public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: Fix orgrole picker disabled if isSynced user (#64033)

Browse Source 
* fix: disable orgrolepicker if externaluser is synced

* add disable to role picker

* just took me 2 hours to center the icon

* wip

* fix: check externallySyncedUser for API call

* remove check from store

* add: tests

* refactor authproxy and made tests run

* add: feature toggle

* set feature toggle for tests

* add: IsProviderEnabled

* refactor: featuretoggle name

* IsProviderEnabled tests

* add specific tests for isProviderEnabled

* fix: org_user tests

* add: owner to featuretoggle

* add missing authlabels

* remove fmt

* feature toggle

* change config

* add test for a different authmodule

* test refactor

* gen feature toggle again

* fix basic auth user able to change the org role

* test for basic auth role

* make err.base to error

* lowered lvl of log and input mesg
This commit is contained in:
Eric Leijonmarck
2023-03-22 17:41:59 +00:00
committed by GitHub
parent 13af5afaf3
commit 3cd952b8ba
38 changed files with 405 additions and 161 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/ldap/api/service.go
+5 -5
View File
@@ -65,7 +65,7 @@ func ProvideService(cfg *setting.Cfg, router routing.RouteRegister, accessContro
adminRoute.Get("/ldap/status", authorize(reqGrafanaAdmin, ac.EvalPermission(ac.ActionLDAPStatusRead)), routing.Wrap(s.GetLDAPStatus))
}, middleware.ReqSignedIn)
if cfg.LDAPEnabled {
if cfg.LDAPAuthEnabled {
bundleRegistry.RegisterSupportItemCollector(supportbundles.Collector{
UID: "auth-ldap",
DisplayName: "LDAP",
@@ -94,7 +94,7 @@ func ProvideService(cfg *setting.Cfg, router routing.RouteRegister, accessContro
// 403: forbiddenError
// 500: internalServerError
func (s *Service) ReloadLDAPCfg(c *contextmodel.ReqContext) response.Response {
if !s.cfg.LDAPEnabled {
if !s.cfg.LDAPAuthEnabled {
return response.Error(http.StatusBadRequest, "LDAP is not enabled", nil)
}
@@ -120,7 +120,7 @@ func (s *Service) ReloadLDAPCfg(c *contextmodel.ReqContext) response.Response {
// 403: forbiddenError
// 500: internalServerError
func (s *Service) GetLDAPStatus(c *contextmodel.ReqContext) response.Response {
if !s.cfg.LDAPEnabled {
if !s.cfg.LDAPAuthEnabled {
return response.Error(http.StatusBadRequest, "LDAP is not enabled", nil)
}
@@ -167,7 +167,7 @@ func (s *Service) GetLDAPStatus(c *contextmodel.ReqContext) response.Response {
// 403: forbiddenError
// 500: internalServerError
func (s *Service) PostSyncUserWithLDAP(c *contextmodel.ReqContext) response.Response {
if !s.cfg.LDAPEnabled {
if !s.cfg.LDAPAuthEnabled {
return response.Error(http.StatusBadRequest, "LDAP is not enabled", nil)
}
@@ -262,7 +262,7 @@ func (s *Service) PostSyncUserWithLDAP(c *contextmodel.ReqContext) response.Resp
// 403: forbiddenError
// 500: internalServerError
func (s *Service) GetUserFromLDAP(c *contextmodel.ReqContext) response.Response {
if !s.cfg.LDAPEnabled {
if !s.cfg.LDAPAuthEnabled {
return response.Error(http.StatusBadRequest, "LDAP is not enabled", nil)
}
pkg/services/ldap/api/service_test.go
+1 -1
View File
@@ -60,7 +60,7 @@ func setupAPITest(t *testing.T, opts ...func(a *Service)) (*Service, *webtest.Se
t.Helper()
router := routing.NewRouteRegister()
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
a := ProvideService(cfg,
router,
pkg/services/ldap/api/support_bundle.go
+1 -1
View File
@@ -72,7 +72,7 @@ func (s *Service) supportBundleCollector(context.Context) (*supportbundles.Suppo
bWriter.WriteString("```ini\n")
bWriter.WriteString(fmt.Sprintf("enabled = %v\n", s.cfg.LDAPEnabled))
bWriter.WriteString(fmt.Sprintf("enabled = %v\n", s.cfg.LDAPAuthEnabled))
bWriter.WriteString(fmt.Sprintf("config_file = %s\n", s.cfg.LDAPConfigFilePath))
