Users: Disable users removed from LDAP (#16820)

* Users: add is_disabled column

* Users: disable users removed from LDAP

* Auth: return ErrInvalidCredentials for failed LDAP auth

* User: return isDisabled flag in user search api

* User: mark disabled users at the server admin page

* Chore: refactor according to review

* Auth: prevent disabled user from login

* Auth: re-enable user when it found in ldap

* User: add api endpoint for disabling user

* User: use separate endpoints to disable/enable user

* User: disallow disabling external users

* User: able do disable users from admin UI

* Chore: refactor based on review

* Chore: use more clear error check when disabling user

* Fix login tests

* Tests for disabling user during the LDAP login

* Tests for disable user API

* Tests for login with disabled user

* Remove disable user UI stub

* Sync with latest LDAP refactoring

pkg/services/ldap/ldap.go

@@ -10,6 +10,7 @@ import (
 
 	"gopkg.in/ldap.v3"
 
+	"github.com/grafana/grafana/pkg/bus"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/models"
 )
@@ -48,6 +49,7 @@ var (
 
 	// ErrInvalidCredentials is returned if username and password do not match
 	ErrInvalidCredentials = errors.New("Invalid Username or Password")
+	ErrLDAPUserNotFound   = errors.New("LDAP user not found")
 )
 
 var dial = func(network, addr string) (IConnection, error) {
@@ -142,6 +144,7 @@ func (server *Server) Login(query *models.LoginUserQuery) (
 	// If we couldn't find the user -
 	// we should show incorrect credentials err
 	if len(users) == 0 {
+		server.disableExternalUser(query.Username)
 		return nil, ErrInvalidCredentials
 	}
 
@@ -263,6 +266,34 @@ func (server *Server) validateGrafanaUser(user *models.ExternalUserInfo) error {
 	return nil
 }
 
+// disableExternalUser marks external user as disabled in Grafana db
+func (server *Server) disableExternalUser(username string) error {
+	// Check if external user exist in Grafana
+	userQuery := &models.GetExternalUserInfoByLoginQuery{
+		LoginOrEmail: username,
+	}
+
+	if err := bus.Dispatch(userQuery); err != nil {
+		return err
+	}
+
+	userInfo := userQuery.Result
+	if !userInfo.IsDisabled {
+		server.log.Debug("Disabling external user", "user", userQuery.Result.Login)
+		// Mark user as disabled in grafana db
+		disableUserCmd := &models.DisableUserCommand{
+			UserId:     userQuery.Result.UserId,
+			IsDisabled: true,
+		}
+
+		if err := bus.Dispatch(disableUserCmd); err != nil {
+			server.log.Debug("Error disabling external user", "user", userQuery.Result.Login, "message", err.Error())
+			return err
+		}
+	}
+	return nil
+}
+
 // getSearchRequest returns LDAP search request for users
 func (server *Server) getSearchRequest(
 	base string,
@@ -305,7 +336,7 @@ func (server *Server) getSearchRequest(
 // buildGrafanaUser extracts info from UserInfo model to ExternalUserInfo
 func (server *Server) buildGrafanaUser(user *UserInfo) *models.ExternalUserInfo {
 	extUser := &models.ExternalUserInfo{
-		AuthModule: "ldap",
+		AuthModule: models.AuthModuleLDAP,
 		AuthId:     user.DN,
 		Name: strings.TrimSpace(
 			fmt.Sprintf("%s %s", user.FirstName, user.LastName),

