public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthN: Perform login with authn.Service (#61466)

Browse Source 
* AuthN: Create password client wrapper and use that on in basic auth
client

* AuthN: fix basic auth client test

* AuthN: Add tests for form authentication

* API: Inject authn service

* Login: If authnService feature flag is enabled use authn login

* Login: Handle token creation errors
This commit is contained in:
Karl Persson
2023-01-17 09:11:45 +01:00
committed by GitHub
parent 0d70eb18ac
commit 2324597d8d
13 changed files with 306 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/clients/basic_test.go
+10 -49
View File
@@ -7,7 +7,6 @@ import (
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/authn/authntest"
"github.com/grafana/grafana/pkg/services/loginattempt/loginattempttest"
"github.com/stretchr/testify/assert"
)
@@ -15,8 +14,7 @@ func TestBasic_Authenticate(t *testing.T) {
type TestCase struct {
desc string
req *authn.Request
blockLogin bool
clients []authn.PasswordClient
client authn.PasswordClient
expectedErr error
expectedIdentity *authn.Identity
}
@@ -25,40 +23,19 @@ func TestBasic_Authenticate(t *testing.T) {
{
desc: "should success when password client return identity",
req: &authn.Request{HTTPRequest: &http.Request{Header: map[string][]string{authorizationHeaderName: {encodeBasicAuth("user", "password")}}}},
clients: []authn.PasswordClient{authntest.FakePasswordClient{ExpectedIdentity: &authn.Identity{ID: "user:1"}}},
client: authntest.FakePasswordClient{ExpectedIdentity: &authn.Identity{ID: "user:1"}},
expectedIdentity: &authn.Identity{ID: "user:1"},
},
{
desc: "should success when found in second client",
req: &authn.Request{HTTPRequest: &http.Request{Header: map[string][]string{authorizationHeaderName: {encodeBasicAuth("user", "password")}}}},
clients: []authn.PasswordClient{authntest.FakePasswordClient{ExpectedErr: errIdentityNotFound}, authntest.FakePasswordClient{ExpectedIdentity: &authn.Identity{ID: "user:2"}}},
expectedIdentity: &authn.Identity{ID: "user:2"},
},
{
desc: "should fail for empty password",
req: &authn.Request{HTTPRequest: &http.Request{Header: map[string][]string{authorizationHeaderName: {encodeBasicAuth("user", "")}}}},
expectedErr: errBasicAuthCredentials,
},
{
desc: "should if login is blocked by to many attempts",
req: &authn.Request{HTTPRequest: &http.Request{Header: map[string][]string{authorizationHeaderName: {encodeBasicAuth("user", "")}}}},
blockLogin: true,
expectedErr: errBasicAuthCredentials,
},
{
desc: "should fail when not found in any clients",
req: &authn.Request{HTTPRequest: &http.Request{Header: map[string][]string{authorizationHeaderName: {encodeBasicAuth("user", "password")}}}},
clients: []authn.PasswordClient{authntest.FakePasswordClient{ExpectedErr: errIdentityNotFound}, authntest.FakePasswordClient{ExpectedErr: errIdentityNotFound}},
expectedErr: errBasicAuthCredentials,
desc: "should fail when basic auth header could not be decoded",
req: &authn.Request{HTTPRequest: &http.Request{Header: map[string][]string{authorizationHeaderName: {}}}},
expectedErr: errDecodingBasicAuthHeader,
},
}
for _, tt := range tests {
t.Run(tt.desc, func(t *testing.T) {
c := ProvideBasic(
loginattempttest.FakeLoginAttemptService{ExpectedValid: !tt.blockLogin},
tt.clients...,
)
c := ProvideBasic(tt.client)
identity, err := c.Authenticate(context.Background(), tt.req)
if tt.expectedErr != nil {
@@ -74,10 +51,9 @@ func TestBasic_Authenticate(t *testing.T) {
func TestBasic_Test(t *testing.T) {
type TestCase struct {
desc string
req *authn.Request
noClients bool
expected bool
desc string
req *authn.Request
expected bool
}
tests := []TestCase{
@@ -92,18 +68,6 @@ func TestBasic_Test(t *testing.T) {
},
expected: true,
},
{
desc: "should fail when no password client is configured",
req: &authn.Request{
HTTPRequest: &http.Request{
Header: map[string][]string{
authorizationHeaderName: {encodeBasicAuth("user", "password")},
},
},
},
noClients: true,
expected: false,
},
{
desc: "should fail when no http request is passed",
req: &authn.Request{},
@@ -124,10 +88,7 @@ func TestBasic_Test(t *testing.T) {
for _, tt := range tests {
t.Run(tt.desc, func(t *testing.T) {
c := ProvideBasic(loginattempttest.FakeLoginAttemptService{}, authntest.FakePasswordClient{})
if tt.noClients {
c.clients = nil
}
c := ProvideBasic(authntest.FakePasswordClient{})
assert.Equal(t, tt.expected, c.Test(context.Background(), tt.req))
})
}