bWriter.WriteString(fmt.Sprintf("allow_sign_up = %v\n", s.cfg.LDAPAllowSignup))
bWriter.WriteString(fmt.Sprintf("sync_cron = %s\n", s.cfg.LDAPSyncCron))
pkg/services/ldap/ldap_login_test.go
+5 -5
View File
@@ -32,7 +32,7 @@ func TestServer_Login_UserBind_Fail(t *testing.T) {
}
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
Config: &ServerConfig{
@@ -106,7 +106,7 @@ func TestServer_Login_ValidCredentials(t *testing.T) {
}
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
@@ -143,7 +143,7 @@ func TestServer_Login_UnauthenticatedBind(t *testing.T) {
}
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
@@ -190,7 +190,7 @@ func TestServer_Login_AuthenticatedBind(t *testing.T) {
}
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
@@ -233,7 +233,7 @@ func TestServer_Login_UserWildcardBind(t *testing.T) {
}
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
pkg/services/ldap/ldap_private_test.go
+6 -6
View File
@@ -54,7 +54,7 @@ func TestServer_getSearchRequest(t *testing.T) {
func TestSerializeUsers(t *testing.T) {
t.Run("simple case", func(t *testing.T) {
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
@@ -93,7 +93,7 @@ func TestSerializeUsers(t *testing.T) {
t.Run("without lastname", func(t *testing.T) {
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
@@ -130,7 +130,7 @@ func TestSerializeUsers(t *testing.T) {
t.Run("mark user without matching group as disabled", func(t *testing.T) {
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
@@ -164,7 +164,7 @@ func TestSerializeUsers(t *testing.T) {
func TestServer_validateGrafanaUser(t *testing.T) {
t.Run("no group config", func(t *testing.T) {
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
@@ -184,7 +184,7 @@ func TestServer_validateGrafanaUser(t *testing.T) {
t.Run("user in group", func(t *testing.T) {
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
@@ -211,7 +211,7 @@ func TestServer_validateGrafanaUser(t *testing.T) {
t.Run("user not in group", func(t *testing.T) {
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
pkg/services/ldap/ldap_test.go
+3 -3
View File
@@ -68,7 +68,7 @@ func TestServer_Users(t *testing.T) {
// Set up attribute map without surname and email
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
@@ -212,7 +212,7 @@ func TestServer_Users(t *testing.T) {
})
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
@@ -289,7 +289,7 @@ func TestServer_Users(t *testing.T) {
})
cfg := setting.NewCfg()
cfg.LDAPEnabled = true
cfg.LDAPAuthEnabled = true
server := &Server{
cfg: cfg,
pkg/services/ldap/service/ldap.go
+4 -4
View File
@@ -47,7 +47,7 @@ func ProvideService(cfg *setting.Cfg) *LDAPImpl {
loadingMutex: &sync.Mutex{},
}
if !cfg.LDAPEnabled {
if !cfg.LDAPAuthEnabled {
return s
}
@@ -63,7 +63,7 @@ func ProvideService(cfg *setting.Cfg) *LDAPImpl {
}
func (s *LDAPImpl) ReloadConfig() error {
if !s.cfg.LDAPEnabled {
if !s.cfg.LDAPAuthEnabled {
return nil
}
@@ -95,7 +95,7 @@ func (s *LDAPImpl) Config() *ldap.Config {
}
func (s *LDAPImpl) Login(query *login.LoginUserQuery) (*login.ExternalUserInfo, error) {
if !s.cfg.LDAPEnabled {
if !s.cfg.LDAPAuthEnabled {
return nil, ErrLDAPNotEnabled
}
@@ -108,7 +108,7 @@ func (s *LDAPImpl) Login(query *login.LoginUserQuery) (*login.ExternalUserInfo,
}
func (s *LDAPImpl) User(username string) (*login.ExternalUserInfo, error) {
if !s.cfg.LDAPEnabled {
if !s.cfg.LDAPAuthEnabled {
return nil, ErrLDAPNotEnabled
}
pkg/services/ldap/settings.go
+2 -2
View File
@@ -87,10 +87,10 @@ var config *Config
// the config or it reads it and caches it first.
func GetConfig(cfg *setting.Cfg) (*Config, error) {
if cfg != nil {
if !cfg.LDAPEnabled {
if !cfg.LDAPAuthEnabled {
return nil, nil
}
} else if !cfg.LDAPEnabled {
} else if !cfg.LDAPAuthEnabled {
return nil, nil
}