint" yaml:"endpoint"`
 
 	// RedirectURL is the URL to redirect users going through
 	// the OAuth flow, after the resource owner's URLs.
@@ -49,15 +53,15 @@ type AliyunIDaaS struct {
 	Scopes []string `json:"scopes" yaml:"scopes"`
 }
 
-// Endpoint represents an OAuth 2.0 provider's authorization and token
+// endpoint represents an OAuth 2.0 provider's authorization and token
 // endpoint URLs.
-type Endpoint struct {
+type endpoint struct {
 	AuthURL     string `json:"authURL" yaml:"authURL"`
 	TokenURL    string `json:"tokenURL" yaml:"tokenURL"`
 	UserInfoURL string `json:"user_info_url" yaml:"userInfoUrl"`
 }
 
-type IDaaSIdentity struct {
+type idaasIdentity struct {
 	Sub         string `json:"sub"`
 	OuID        string `json:"ou_id"`
 	Nickname    string `json:"nickname"`
@@ -67,72 +71,73 @@ type IDaaSIdentity struct {
 	Username    string `json:"username"`
 }
 
-type UserInfoResp struct {
+type userInfoResp struct {
 	Success       bool          `json:"success"`
 	Message       string        `json:"message"`
 	Code          string        `json:"code"`
-	IDaaSIdentity IDaaSIdentity `json:"data"`
+	IDaaSIdentity idaasIdentity `json:"data"`
 }
 
-func init() {
-	identityprovider.RegisterOAuthProvider(&AliyunIDaaS{})
+type idaasProviderFactory struct {
 }
 
-func (a *AliyunIDaaS) Type() string {
+func (g *idaasProviderFactory) Type() string {
 	return "AliyunIDaasProvider"
 }
 
-func (a *AliyunIDaaS) Setup(options *oauth.DynamicOptions) (identityprovider.OAuthProvider, error) {
-	data, err := yaml.Marshal(options)
-	if err != nil {
+func (g *idaasProviderFactory) Create(options *oauth.DynamicOptions) (identityprovider.OAuthProvider, error) {
+	var idaas aliyunIDaaS
+	if err := mapstructure.Decode(options, &idaas); err != nil {
 		return nil, err
 	}
-	var provider AliyunIDaaS
-	err = yaml.Unmarshal(data, &provider)
-	if err != nil {
-		return nil, err
-	}
-	return &provider, nil
+	return &idaas, nil
 }
 
-func (a IDaaSIdentity) GetName() string {
+func (a idaasIdentity) GetUserID() string {
+	return a.Sub
+}
+
+func (a idaasIdentity) GetUsername() string {
 	return a.Username
 }
 
-func (a IDaaSIdentity) GetEmail() string {
+func (a idaasIdentity) GetEmail() string {
 	return a.Email
 }
 
-func (g *AliyunIDaaS) IdentityExchange(code string) (identityprovider.Identity, error) {
+func (a idaasIdentity) GetDisplayName() string {
+	return a.Nickname
+}
+
+func (a *aliyunIDaaS) IdentityExchange(code string) (identityprovider.Identity, error) {
 	config := oauth2.Config{
-		ClientID:     g.ClientID,
-		ClientSecret: g.ClientSecret,
+		ClientID:     a.ClientID,
+		ClientSecret: a.ClientSecret,
 		Endpoint: oauth2.Endpoint{
-			AuthURL:   g.Endpoint.AuthURL,
-			TokenURL:  g.Endpoint.TokenURL,
+			AuthURL:   a.Endpoint.AuthURL,
+			TokenURL:  a.Endpoint.TokenURL,
 			AuthStyle: oauth2.AuthStyleAutoDetect,
 		},
-		RedirectURL: g.RedirectURL,
-		Scopes:      g.Scopes,
+		RedirectURL: a.RedirectURL,
+		Scopes:      a.Scopes,
 	}
 	token, err := config.Exchange(context.Background(), code)
 	if err != nil {
 		return nil, err
 	}
 
-	resp, err := oauth2.NewClient(context.Background(), oauth2.StaticTokenSource(token)).Get(g.Endpoint.UserInfoURL)
+	resp, err := oauth2.NewClient(context.Background(), oauth2.StaticTokenSource(token)).Get(a.Endpoint.UserInfoURL)
 	if err != nil {
 		return nil, err
 	}
 
 	data, err := ioutil.ReadAll(resp.Body)
-
-	defer resp.Body.Close()
 	if err != nil {
 		return nil, err
 	}
+	defer resp.Body.Close()
 