pkg/services/ldap/ldap_login_test.go

@@ -148,5 +148,102 @@ func TestLDAPLogin(t *testing.T) {
 			So(err, ShouldBeNil)
 			So(resp.Login, ShouldEqual, "markelog")
 		})
+
+		authScenario("When user not found in LDAP, but exist in Grafana", func(scenario *scenarioContext) {
+			connection := &mockConnection{}
+			result := ldap.SearchResult{Entries: []*ldap.Entry{}}
+			connection.setSearchResult(&result)
+
+			externalUser := &models.ExternalUserInfo{UserId: 42, IsDisabled: false}
+			scenario.getExternalUserInfoByLoginQueryReturns(externalUser)
+
+			connection.bindProvider = func(username, password string) error {
+				return nil
+			}
+			auth := &Server{
+				config: &ServerConfig{
+					SearchBaseDNs: []string{"BaseDNHere"},
+				},
+				connection: connection,
+				log:        log.New("test-logger"),
+			}
+
+			_, err := auth.Login(scenario.loginUserQuery)
+
+			Convey("it should disable user", func() {
+				So(scenario.disableExternalUserCalled, ShouldBeTrue)
+				So(scenario.disableUserCmd.IsDisabled, ShouldBeTrue)
+				So(scenario.disableUserCmd.UserId, ShouldEqual, 42)
+			})
+
+			Convey("it should return invalid credentials error", func() {
+				So(err, ShouldEqual, ErrInvalidCredentials)
+			})
+		})
+
+		authScenario("When user not found in LDAP, and disabled in Grafana already", func(scenario *scenarioContext) {
+			connection := &mockConnection{}
+			result := ldap.SearchResult{Entries: []*ldap.Entry{}}
+			connection.setSearchResult(&result)
+
+			externalUser := &models.ExternalUserInfo{UserId: 42, IsDisabled: true}
+			scenario.getExternalUserInfoByLoginQueryReturns(externalUser)
+
+			connection.bindProvider = func(username, password string) error {
+				return nil
+			}
+			auth := &Server{
+				config: &ServerConfig{
+					SearchBaseDNs: []string{"BaseDNHere"},
+				},
+				connection: connection,
+				log:        log.New("test-logger"),
+			}
+
+			_, err := auth.Login(scenario.loginUserQuery)
+
+			Convey("it should't call disable function", func() {
+				So(scenario.disableExternalUserCalled, ShouldBeFalse)
+			})
+
+			Convey("it should return invalid credentials error", func() {
+				So(err, ShouldEqual, ErrInvalidCredentials)
+			})
+		})
+
+		authScenario("When user found in LDAP, and disabled in Grafana", func(scenario *scenarioContext) {
+			connection := &mockConnection{}
+			entry := ldap.Entry{}
+			result := ldap.SearchResult{Entries: []*ldap.Entry{&entry}}
+			connection.setSearchResult(&result)
+			scenario.userQueryReturns(&models.User{Id: 42, IsDisabled: true})
+
+			connection.bindProvider = func(username, password string) error {
+				return nil
+			}
+			auth := &Server{
+				config: &ServerConfig{
+					SearchBaseDNs: []string{"BaseDNHere"},
+				},
+				connection: connection,
+				log:        log.New("test-logger"),
+			}
+
+			extUser, _ := auth.Login(scenario.loginUserQuery)
+			_, err := user.Upsert(&user.UpsertArgs{
+				SignupAllowed: true,
+				ExternalUser:  extUser,
+			})
+
+			Convey("it should re-enable user", func() {
+				So(scenario.disableExternalUserCalled, ShouldBeTrue)
+				So(scenario.disableUserCmd.IsDisabled, ShouldBeFalse)
+				So(scenario.disableUserCmd.UserId, ShouldEqual, 42)
+			})
+
+			Convey("it should not return error", func() {
+				So(err, ShouldBeNil)
+			})
+		})
 	})
 }

pkg/services/ldap/test.go

@@ -115,6 +115,18 @@ func authScenario(desc string, fn scenarioFunc) {
 			return nil
 		})
 
+		bus.AddHandler("test", func(cmd *models.GetExternalUserInfoByLoginQuery) error {
+			sc.getExternalUserInfoByLoginQuery = cmd
+			sc.getExternalUserInfoByLoginQuery.Result = &models.ExternalUserInfo{UserId: 42, IsDisabled: false}
+			return nil
+		})
+
+		bus.AddHandler("test", func(cmd *models.DisableUserCommand) error {
+			sc.disableExternalUserCalled = true
+			sc.disableUserCmd = cmd
+			return nil
+		})
+
 		bus.AddHandler("test", func(cmd *models.AddOrgUserCommand) error {
 			sc.addOrgUserCmd = cmd
 			return nil
@@ -145,16 +157,19 @@ func authScenario(desc string, fn scenarioFunc) {
 }
 
