public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Authn: JWT client (#61157)

Browse Source 
* add jwt client

* alias JWT verifier

* debug implementation

* add tests for jwt client

* add constant for JWT module

* Feedback

Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>

Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>
This commit is contained in:
Jo
2023-01-10 15:08:52 +01:00
committed by GitHub
co-authored by Kalle Persson Mihály Gyöngyösi
parent 2de72c1c39
commit 0c8ad80575
16 changed files with 539 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/authnimpl/usersync/orgsync_test.go
+10 -10
View File
@@ -77,13 +77,13 @@ func TestOrgSync_SyncOrgUser(t *testing.T) {
Email: "test",
OrgRoles: map[int64]roletype.RoleType{1: org.RoleAdmin, 2: org.RoleEditor},
IsGrafanaAdmin: ptrBool(false),
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test"),
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test"),
Login: nil,
},
},
},
},
@@ -95,13 +95,13 @@ func TestOrgSync_SyncOrgUser(t *testing.T) {
OrgRoles: map[int64]roletype.RoleType{1: org.RoleAdmin, 2: org.RoleEditor},
OrgID: 1, //set using org
IsGrafanaAdmin: ptrBool(false),
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test"),
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test"),
Login: nil,
},
},
},
wantErr: false,
pkg/services/authn/authnimpl/usersync/usersync.go
+2 -2
View File
@@ -32,7 +32,7 @@ func (s *UserSync) SyncUser(ctx context.Context, id *authn.Identity, _ *authn.Re
}
// Does user exist in the database?
usr, errUserInDB := s.UserInDB(ctx, &id.AuthModule, &id.AuthID, id.LookUpParams)
usr, errUserInDB := s.UserInDB(ctx, &id.AuthModule, &id.AuthID, id.ClientParams.LookUpParams)
if errUserInDB != nil && !errors.Is(errUserInDB, user.ErrUserNotFound) {
return errUserInDB
}
@@ -244,7 +244,7 @@ func (s *UserSync) LookupByOneOf(ctx context.Context, params *models.UserLookupP
}
}
if usr == nil {
if usr == nil || usr.ID == 0 { // id check as safeguard against returning empty user
return nil, user.ErrUserNotFound
}
pkg/services/authn/authnimpl/usersync/usersync_test.go
+77 -75
View File
@@ -110,12 +110,13 @@ func TestUserSync_SyncUser(t *testing.T) {
Login: "test",
Name: "test",
Email: "test",
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test"),
Login: nil,
ClientParams: authn.ClientParams{
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test"),
Login: nil,
},
},
ClientParams: authn.ClientParams{},
},
},
wantErr: false,
@@ -124,12 +125,13 @@ func TestUserSync_SyncUser(t *testing.T) {
Login: "test",
Name: "test",
Email: "test",
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test"),
Login: nil,
ClientParams: authn.ClientParams{
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test"),
Login: nil,
},
},
ClientParams: authn.ClientParams{},
},
},
{
@@ -147,13 +149,13 @@ func TestUserSync_SyncUser(t *testing.T) {
Login: "test",
Name: "test",
Email: "test",
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test"),
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test"),
Login: nil,
},
},
},
},
@@ -164,13 +166,13 @@ func TestUserSync_SyncUser(t *testing.T) {
Name: "test",
Email: "test",
IsGrafanaAdmin: ptrBool(false),
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test"),
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test"),
Login: nil,
},
},
},
},
@@ -189,13 +191,13 @@ func TestUserSync_SyncUser(t *testing.T) {
Login: "test",
Name: "test",
Email: "test",
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: nil,
Login: ptrString("test"),
},
ClientParams: authn.ClientParams{
SyncUser: true,
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: nil,
Login: ptrString("test"),
},
},
},
},
@@ -206,12 +208,12 @@ func TestUserSync_SyncUser(t *testing.T) {
Name: "test",
Email: "test",
IsGrafanaAdmin: ptrBool(false),
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: nil,
Login: ptrString("test"),
},
ClientParams: authn.ClientParams{
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: nil,
Login: ptrString("test"),
},
SyncUser: true,
},
},
@@ -231,13 +233,13 @@ func TestUserSync_SyncUser(t *testing.T) {
Login: "test",
Name: "test",
Email: "test",
LookUpParams: models.UserLookupParams{
UserID: ptrInt64(1),
Email: nil,
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
LookUpParams: models.UserLookupParams{
UserID: ptrInt64(1),
Email: nil,
Login: nil,
},
},
},
},
@@ -248,13 +250,13 @@ func TestUserSync_SyncUser(t *testing.T) {
Name: "test",
Email: "test",
IsGrafanaAdmin: ptrBool(false),
LookUpParams: models.UserLookupParams{
UserID: ptrInt64(1),
Email: nil,
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
LookUpParams: models.UserLookupParams{
UserID: ptrInt64(1),
Email: nil,
Login: nil,
},
},
},
},
@@ -274,13 +276,13 @@ func TestUserSync_SyncUser(t *testing.T) {
Login: "test",
Name: "test",
Email: "test",
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: nil,
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: nil,
Login: nil,
},
},
},
},
@@ -291,13 +293,13 @@ func TestUserSync_SyncUser(t *testing.T) {
Name: "test",
Email: "test",
IsGrafanaAdmin: ptrBool(false),
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: nil,
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: nil,
Login: nil,
},
},
},
},
@@ -318,13 +320,13 @@ func TestUserSync_SyncUser(t *testing.T) {
Email: "test",
AuthModule: "oauth",
AuthID: "2032",
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: nil,
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: nil,
Login: nil,
},
},
},
},
@@ -348,15 +350,15 @@ func TestUserSync_SyncUser(t *testing.T) {
Email: "test_create",
AuthModule: "oauth",
AuthID: "2032",
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test_create"),
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
AllowSignUp: true,
EnableDisabledUsers: true,
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test_create"),
Login: nil,
},
},
},
},
@@ -369,15 +371,15 @@ func TestUserSync_SyncUser(t *testing.T) {
AuthModule: "oauth",
AuthID: "2032",
IsGrafanaAdmin: ptrBool(true),
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test_create"),
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
AllowSignUp: true,
EnableDisabledUsers: true,
LookUpParams: models.UserLookupParams{
UserID: nil,
Email: ptrString("test_create"),
Login: nil,
},
},
},
},
@@ -398,14 +400,14 @@ func TestUserSync_SyncUser(t *testing.T) {
Email: "test_mod",
IsDisabled: false,
IsGrafanaAdmin: ptrBool(true),
LookUpParams: models.UserLookupParams{
UserID: ptrInt64(3),
Email: nil,
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
EnableDisabledUsers: true,
LookUpParams: models.UserLookupParams{
UserID: ptrInt64(3),
Email: nil,
Login: nil,
},
},
},
},
@@ -417,14 +419,14 @@ func TestUserSync_SyncUser(t *testing.T) {
Email: "test_mod",
IsDisabled: false,
IsGrafanaAdmin: ptrBool(true),
LookUpParams: models.UserLookupParams{
UserID: ptrInt64(3),
Email: nil,
Login: nil,
},
ClientParams: authn.ClientParams{
SyncUser: true,
EnableDisabledUsers: true,
LookUpParams: models.UserLookupParams{
UserID: ptrInt64(3),
Email: nil,
Login: nil,
},
},
},
},