-	var UserInfoResp UserInfoResp
+	var UserInfoResp userInfoResp
 	err = json.Unmarshal(data, &UserInfoResp)
 	if err != nil {
 		return nil, err

pkg/apiserver/authentication/identityprovider/generic_provider.go

@@ -0,0 +1,48 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package identityprovider
+
+import (
+	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
+)
+
+var (
+	builtinGenericProviders = make(map[string]GenericProviderFactory)
+)
+
+type GenericProvider interface {
+	// Authenticate from remote server
+	Authenticate(username string, password string) (Identity, error)
+}
+
+type GenericProviderFactory interface {
+	// Type unique type of the provider
+	Type() string
+	// Apply the dynamic options from kubesphere-config
+	Create(options *oauth.DynamicOptions) (GenericProvider, error)
+}
+
+func CreateGenericProvider(providerType string, options *oauth.DynamicOptions) (GenericProvider, error) {
+	if factory, ok := builtinGenericProviders[providerType]; ok {
+		return factory.Create(options)
+	}
+	return nil, identityProviderNotFound
+}
+
+func RegisterGenericProvider(factory GenericProviderFactory) {
+	builtinGenericProviders[factory.Type()] = factory
+}

pkg/apiserver/authentication/identityprovider/github/github.go

@@ -19,8 +19,8 @@ package github
 import (
 	"context"
 	"encoding/json"
+	"github.com/mitchellh/mapstructure"
 	"golang.org/x/oauth2"
-	"gopkg.in/yaml.v3"
 	"io/ioutil"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
@@ -31,7 +31,11 @@ const (
 	UserInfoURL = "https://api.github.com/user"
 )
 
-type Github struct {
+func init() {
+	identityprovider.RegisterOAuthProvider(&githubProviderFactory{})
+}
+
+type github struct {
 	// ClientID is the application's ID.
 	ClientID string `json:"clientID" yaml:"clientID"`
 
@@ -41,8 +45,8 @@ type Github struct {
 	// Endpoint contains the resource server's token endpoint
 	// URLs. These are constants specific to each server and are
 	// often available via site-specific packages, such as
-	// google.Endpoint or github.Endpoint.
-	Endpoint Endpoint `json:"endpoint" yaml:"endpoint"`
+	// google.Endpoint or github.endpoint.
+	Endpoint endpoint `json:"endpoint" yaml:"endpoint"`
 
 	// RedirectURL is the URL to redirect users going through
 	// the OAuth flow, after the resource owner's URLs.
@@ -52,14 +56,14 @@ type Github struct {
 	Scopes []string `json:"scopes" yaml:"scopes"`
 }
 
-// Endpoint represents an OAuth 2.0 provider's authorization and token
+// endpoint represents an OAuth 2.0 provider's authorization and token
 // endpoint URLs.
-type Endpoint struct {
+type endpoint struct {
 	AuthURL  string `json:"authURL" yaml:"authURL"`
 	TokenURL string `json:"tokenURL" yaml:"tokenURL"`
 }
 
-type GithubIdentity struct {
+type githubIdentity struct {
 	Login             string    `json:"login"`
 	ID                int       `json:"id"`
 	NodeID            string    `json:"node_id"`
@@ -98,36 +102,38 @@ type GithubIdentity struct {
 	Collaborators     int       `json:"collaborators"`
 }
 
-func init() {
-	identityprovider.RegisterOAuthProvider(&Github{})
+type githubProviderFactory struct {
 }
 
-func (g *Github) Type() string {
+func (g *githubProviderFactory) Type() string {
 	return "GitHubIdentityProvider"
 }
 
-func (g *Github) Setup(options *oauth.DynamicOptions) (identityprovider.OAuthProvider, error) {
-	data, err := yaml.Marshal(options)
-	if err != nil {
+func (g *githubProviderFactory) Create(options *oauth.DynamicOptions) (identityprovider.OAuthProvider, error) {
+	var github github
+	if err := mapstructure.Decode(options, &github); err != nil {
 		return nil, err
 	}
-	var provider Github
-	err = yaml.Unmarshal(data, &provider)
-	if err != nil {
-		return nil, err
-	}
-	return &provider, nil
+	return &github, nil
 }
 
-func (g GithubIdentity) GetName() string {
+func (g githubIdentity) GetUserID() string {
 	return g.Login
 }
 
-func (g GithubIdentity) GetEmail() string {
+func (g githubIdentity) GetUsername() string {
+	return g.Login
+}
+
+func (g githubIdentity) GetEmail() string {
 	return g.Email
 }
 
-func (g *Github) IdentityExchange(code string) (identityprovider.Identity, error) {
+func (g githubIdentity) GetDisplayName() string {
+	return ""
+}
+
+func (g *github) IdentityExchange(code string) (identityprovider.Identity, error) {
 	config := oauth2.Config{
 		ClientID:     g.ClientID,
 		ClientSecret: g.ClientSecret,
@@ -141,27 +147,23 @@ func (g *Github) IdentityExchange(code string) (identityprovider.Identity, error
 	}
 
 	token, err := config.Exchange(context.Background(), code)
-
 	if err != nil {
 		return nil, err
 	}
 
 	resp, err := oauth2.NewClient(context.Background(), oauth2.StaticTokenSource(token)).Get(UserInfoURL)
-
 	if err != nil {
 		return nil, err
 	}
 
 	data, err := ioutil.ReadAll(resp.Body)
-	defer resp.Body.Close()
 	if err != nil {
 		return nil, err
 	}
+	defer resp.Body.Close()
 
