IDForwarding: add "authenticatedBy" to id token (#80622)

* IDForwading: Set authenticated by for users

pkg/services/auth/idimpl/service_test.go

@@ -1,13 +1,22 @@
 package idimpl
 
 import (
+	"context"
+	"encoding/json"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
+	"github.com/grafana/grafana/pkg/infra/remotecache"
+	"github.com/grafana/grafana/pkg/services/auth"
+	"github.com/grafana/grafana/pkg/services/auth/idtest"
 	"github.com/grafana/grafana/pkg/services/authn"
 	"github.com/grafana/grafana/pkg/services/authn/authntest"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/login"
+	"github.com/grafana/grafana/pkg/services/login/authinfotest"
+	"github.com/grafana/grafana/pkg/services/user"
 	"github.com/grafana/grafana/pkg/setting"
 )
 
@@ -22,7 +31,7 @@ func Test_ProvideService(t *testing.T) {
 			},
 		}
 
-		_ = ProvideService(setting.NewCfg(), nil, nil, features, authnService, nil)
+		_ = ProvideService(setting.NewCfg(), nil, nil, features, authnService, nil, nil)
 		assert.True(t, hookRegistered)
 	})
 
@@ -36,7 +45,44 @@ func Test_ProvideService(t *testing.T) {
 			},
 		}
 
-		_ = ProvideService(setting.NewCfg(), nil, nil, features, authnService, nil)
+		_ = ProvideService(setting.NewCfg(), nil, nil, features, authnService, nil, nil)
 		assert.False(t, hookRegistered)
 	})
 }
+
+func TestService_SignIdentity(t *testing.T) {
+	signer := &idtest.MockSigner{
+		SignIDTokenFn: func(_ context.Context, claims *auth.IDClaims) (string, error) {
+			data, err := json.Marshal(claims)
+			if err != nil {
+				return "", err
+			}
+			return string(data), nil
+		},
+	}
+
+	t.Run("should sing identity", func(t *testing.T) {
+		s := ProvideService(
+			setting.NewCfg(), signer, remotecache.NewFakeCacheStorage(),
+			featuremgmt.WithFeatures(featuremgmt.FlagIdForwarding),
+			&authntest.FakeService{}, &authinfotest.FakeService{ExpectedError: user.ErrUserNotFound}, nil,
+		)
+		token, err := s.SignIdentity(context.Background(), &authn.Identity{ID: "user:1"})
+		require.NoError(t, err)
+		require.NotEmpty(t, token)
+	})
+
+	t.Run("should sing identity with authenticated by if user is externally authenticated", func(t *testing.T) {
+		s := ProvideService(
+			setting.NewCfg(), signer, remotecache.NewFakeCacheStorage(),
+			featuremgmt.WithFeatures(featuremgmt.FlagIdForwarding),
+			&authntest.FakeService{}, &authinfotest.FakeService{ExpectedUserAuth: &login.UserAuth{AuthModule: login.AzureADAuthModule}}, nil,
+		)
+		token, err := s.SignIdentity(context.Background(), &authn.Identity{ID: "user:1"})
+		require.NoError(t, err)
+
+		claims := &auth.IDClaims{}
+		require.NoError(t, json.Unmarshal([]byte(token), claims))
+		assert.Equal(t, login.AzureADAuthModule, claims.AuthenticatedBy)
+	})
+}