 type scenarioContext struct {
-	loginUserQuery           *models.LoginUserQuery
-	getUserByAuthInfoQuery   *models.GetUserByAuthInfoQuery
-	getUserOrgListQuery      *models.GetUserOrgListQuery
-	createUserCmd            *models.CreateUserCommand
-	addOrgUserCmd            *models.AddOrgUserCommand
-	updateOrgUserCmd         *models.UpdateOrgUserCommand
-	removeOrgUserCmd         *models.RemoveOrgUserCommand
-	updateUserCmd            *models.UpdateUserCommand
-	setUsingOrgCmd           *models.SetUsingOrgCommand
-	updateUserPermissionsCmd *models.UpdateUserPermissionsCommand
+	loginUserQuery                  *models.LoginUserQuery
+	getUserByAuthInfoQuery          *models.GetUserByAuthInfoQuery
+	getExternalUserInfoByLoginQuery *models.GetExternalUserInfoByLoginQuery
+	getUserOrgListQuery             *models.GetUserOrgListQuery
+	createUserCmd                   *models.CreateUserCommand
+	disableUserCmd                  *models.DisableUserCommand
+	addOrgUserCmd                   *models.AddOrgUserCommand
+	updateOrgUserCmd                *models.UpdateOrgUserCommand
+	removeOrgUserCmd                *models.RemoveOrgUserCommand
+	updateUserCmd                   *models.UpdateUserCommand
+	setUsingOrgCmd                  *models.SetUsingOrgCommand
+	updateUserPermissionsCmd        *models.UpdateUserPermissionsCommand
+	disableExternalUserCalled       bool
 }
 
 func (sc *scenarioContext) userQueryReturns(user *models.User) {
@@ -177,4 +192,15 @@ func (sc *scenarioContext) userOrgsQueryReturns(orgs []*models.UserOrgDTO) {
 	})
 }
 
+func (sc *scenarioContext) getExternalUserInfoByLoginQueryReturns(externalUser *models.ExternalUserInfo) {
+	bus.AddHandler("test", func(cmd *models.GetExternalUserInfoByLoginQuery) error {
+		sc.getExternalUserInfoByLoginQuery = cmd
+		sc.getExternalUserInfoByLoginQuery.Result = &models.ExternalUserInfo{
+			UserId:     externalUser.UserId,
+			IsDisabled: externalUser.IsDisabled,
+		}
+		return nil
+	})
+}
+
 type scenarioFunc func(c *scenarioContext)

pkg/services/login/login.go

@@ -3,7 +3,7 @@ package login
 import (
 	"github.com/grafana/grafana/pkg/bus"
 	"github.com/grafana/grafana/pkg/infra/log"
-	m "github.com/grafana/grafana/pkg/models"
+	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/registry"
 	"github.com/grafana/grafana/pkg/services/quota"
 )
@@ -27,10 +27,10 @@ func (ls *LoginService) Init() error {
 	return nil
 }
 
-func (ls *LoginService) UpsertUser(cmd *m.UpsertUserCommand) error {
+func (ls *LoginService) UpsertUser(cmd *models.UpsertUserCommand) error {
 	extUser := cmd.ExternalUser
 
-	userQuery := &m.GetUserByAuthInfoQuery{
+	userQuery := &models.GetUserByAuthInfoQuery{
 		AuthModule: extUser.AuthModule,
 		AuthId:     extUser.AuthId,
 		UserId:     extUser.UserId,
@@ -39,7 +39,7 @@ func (ls *LoginService) UpsertUser(cmd *m.UpsertUserCommand) error {
 	}
 
 	err := bus.Dispatch(userQuery)
-	if err != m.ErrUserNotFound && err != nil {
+	if err != models.ErrUserNotFound && err != nil {
 		return err
 	}
 