-	var githubIdentity GithubIdentity
-
+	var githubIdentity githubIdentity
 	err = json.Unmarshal(data, &githubIdentity)
-
 	if err != nil {
 		return nil, err
 	}

pkg/apiserver/authentication/identityprovider/identity.go

@@ -17,6 +17,12 @@ limitations under the License.
 package identityprovider
 
 type Identity interface {
-	GetName() string
+	// required
+	GetUserID() string
+	// optional
+	GetUsername() string
+	// optional
+	GetDisplayName() string
+	// optional
 	GetEmail() string
 }

pkg/apiserver/authentication/identityprovider/ldap/ldap_provider.go

@@ -1,22 +1,20 @@
 /*
+Copyright 2020 The KubeSphere Authors.
 
- Copyright 2020 The KubeSphere Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
 
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
+    http://www.apache.org/licenses/LICENSE-2.0
 
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
 */
 
-package identityprovider
+package ldap
 
 import (
 	"crypto/tls"
@@ -26,24 +24,23 @@ import (
 	"github.com/go-ldap/ldap"
 	"github.com/mitchellh/mapstructure"
 	"io/ioutil"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/klog"
-	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	"kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
-	"kubesphere.io/kubesphere/pkg/constants"
 	"time"
 )
 
 const (
-	LdapIdentityProvider = "LDAPIdentityProvider"
+	ldapIdentityProvider = "LDAPIdentityProvider"
 	defaultReadTimeout   = 15000
 )
 
-type LdapProvider interface {
-	Authenticate(username string, password string) (*iamv1alpha2.User, error)
+func init() {
+	identityprovider.RegisterGenericProvider(&ldapProviderFactory{})
 }
 
-type ldapOptions struct {
+type ldapProvider struct {
 	// Host and optional port of the LDAP server in the form "host:port".
 	// If the port is not supplied, 389 for insecure or StartTLS connections, 636
 	Host string `json:"host,omitempty" yaml:"managerDN"`
@@ -73,105 +70,125 @@ type ldapOptions struct {
 	UserMemberAttribute string `json:"userMemberAttribute,omitempty" yaml:"userMemberAttribute"`
 	// Attribute on a group object storing the information for primary group membership.
 	GroupMemberAttribute string `json:"groupMemberAttribute,omitempty" yaml:"groupMemberAttribute"`
-	// login attribute used for comparing user entries.
 	// The following three fields are direct mappings of attributes on the user entry.
+	// login attribute used for comparing user entries.
 	LoginAttribute       string `json:"loginAttribute" yaml:"loginAttribute"`
 	MailAttribute        string `json:"mailAttribute" yaml:"mailAttribute"`
 	DisplayNameAttribute string `json:"displayNameAttribute" yaml:"displayNameAttribute"`
 }
 
-type ldapProvider struct {
-	options ldapOptions
+type ldapProviderFactory struct {
 }
 
-func NewLdapProvider(options *oauth.DynamicOptions) (LdapProvider, error) {
-	var ldapOptions ldapOptions
-	if err := mapstructure.Decode(options, &ldapOptions); err != nil {
+func (l *ldapProviderFactory) Type() string {
+	return ldapIdentityProvider
+}
+
+func (l *ldapProviderFactory) Create(options *oauth.DynamicOptions) (identityprovider.GenericProvider, error) {
+	var ldapProvider ldapProvider
+	if err := mapstructure.Decode(options, &ldapProvider); err != nil {
 		return nil, err
 	}
-	if ldapOptions.ReadTimeout <= 0 {
-		ldapOptions.ReadTimeout = defaultReadTimeout
+	if ldapProvider.ReadTimeout <= 0 {
+		ldapProvider.ReadTimeout = defaultReadTimeout
 	}
-	return &ldapProvider{options: ldapOptions}, nil
+	return &ldapProvider, nil
 }
 
-func (l ldapProvider) Authenticate(username string, password string) (*iamv1alpha2.User, error) {
+type ldapIdentity struct {
+	Username    string
+	Email       string
+	DisplayName string
+}
+
+func (l *ldapIdentity) GetUserID() string {
+	return l.Username
+}
+
+func (l *ldapIdentity) GetUsername() string {
+	return l.Username
+}
+
+func (l *ldapIdentity) GetEmail() string {
+	return l.Email
+}
+
+func (l *ldapIdentity) GetDisplayName() string {
+	return l.DisplayName
+}
+
+func (l ldapProvider) Authenticate(username string, password string) (identityprovider.Identity, error) {
 	conn, err := l.newConn()
 	if err != nil {
 		klog.Error(err)
 		return nil, err
 	}
-	conn.SetTimeout(time.Duration(l.options.ReadTimeout) * time.Millisecond)
+	conn.SetTimeout(time.Duration(l.ReadTimeout) * time.Millisecond)
 	defer conn.Close()
-	err = conn.Bind(l.options.ManagerDN, l.options.ManagerPassword)
+	err = conn.Bind(l.ManagerDN, l.ManagerPassword)
 
