public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v10.4.x] Chore: Improve domain validation for Google OAuth - Backport 83229 to v10.4.x (#83726)

Browse Source 
* Chore: Query oauth info from a new instance (#83229)

* query OAuth info from a new instance

* add `hd` validation flag

* add `disable_hd_validation` to settings map

* update documentation

---------

Co-authored-by: Jo <joao.guerreiro@grafana.com>
(cherry picked from commit b02ae375ba)
This commit is contained in:
linoman
2024-03-04 13:05:16 +01:00
committed by GitHub
parent dcec8aafb7
commit 1c79d8e0c0
5 changed files with 93 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/setup-grafana/configure-security/configure-authentication/google/index.md
+8
View File
@@ -111,6 +111,14 @@ automatically signed up.
You may specify a domain to be passed as `hd` query parameter accepted by Google's
OAuth 2.0 authentication API. Refer to Google's OAuth [documentation](https://developers.google.com/identity/openid-connect/openid-connect#hd-param).
{{% admonition type="note" %}}
The `hd` parameter retrieved from Google ID token is also used to determine the user's hosted domain. The Google Oauth `allowed_domains` configuration option is used to restrict access to users from a specific domain. If the `allowed_domains` configuration option is set, the `hd` parameter from the Google ID token must match the `allowed_domains` configuration option. If the `hd` parameter from the Google ID token does not match the `allowed_domains` configuration option, the user is denied access.
When an account does not belong to a Google Workspace, the `hd` claim is not be available.
This validation will be enabled by default with Grafana 11.0. To disable this validation, set the `validate_hd` configuration option to `false`. The `allowed_domains` configuration option will use the email claim to validate the domain.
{{% /admonition %}}
#### PKCE
IETF's [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636)