@@ -64,7 +64,7 @@ func (ls *LoginService) UpsertUser(cmd *m.UpsertUserCommand) error {
 		}
 
 		if extUser.AuthModule != "" {
-			cmd2 := &m.SetAuthInfoCommand{
+			cmd2 := &models.SetAuthInfoCommand{
 				UserId:     cmd.Result.Id,
 				AuthModule: extUser.AuthModule,
 				AuthId:     extUser.AuthId,
@@ -90,6 +90,13 @@ func (ls *LoginService) UpsertUser(cmd *m.UpsertUserCommand) error {
 				return err
 			}
 		}
+
+		if extUser.AuthModule == models.AuthModuleLDAP && userQuery.Result.IsDisabled {
+			// Re-enable user when it found in LDAP
+			if err := ls.Bus.Dispatch(&models.DisableUserCommand{UserId: cmd.Result.Id, IsDisabled: false}); err != nil {
+				return err
+			}
+		}
 	}
 
 	err = syncOrgRoles(cmd.Result, extUser)
@@ -100,12 +107,12 @@ func (ls *LoginService) UpsertUser(cmd *m.UpsertUserCommand) error {
 
 	// Sync isGrafanaAdmin permission
 	if extUser.IsGrafanaAdmin != nil && *extUser.IsGrafanaAdmin != cmd.Result.IsAdmin {
-		if err := ls.Bus.Dispatch(&m.UpdateUserPermissionsCommand{UserId: cmd.Result.Id, IsGrafanaAdmin: *extUser.IsGrafanaAdmin}); err != nil {
+		if err := ls.Bus.Dispatch(&models.UpdateUserPermissionsCommand{UserId: cmd.Result.Id, IsGrafanaAdmin: *extUser.IsGrafanaAdmin}); err != nil {
 			return err
 		}
 	}
 
-	err = ls.Bus.Dispatch(&m.SyncTeamsCommand{
+	err = ls.Bus.Dispatch(&models.SyncTeamsCommand{
 		User:         cmd.Result,
 		ExternalUser: extUser,
 	})
@@ -117,8 +124,8 @@ func (ls *LoginService) UpsertUser(cmd *m.UpsertUserCommand) error {
 	return err
 }
 
-func createUser(extUser *m.ExternalUserInfo) (*m.User, error) {
-	cmd := &m.CreateUserCommand{
+func createUser(extUser *models.ExternalUserInfo) (*models.User, error) {
+	cmd := &models.CreateUserCommand{
 		Login:        extUser.Login,
 		Email:        extUser.Email,
 		Name:         extUser.Name,
@@ -132,9 +139,9 @@ func createUser(extUser *m.ExternalUserInfo) (*m.User, error) {
 	return &cmd.Result, nil
 }
 
-func updateUser(user *m.User, extUser *m.ExternalUserInfo) error {
+func updateUser(user *models.User, extUser *models.ExternalUserInfo) error {
 	// sync user info
-	updateCmd := &m.UpdateUserCommand{
+	updateCmd := &models.UpdateUserCommand{
 		UserId: user.Id,
 	}
 
@@ -165,8 +172,8 @@ func updateUser(user *m.User, extUser *m.ExternalUserInfo) error {
 	return bus.Dispatch(updateCmd)
 }
 
-func updateUserAuth(user *m.User, extUser *m.ExternalUserInfo) error {
-	updateCmd := &m.UpdateAuthInfoCommand{
+func updateUserAuth(user *models.User, extUser *models.ExternalUserInfo) error {
+	updateCmd := &models.UpdateAuthInfoCommand{
 		AuthModule: extUser.AuthModule,
 		AuthId:     extUser.AuthId,
 		UserId:     user.Id,
@@ -177,13 +184,13 @@ func updateUserAuth(user *m.User, extUser *m.ExternalUserInfo) error {
 	return bus.Dispatch(updateCmd)
 }
 
-func syncOrgRoles(user *m.User, extUser *m.ExternalUserInfo) error {
+func syncOrgRoles(user *models.User, extUser *models.ExternalUserInfo) error {
 	// don't sync org roles if none are specified
 	if len(extUser.OrgRoles) == 0 {
 		return nil
 	}
 