 	if err != nil {
 		klog.Error(err)
 		return nil, err
 	}
 
-	filter := fmt.Sprintf("(&(%s=%s)%s)", l.options.LoginAttribute, username, l.options.UserSearchFilter)
+	filter := fmt.Sprintf("(&(%s=%s)%s)", l.LoginAttribute, username, l.UserSearchFilter)
 	result, err := conn.Search(&ldap.SearchRequest{
-		BaseDN:       l.options.UserSearchBase,
+		BaseDN:       l.UserSearchBase,
 		Scope:        ldap.ScopeWholeSubtree,
 		DerefAliases: ldap.NeverDerefAliases,
 		SizeLimit:    1,
 		TimeLimit:    0,
 		TypesOnly:    false,
 		Filter:       filter,
-		Attributes:   []string{l.options.LoginAttribute, l.options.MailAttribute, l.options.DisplayNameAttribute},
+		Attributes:   []string{l.LoginAttribute, l.MailAttribute, l.DisplayNameAttribute},
 	})
 	if err != nil {
 		klog.Error(err)
 		return nil, err
 	}
 
-	if len(result.Entries) == 1 {
-		entry := result.Entries[0]
-		err = conn.Bind(entry.DN, password)
-		if err != nil {
-			klog.Error(err)
-			return nil, err
-		}
-		email := entry.GetAttributeValue(l.options.MailAttribute)
-		displayName := entry.GetAttributeValue(l.options.DisplayNameAttribute)
-		return &iamv1alpha2.User{
-			ObjectMeta: metav1.ObjectMeta{
-				Name: username,
-				Annotations: map[string]string{
-					constants.DisplayNameAnnotationKey: displayName,
-				},
-			},
-			Spec: iamv1alpha2.UserSpec{
-				Email:       email,
-				DisplayName: displayName,
-			},
-		}, nil
+	if len(result.Entries) != 1 {
+		return nil, errors.NewUnauthorized("incorrect password")
 	}
 
-	return nil, ldap.NewError(ldap.LDAPResultNoSuchObject, fmt.Errorf("could not find user %s in LDAP directory", username))
+	entry := result.Entries[0]
+	if err = conn.Bind(entry.DN, password); err != nil {
+		klog.Error(err)
+		if ldap.IsErrorWithCode(err, ldap.LDAPResultInvalidCredentials) {
+			return nil, errors.NewUnauthorized("incorrect password")
+		}
+		return nil, err
+	}
+	email := entry.GetAttributeValue(l.MailAttribute)
+	displayName := entry.GetAttributeValue(l.DisplayNameAttribute)
+	return &ldapIdentity{
+		Username:    username,
+		DisplayName: displayName,
+		Email:       email,
+	}, nil
 }
 
 func (l *ldapProvider) newConn() (*ldap.Conn, error) {
-	if !l.options.StartTLS {
-		return ldap.Dial("tcp", l.options.Host)
+	if !l.StartTLS {
+		return ldap.Dial("tcp", l.Host)
 	}
 	tlsConfig := tls.Config{}
-	if l.options.InsecureSkipVerify {
+	if l.InsecureSkipVerify {
 		tlsConfig.InsecureSkipVerify = true
 	}
 	tlsConfig.RootCAs = x509.NewCertPool()
 	var caCert []byte
 	var err error
 	// Load CA cert
-	if l.options.RootCA != "" {
-		if caCert, err = ioutil.ReadFile(l.options.RootCA); err != nil {
+	if l.RootCA != "" {
+		if caCert, err = ioutil.ReadFile(l.RootCA); err != nil {
 			klog.Error(err)
 			return nil, err
 		}
 	}
-	if l.options.RootCAData != "" {
-		if caCert, err = base64.StdEncoding.DecodeString(l.options.RootCAData); err != nil {
+	if l.RootCAData != "" {
+		if caCert, err = base64.StdEncoding.DecodeString(l.RootCAData); err != nil {
 			klog.Error(err)
 			return nil, err
 		}
@@ -179,5 +196,5 @@ func (l *ldapProvider) newConn() (*ldap.Conn, error) {
 	if caCert != nil {
 		tlsConfig.RootCAs.AppendCertsFromPEM(caCert)
 	}
-	return ldap.DialTLS("tcp", l.options.Host, &tlsConfig)
+	return ldap.DialTLS("tcp", l.Host, &tlsConfig)
 }

pkg/apiserver/authentication/identityprovider/ldap/ldap_provider_test.go

@@ -1,22 +1,20 @@
 /*
+Copyright 2020 The KubeSphere Authors.
 
