Function ValidatePrincipalName

auth/role.go:166–218

ValidatePrincipalName performs the same checks as IsValidPrincipalName, but adds length check and returns a more verbose error message. This function is slower than IsValidPrincipalName, and should be used only for user and role creation. Names should have a max length of 239 chars, to account for

(name string)

// and role creation.  Names should have a max length of 239 chars, to account for SG prefixes.  All validation
// errors are concatenated and returned as one error message.
func ValidatePrincipalName(name string) error {
	namelen := len(name)
	if namelen == 0 {
		return nil // guest user
	}

	const validationMsg = "invalid name: "
	msgs := make([]string, 0, 4)

	if namelen > base.MaxPrincipalNameLen {
		const msg = "length exceeds 239" // leaving as const to avoid fmt performance (21% slower)
		msgs = append(msgs, msg)
	}

	if !utf8.ValidString(name) {
		const msg = "non UTF-8 encoding"
		msgs = append(msgs, msg)
	}

	seenAnInvalid := false
	seenAnAlphanum := false
	for _, char := range name {
		// Reasons for forbidding each of these:
		// colons: basic authentication uses them to separate usernames from passwords
		// commas: fails channels.IsValidChannel, which channels.compileAccessMap uses via SetFromArray
		// slashes: would need to make many (possibly breaking) changes to routing
		// backticks: MB-50619
		if (char == '/' || char == ':' || char == ',' || char == '`') && !seenAnInvalid {
			seenAnInvalid = true
			const msg = "contains '/', ':', ',', or '`'"
			msgs = append(msgs, msg)
			if seenAnAlphanum {
				break
			}
		}
		if !seenAnAlphanum && (unicode.IsLetter(char) || unicode.IsNumber(char)) {
			seenAnAlphanum = true
			if seenAnInvalid {
				break
			}
		}
	}

	if !seenAnAlphanum {
		const msg = "must contain alphanumeric"
		msgs = append(msgs, msg)
	}

	if len(msgs) > 0 {
		return errors.New(validationMsg + strings.Join(msgs, "; "))
	}
	return nil
}

// Creates a new Role object.
func (auth *Authenticator) NewRole(name string, channels base.Set) (Role, error) {