-	orgsQuery := &m.GetUserOrgListQuery{UserId: user.Id}
+	orgsQuery := &models.GetUserOrgListQuery{UserId: user.Id}
 	if err := bus.Dispatch(orgsQuery); err != nil {
 		return err
 	}
@@ -199,7 +206,7 @@ func syncOrgRoles(user *m.User, extUser *m.ExternalUserInfo) error {
 			deleteOrgIds = append(deleteOrgIds, org.OrgId)
 		} else if extUser.OrgRoles[org.OrgId] != org.Role {
 			// update role
-			cmd := &m.UpdateOrgUserCommand{OrgId: org.OrgId, UserId: user.Id, Role: extUser.OrgRoles[org.OrgId]}
+			cmd := &models.UpdateOrgUserCommand{OrgId: org.OrgId, UserId: user.Id, Role: extUser.OrgRoles[org.OrgId]}
 			if err := bus.Dispatch(cmd); err != nil {
 				return err
 			}
@@ -213,16 +220,16 @@ func syncOrgRoles(user *m.User, extUser *m.ExternalUserInfo) error {
 		}
 
 		// add role
-		cmd := &m.AddOrgUserCommand{UserId: user.Id, Role: orgRole, OrgId: orgId}
+		cmd := &models.AddOrgUserCommand{UserId: user.Id, Role: orgRole, OrgId: orgId}
 		err := bus.Dispatch(cmd)
-		if err != nil && err != m.ErrOrgNotFound {
+		if err != nil && err != models.ErrOrgNotFound {
 			return err
 		}
 	}
 
 	// delete any removed org roles
 	for _, orgId := range deleteOrgIds {
-		cmd := &m.RemoveOrgUserCommand{OrgId: orgId, UserId: user.Id}
+		cmd := &models.RemoveOrgUserCommand{OrgId: orgId, UserId: user.Id}
 		if err := bus.Dispatch(cmd); err != nil {
 			return err
 		}
@@ -235,7 +242,7 @@ func syncOrgRoles(user *m.User, extUser *m.ExternalUserInfo) error {
 			break
 		}
 
-		return bus.Dispatch(&m.SetUsingOrgCommand{
+		return bus.Dispatch(&models.SetUsingOrgCommand{
 			UserId: user.Id,
 			OrgId:  user.OrgId,
 		})

pkg/services/sqlstore/migrations/user_mig.go

@@ -116,6 +116,12 @@ func addUserMigrations(mg *Migrator) {
 
 	// Adds salt & rands for old users who used ldap or oauth
 	mg.AddMigration("Add missing user data", &AddMissingUserSaltAndRandsMigration{})
+
+	// is_disabled indicates whether user disabled or not. Disabled user should not be able to log in.
+	// This field used in couple with LDAP auth to disable users removed from LDAP rather than delete it immediately.
+	mg.AddMigration("Add is_disabled column to user", NewAddColumnMigration(userV2, &Column{
+		Name: "is_disabled", Type: DB_Bool, Nullable: false, Default: "0",
+	}))
 }
 
 type AddMissingUserSaltAndRandsMigration struct {

pkg/services/sqlstore/user.go

@@ -27,6 +27,7 @@ func (ss *SqlStore) addUserQueryAndCommandHandlers() {
 	bus.AddHandler("sql", GetUserProfile)
 	bus.AddHandler("sql", SearchUsers)
 	bus.AddHandler("sql", GetUserOrgList)
+	bus.AddHandler("sql", DisableUser)
 	bus.AddHandler("sql", DeleteUser)
 	bus.AddHandler("sql", UpdateUserPermissions)
 	bus.AddHandler("sql", SetUserHelpFlag)
@@ -326,6 +327,7 @@ func GetUserProfile(query *m.GetUserProfileQuery) error {
 		Login:          user.Login,
 		Theme:          user.Theme,
 		IsGrafanaAdmin: user.IsAdmin,
+		IsDisabled:     user.IsDisabled,
 		OrgId:          user.OrgId,
 	}
 
@@ -450,7 +452,7 @@ func SearchUsers(query *m.SearchUsersQuery) error {
 
 	offset := query.Limit * (query.Page - 1)
 	sess.Limit(query.Limit, offset)
-	sess.Cols("id", "email", "name", "login", "is_admin", "last_seen_at")
+	sess.Cols("id", "email", "name", "login", "is_admin", "is_disabled", "last_seen_at")
 	if err := sess.Find(&query.Result.Users); err != nil {
 		return err
 	}
@@ -473,6 +475,18 @@ func SearchUsers(query *m.SearchUsersQuery) error {
 	return err
 }
 