- Copyright 2020 The KubeSphere Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
 
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
+    http://www.apache.org/licenses/LICENSE-2.0
 
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
 */
 
-package identityprovider
+package ldap
 
 import (
 	"github.com/google/go-cmp/cmp"
@@ -42,12 +40,11 @@ mailAttribute: mail
 	if err != nil {
 		t.Fatal(err)
 	}
-	provider, err := NewLdapProvider(&dynamicOptions)
+	got, err := new(ldapProviderFactory).Create(&dynamicOptions)
 	if err != nil {
 		t.Fatal(err)
 	}
-	got := provider.(*ldapProvider).options
-	expected := ldapOptions{
+	expected := &ldapProvider{
 		Host:                 "test.sn.mynetname.net:389",
 		StartTLS:             false,
 		InsecureSkipVerify:   false,
@@ -81,14 +78,14 @@ func TestLdapProvider_Authenticate(t *testing.T) {
 		t.Fatal(err)
 	}
 	var dynamicOptions oauth.DynamicOptions
-	if err := yaml.Unmarshal(options, &dynamicOptions); err != nil {
+	if err = yaml.Unmarshal(options, &dynamicOptions); err != nil {
 		t.Fatal(err)
 	}
-	provider, err := NewLdapProvider(&dynamicOptions)
+	ldapProvider, err := new(ldapProviderFactory).Create(&dynamicOptions)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if _, err := provider.Authenticate("test", "test"); err != nil {
+	if _, err = ldapProvider.Authenticate("test", "test"); err != nil {
 		t.Fatal(err)
 	}
 }

pkg/apiserver/authentication/identityprovider/oauth_provider.go

@@ -1,21 +1,18 @@
 /*
+Copyright 2020 The KubeSphere Authors.
 
- Copyright 2020 The KubeSphere Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
 
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
+    http://www.apache.org/licenses/LICENSE-2.0
 
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
 */
-
 package identityprovider
 
 import (
@@ -24,23 +21,29 @@ import (
 )
 
 var (
-	oauthProviders                = make(map[string]OAuthProvider, 0)
-	ErrorIdentityProviderNotFound = errors.New("the identity provider was not found")
+	builtinOAuthProviders    = make(map[string]OAuthProviderFactory)
+	identityProviderNotFound = errors.New("identity provider not found")
 )
 
 type OAuthProvider interface {
-	Type() string
-	Setup(options *oauth.DynamicOptions) (OAuthProvider, error)
+	// IdentityExchange exchange identity from remote server
 	IdentityExchange(code string) (Identity, error)
 }
 
-func GetOAuthProvider(providerType string, options *oauth.DynamicOptions) (OAuthProvider, error) {
-	if provider, ok := oauthProviders[providerType]; ok {
-		return provider.Setup(options)
-	}
-	return nil, ErrorIdentityProviderNotFound
+type OAuthProviderFactory interface {
+	// Type unique type of the provider
+	Type() string
+	// Apply the dynamic options from kubesphere-config
+	Create(options *oauth.DynamicOptions) (OAuthProvider, error)
 }
 
-func RegisterOAuthProvider(provider OAuthProvider) {
-	oauthProviders[provider.Type()] = provider
+func CreateOAuthProvider(providerType string, options *oauth.DynamicOptions) (OAuthProvider, error) {
+	if provider, ok := builtinOAuthProviders[providerType]; ok {
+		return provider.Create(options)
+	}
+	return nil, identityProviderNotFound
+}
+
+func RegisterOAuthProvider(factory OAuthProviderFactory) {
+	builtinOAuthProviders[factory.Type()] = factory
 }

pkg/apiserver/authentication/oauth/oauth_options.go

@@ -35,12 +35,13 @@ const (
 	// GrantHandlerDeny auto-denies client authorization grant requests
 	GrantHandlerDeny GrantHandlerType = "deny"
 	// MappingMethodAuto  The default value.The user will automatically create and mapping when login successful.
-	// Fails if a user with that user name is already mapped to another identity.
+	// Fails if a user with that username is already mapped to another identity.
 	MappingMethodAuto MappingMethod = "auto"
 	// MappingMethodLookup Looks up an existing identity, user identity mapping, and user, but does not automatically
 	// provision users or identities. Using this method requires you to manually provision users.
 	MappingMethodLookup MappingMethod = "lookup"
 	// MappingMethodMixed  A user entity can be mapped with multiple identifyProvider.
+	// not supported yet.
 	MappingMethodMixed MappingMethod = "mixed"
 )
 

pkg/apiserver/authentication/options/authenticate_options.go

@@ -21,6 +21,7 @@ import (
 	"github.com/spf13/pflag"
 	_ "kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider/aliyunidaas"
 	_ "kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider/github"
+	_ "kubesphere.io/kubesphere/pkg/apiserver/authentication/identityprovider/ldap"
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
 	"time"
 )
@@ -66,7 +67,6 @@ func (options *AuthenticationOptions) Validate() []error {
 	if len(options.JwtSecret) == 0 {
 		errs = append(errs, fmt.Errorf("jwt secret is empty"))
 	}
-
 	return errs
 }
 

pkg/apiserver/authentication/token/jwt.go

@@ -29,9 +29,10 @@ const (
 )
 
 type Claims struct {
-	Username  string    `json:"username"`
-	UID       string    `json:"uid"`
-	TokenType TokenType `json:"token_type"`
+	Username  string              `json:"username"`
+	Groups    []string            `json:"groups,omitempty"`
+	Extra     map[string][]string `json:"extra,omitempty"`
+	TokenType TokenType           `json:"token_type"`
 	// Currently, we are not using any field in jwt.StandardClaims
 	jwt.StandardClaims
 }
@@ -51,7 +52,7 @@ func (s *jwtTokenIssuer) Verify(tokenString string) (user.Info, TokenType, error
 		klog.Error(err)
 		return nil, "", err
 	}
-	return &user.DefaultInfo{Name: clm.Username, UID: clm.UID}, clm.TokenType, nil
+	return &user.DefaultInfo{Name: clm.Username, Groups: clm.Groups, Extra: clm.Extra}, clm.TokenType, nil
 }
 
 func (s *jwtTokenIssuer) IssueTo(user user.Info, tokenType TokenType, expiresIn time.Duration) (string, error) {
@@ -59,7 +60,8 @@ func (s *jwtTokenIssuer) IssueTo(user user.Info, tokenType TokenType, expiresIn
 	notBefore := issueAt
 	clm := &Claims{
 		Username:  user.GetName(),
-		UID:       user.GetUID(),
+		Groups:    user.GetGroups(),
+		Extra:     user.GetExtra(),
 		TokenType: tokenType,
 		StandardClaims: jwt.StandardClaims{
 			IssuedAt:  issueAt,

pkg/apiserver/authorization/rbac/evaluation_helpers.go

@@ -0,0 +1,181 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Following code copied from k8s.io/kubernetes/pkg/apis/rbac/v1  to avoid import collision
+
+package rbac
+
+import (
+	"fmt"
+	"strings"
+
+	rbacv1 "k8s.io/api/rbac/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func RoleRefGroupKind(roleRef rbacv1.RoleRef) schema.GroupKind {
+	return schema.GroupKind{Group: roleRef.APIGroup, Kind: roleRef.Kind}
+}
+
+func VerbMatches(rule *rbacv1.PolicyRule, requestedVerb string) bool {
+	for _, ruleVerb := range rule.Verbs {
+		if ruleVerb == rbacv1.VerbAll {
+			return true
+		}
+		if ruleVerb == requestedVerb {
+			return true
+		}
+	}
+
+	return false
+}
+
+func APIGroupMatches(rule *rbacv1.PolicyRule, requestedGroup string) bool {
+	for _, ruleGroup := range rule.APIGroups {
+		if ruleGroup == rbacv1.APIGroupAll {
+			return true
+		}
+		if ruleGroup == requestedGroup {
+			return true
+		}
+	}
+
+	return false
+}
+
+func ResourceMatches(rule *rbacv1.PolicyRule, combinedRequestedResource, requestedSubresource string) bool {
+	for _, ruleResource := range rule.Resources {
+		// if everything is allowed, we match
+		if ruleResource == rbacv1.ResourceAll {
+			return true
+		}
+		// if we have an exact match, we match
+		if ruleResource == combinedRequestedResource {
+			return true
+		}
+
+		// We can also match a */subresource.
+		// if there isn't a subresource, then continue
+		if len(requestedSubresource) == 0 {
+			continue
+		}
+		// if the rule isn't in the format */subresource, then we don't match, continue
+		if len(ruleResource) == len(requestedSubresource)+2 &&
+			strings.HasPrefix(ruleResource, "*/") &&
+			strings.HasSuffix(ruleResource, requestedSubresource) {
+			return true
+
+		}
+	}
+
+	return false
+}
+
+func ResourceNameMatches(rule *rbacv1.PolicyRule, requestedName string) bool {
+	if len(rule.ResourceNames) == 0 {
+		return true
+	}
+
+	for _, ruleName := range rule.ResourceNames {
+		if ruleName == requestedName {
+			return true
+		}
+	}
+
+	return false
+}
+
+func NonResourceURLMatches(rule *rbacv1.PolicyRule, requestedURL string) bool {
+	for _, ruleURL := range rule.NonResourceURLs {
+		if ruleURL == rbacv1.NonResourceAll {
+			return true
+		}
+		if ruleURL == requestedURL {
+			return true
+		}
+		if strings.HasSuffix(ruleURL, "*") && strings.HasPrefix(requestedURL, strings.TrimRight(ruleURL, "*")) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// subjectsStrings returns users, groups, serviceaccounts, unknown for display purposes.
+func SubjectsStrings(subjects []rbacv1.Subject) ([]string, []string, []string, []string) {
+	users := []string{}
+	groups := []string{}
+	sas := []string{}
+	others := []string{}
+
+	for _, subject := range subjects {
+		switch subject.Kind {
+		case rbacv1.ServiceAccountKind:
+			sas = append(sas, fmt.Sprintf("%s/%s", subject.Namespace, subject.Name))
+
+		case rbacv1.UserKind:
+			users = append(users, subject.Name)
+
+		case rbacv1.GroupKind:
+			groups = append(groups, subject.Name)
+
+		default:
+			others = append(others, fmt.Sprintf("%s/%s/%s", subject.Kind, subject.Namespace, subject.Name))
+		}
+	}
+
+	return users, groups, sas, others
+}
+
+func String(r rbacv1.PolicyRule) string {
+	return "PolicyRule" + CompactString(r)
+}
+
+// CompactString exposes a compact string representation for use in escalation error messages
+func CompactString(r rbacv1.PolicyRule) string {
+	formatStringParts := []string{}
+	formatArgs := []interface{}{}
+	if len(r.APIGroups) > 0 {
+		formatStringParts = append(formatStringParts, "APIGroups:%q")
+		formatArgs = append(formatArgs, r.APIGroups)
+	}
+	if len(r.Resources) > 0 {
+		formatStringParts = append(formatStringParts, "Resources:%q")
+		formatArgs = append(formatArgs, r.Resources)
+	}
+	if len(r.NonResourceURLs) > 0 {
+		formatStringParts = append(formatStringParts, "NonResourceURLs:%q")
+		formatArgs = append(formatArgs, r.NonResourceURLs)
+	}
+	if len(r.ResourceNames) > 0 {
+		formatStringParts = append(formatStringParts, "ResourceNames:%q")
+		formatArgs = append(formatArgs, r.ResourceNames)
+	}
+	if len(r.Verbs) > 0 {
+		formatStringParts = append(formatStringParts, "Verbs:%q")
+		formatArgs = append(formatArgs, r.Verbs)
+	}
+	formatString := "{" + strings.Join(formatStringParts, ", ") + "}"
+	return fmt.Sprintf(formatString, formatArgs...)
+}
+
+type SortableRuleSlice []rbacv1.PolicyRule
+
+func (s SortableRuleSlice) Len() int      { return len(s) }
+func (s SortableRuleSlice) Swap(i, j int) { s[i], s[j] = s[j], s[i] }
+func (s SortableRuleSlice) Less(i, j int) bool {
+	return strings.Compare(s[i].String(), s[j].String()) < 0
+}