+func DisableUser(cmd *m.DisableUserCommand) error {
+	user := m.User{}
+	sess := x.Table("user")
+	sess.ID(cmd.UserId).Get(&user)
+
+	user.IsDisabled = cmd.IsDisabled
+	sess.UseBool("is_disabled")
+
+	_, err := sess.ID(cmd.UserId).Update(&user)
+	return err
+}
+
 func DeleteUser(cmd *m.DeleteUserCommand) error {
 	return inTransaction(func(sess *DBSession) error {
 		return deleteUserInTransaction(sess, cmd)

pkg/services/sqlstore/user_auth.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	"github.com/grafana/grafana/pkg/bus"
-	m "github.com/grafana/grafana/pkg/models"
+	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/util"
 )
@@ -14,17 +14,18 @@ var getTime = time.Now
 
 func init() {
 	bus.AddHandler("sql", GetUserByAuthInfo)
+	bus.AddHandler("sql", GetExternalUserInfoByLogin)
 	bus.AddHandler("sql", GetAuthInfo)
 	bus.AddHandler("sql", SetAuthInfo)
 	bus.AddHandler("sql", UpdateAuthInfo)
 	bus.AddHandler("sql", DeleteAuthInfo)
 }
 
-func GetUserByAuthInfo(query *m.GetUserByAuthInfoQuery) error {
-	user := &m.User{}
+func GetUserByAuthInfo(query *models.GetUserByAuthInfoQuery) error {
+	user := &models.User{}
 	has := false
 	var err error
-	authQuery := &m.GetAuthInfoQuery{}
+	authQuery := &models.GetAuthInfoQuery{}
 
 	// Try to find the user by auth module and id first
 	if query.AuthModule != "" && query.AuthId != "" {
@@ -32,14 +33,14 @@ func GetUserByAuthInfo(query *m.GetUserByAuthInfoQuery) error {
 		authQuery.AuthId = query.AuthId
 
 		err = GetAuthInfo(authQuery)
-		if err != m.ErrUserNotFound {
+		if err != models.ErrUserNotFound {
 			if err != nil {
 				return err
 			}
 
 			// if user id was specified and doesn't match the user_auth entry, remove it
 			if query.UserId != 0 && query.UserId != authQuery.Result.UserId {
-				err = DeleteAuthInfo(&m.DeleteAuthInfoCommand{
+				err = DeleteAuthInfo(&models.DeleteAuthInfoCommand{
 					UserAuth: authQuery.Result,
 				})
 				if err != nil {
@@ -55,7 +56,7 @@ func GetUserByAuthInfo(query *m.GetUserByAuthInfoQuery) error {
 
 				if !has {
 					// if the user has been deleted then remove the entry
-					err = DeleteAuthInfo(&m.DeleteAuthInfoCommand{
+					err = DeleteAuthInfo(&models.DeleteAuthInfoCommand{
 						UserAuth: authQuery.Result,
 					})
 					if err != nil {
@@ -78,7 +79,7 @@ func GetUserByAuthInfo(query *m.GetUserByAuthInfoQuery) error {
 
 	// If not found, try to find the user by email address
 	if !has && query.Email != "" {
-		user = &m.User{Email: query.Email}
+		user = &models.User{Email: query.Email}
 		has, err = x.Get(user)
 		if err != nil {
 			return err
@@ -87,7 +88,7 @@ func GetUserByAuthInfo(query *m.GetUserByAuthInfoQuery) error {
 
 	// If not found, try to find the user by login
 	if !has && query.Login != "" {
-		user = &m.User{Login: query.Login}
+		user = &models.User{Login: query.Login}
 		has, err = x.Get(user)
 		if err != nil {
 			return err
@@ -96,12 +97,12 @@ func GetUserByAuthInfo(query *m.GetUserByAuthInfoQuery) error {
 
 	// No user found
 	if !has {
-		return m.ErrUserNotFound
+		return models.ErrUserNotFound
 	}
 