pkg/apiserver/authorization/rbac/rbac.go

@@ -16,7 +16,7 @@ limitations under the License.
 
 // NOTE: This file is copied from k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac.
 
-package authorizerfactory
+package rbac
 
 import (
 	"bytes"
@@ -36,7 +36,6 @@ import (
 	rbacv1 "k8s.io/api/rbac/v1"
 	utilerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/apiserver/pkg/authentication/user"
-	rbacv1helpers "kubesphere.io/kubesphere/pkg/api/rbac/v1"
 )
 
 const (
@@ -159,14 +158,14 @@ func ruleAllows(requestAttributes authorizer.Attributes, rule *rbacv1.PolicyRule
 			combinedResource = requestAttributes.GetResource() + "/" + requestAttributes.GetSubresource()
 		}
 
-		return rbacv1helpers.VerbMatches(rule, requestAttributes.GetVerb()) &&
-			rbacv1helpers.APIGroupMatches(rule, requestAttributes.GetAPIGroup()) &&
-			rbacv1helpers.ResourceMatches(rule, combinedResource, requestAttributes.GetSubresource()) &&
-			rbacv1helpers.ResourceNameMatches(rule, requestAttributes.GetName())
+		return VerbMatches(rule, requestAttributes.GetVerb()) &&
+			APIGroupMatches(rule, requestAttributes.GetAPIGroup()) &&
+			ResourceMatches(rule, combinedResource, requestAttributes.GetSubresource()) &&
+			ResourceNameMatches(rule, requestAttributes.GetName())
 	}
 
-	return rbacv1helpers.VerbMatches(rule, requestAttributes.GetVerb()) &&
-		rbacv1helpers.NonResourceURLMatches(rule, requestAttributes.GetPath())
+	return VerbMatches(rule, requestAttributes.GetVerb()) &&
+		NonResourceURLMatches(rule, requestAttributes.GetPath())
 }
 
 func regoPolicyAllows(requestAttributes authorizer.Attributes, regoPolicy string) bool {

pkg/apiserver/authorization/rbac/rbac_test.go

@@ -1,20 +1,22 @@
 /*
-Copyright 2016 The Kubernetes Authors.
 
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
+ Copyright 2020 The KubeSphere Authors.
 
-    http://www.apache.org/licenses/LICENSE-2.0
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
 
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
 */
 
-package authorizerfactory
+package rbac
 
 import (
 	"errors"

pkg/apiserver/filters/authentication.go

@@ -26,26 +26,23 @@ import (
 	"k8s.io/apiserver/pkg/authentication/authenticator"
 	"k8s.io/apiserver/pkg/endpoints/handlers/responsewriters"
 	"k8s.io/klog"
-	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 	"kubesphere.io/kubesphere/pkg/apiserver/request"
-	"kubesphere.io/kubesphere/pkg/models/iam/im"
 	"net/http"
-	"strings"
 )
 
 // WithAuthentication installs authentication handler to handler chain.
 // The following part is a little bit ugly, WithAuthentication also logs user failed login attempt
 // if using basic auth. But only treats request with requestURI `/oauth/authorize` as login attempt
-func WithAuthentication(handler http.Handler, auth authenticator.Request, loginRecorder im.LoginRecorder) http.Handler {
-	if auth == nil {
+func WithAuthentication(handler http.Handler, authRequest authenticator.Request) http.Handler {
+	if authRequest == nil {
 		klog.Warningf("Authentication is disabled")
 		return handler
 	}
 	s := serializer.NewCodecFactory(runtime.NewScheme()).WithoutConversion()
 
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		resp, ok, err := auth.AuthenticateRequest(req)
-		username, _, usingBasicAuth := req.BasicAuth()
+		resp, ok, err := authRequest.AuthenticateRequest(req)
+		_, _, usingBasicAuth := req.BasicAuth()
 
 		defer func() {
 			// if we authenticated successfully, go ahead and remove the bearer token so that no one
@@ -56,41 +53,17 @@ func WithAuthentication(handler http.Handler, auth authenticator.Request, loginR
 		}()
 
 		if err != nil || !ok {
-			if err != nil {
-				klog.Errorf("Unable to authenticate the request due to error: %v", err)
-				if usingBasicAuth && err.Error() == im.AuthFailedIncorrectPassword.Error() { // log failed login attempts
-					go func(user string) {
-						if loginRecorder != nil && len(user) != 0 {
-							err = loginRecorder.RecordLogin(user, iamv1alpha2.BasicAuth, "", err, req)
-							klog.Errorf("Failed to record unsuccessful login attempt for user %s, error: %v", user, err)
-						}
-					}(username)
-				}
-			}
-
 			ctx := req.Context()
 			requestInfo, found := request.RequestInfoFrom(ctx)
 			if !found {
 				responsewriters.InternalError(w, req, errors.New("no RequestInfo found in the context"))
 				return
 			}
-
 			gv := schema.GroupVersion{Group: requestInfo.APIGroup, Version: requestInfo.APIVersion}
-			if err != nil && err.Error() == im.AuthRateLimitExceeded.Error() {
-				responsewriters.ErrorNegotiated(apierrors.NewTooManyRequests(fmt.Sprintf("Unauthorized: %s", err), 60), s, gv, w, req)
-			} else {
-				responsewriters.ErrorNegotiated(apierrors.NewUnauthorized(fmt.Sprintf("Unauthorized: %s", err)), s, gv, w, req)
-			}
+			responsewriters.ErrorNegotiated(apierrors.NewUnauthorized(fmt.Sprintf("Unauthorized: %s", err)), s, gv, w, req)
 			return
 		}
 
-		go func() {
-			if loginRecorder != nil && usingBasicAuth && strings.HasPrefix(req.URL.Path, "/oauth/authorize") {
-				err = loginRecorder.RecordLogin(username, iamv1alpha2.BasicAuth, "", nil, req)
-				klog.Errorf("Failed to record unsuccessful login attempt for user %s, error: %v", username, err)
-			}
-		}()
-
 		req = req.WithContext(request.WithUser(req.Context(), resp.User))
 		handler.ServeHTTP(w, req)
 	})

pkg/apiserver/request/requestinfo.go

@@ -31,6 +31,7 @@ import (
 	"k8s.io/klog"
 	"kubesphere.io/kubesphere/pkg/api"
 	"kubesphere.io/kubesphere/pkg/constants"
+	netutils "kubesphere.io/kubesphere/pkg/utils/net"
 	"net/http"
 	"strings"
 
@@ -74,6 +75,12 @@ type RequestInfo struct {
 
 	// Scope of requested resource.
 	ResourceScope string
+
+	// Source IP
+	SourceIP string
+
+	// User agent
+	UserAgent string
 }
 
 type RequestInfoFactory struct {
@@ -119,6 +126,8 @@ func (r *RequestInfoFactory) NewRequestInfo(req *http.Request) (*RequestInfo, er
 		},
 		Workspace: api.WorkspaceNone,
 		Cluster:   api.ClusterNone,
+		SourceIP:  netutils.GetRequestIP(req),
+		UserAgent: req.UserAgent(),
 	}
 
 	defer func() {