 	// create authInfo record to link accounts
 	if authQuery.Result == nil && query.AuthModule != "" {
-		cmd2 := &m.SetAuthInfoCommand{
+		cmd2 := &models.SetAuthInfoCommand{
 			UserId:     user.Id,
 			AuthModule: query.AuthModule,
 			AuthId:     query.AuthId,
@@ -115,8 +116,32 @@ func GetUserByAuthInfo(query *m.GetUserByAuthInfoQuery) error {
 	return nil
 }
 
-func GetAuthInfo(query *m.GetAuthInfoQuery) error {
-	userAuth := &m.UserAuth{
+func GetExternalUserInfoByLogin(query *models.GetExternalUserInfoByLoginQuery) error {
+	userQuery := models.GetUserByLoginQuery{LoginOrEmail: query.LoginOrEmail}
+	err := bus.Dispatch(&userQuery)
+	if err != nil {
+		return err
+	}
+
+	authInfoQuery := &models.GetAuthInfoQuery{UserId: userQuery.Result.Id}
+	if err := bus.Dispatch(authInfoQuery); err != nil {
+		return err
+	}
+
+	query.Result = &models.ExternalUserInfo{
+		UserId:     userQuery.Result.Id,
+		Login:      userQuery.Result.Login,
+		Email:      userQuery.Result.Email,
+		Name:       userQuery.Result.Name,
+		IsDisabled: userQuery.Result.IsDisabled,
+		AuthModule: authInfoQuery.Result.AuthModule,
+		AuthId:     authInfoQuery.Result.AuthId,
+	}
+	return nil
+}
+
+func GetAuthInfo(query *models.GetAuthInfoQuery) error {
+	userAuth := &models.UserAuth{
 		UserId:     query.UserId,
 		AuthModule: query.AuthModule,
 		AuthId:     query.AuthId,
@@ -126,7 +151,7 @@ func GetAuthInfo(query *m.GetAuthInfoQuery) error {
 		return err
 	}
 	if !has {
-		return m.ErrUserNotFound
+		return models.ErrUserNotFound
 	}
 
 	secretAccessToken, err := decodeAndDecrypt(userAuth.OAuthAccessToken)
@@ -149,9 +174,9 @@ func GetAuthInfo(query *m.GetAuthInfoQuery) error {
 	return nil
 }
 
-func SetAuthInfo(cmd *m.SetAuthInfoCommand) error {
+func SetAuthInfo(cmd *models.SetAuthInfoCommand) error {
 	return inTransaction(func(sess *DBSession) error {
-		authUser := &m.UserAuth{
+		authUser := &models.UserAuth{
 			UserId:     cmd.UserId,
 			AuthModule: cmd.AuthModule,
 			AuthId:     cmd.AuthId,
@@ -183,9 +208,9 @@ func SetAuthInfo(cmd *m.SetAuthInfoCommand) error {
 	})
 }
 
-func UpdateAuthInfo(cmd *m.UpdateAuthInfoCommand) error {
+func UpdateAuthInfo(cmd *models.UpdateAuthInfoCommand) error {
 	return inTransaction(func(sess *DBSession) error {
-		authUser := &m.UserAuth{
+		authUser := &models.UserAuth{
 			UserId:     cmd.UserId,
 			AuthModule: cmd.AuthModule,
 			AuthId:     cmd.AuthId,
@@ -212,7 +237,7 @@ func UpdateAuthInfo(cmd *m.UpdateAuthInfoCommand) error {
 			authUser.OAuthExpiry = cmd.OAuthToken.Expiry
 		}
 
-		cond := &m.UserAuth{
+		cond := &models.UserAuth{
 			UserId:     cmd.UserId,
 			AuthModule: cmd.AuthModule,
 		}
@@ -222,7 +247,7 @@ func UpdateAuthInfo(cmd *m.UpdateAuthInfoCommand) error {
 	})
 }
 
-func DeleteAuthInfo(cmd *m.DeleteAuthInfoCommand) error {
+func DeleteAuthInfo(cmd *models.DeleteAuthInfoCommand) error {
 	return inTransaction(func(sess *DBSession) error {
 		_, err := sess.Delete(cmd.UserAuth)
 		return err