public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: Improve /admin/authentication permission checks and include new SSO pages (#81183)

Browse Source 
* Move evalAuthSettings to ssoutils

* Improve permission check for auth page
This commit is contained in:
Misi
2024-01-25 11:13:24 +01:00
committed by GitHub
parent 7e5544ab21
commit 4577e61ee7
4 changed files with 38 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/navtree/navtreeimpl/admin.go
+3 -8
View File
@@ -2,6 +2,7 @@ package navtreeimpl
import (
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/ssoutils"
contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
"github.com/grafana/grafana/pkg/services/correlations"
"github.com/grafana/grafana/pkg/services/featuremgmt"
@@ -80,7 +81,8 @@ func (s *ServiceImpl) getAdminNode(c *contextmodel.ReqContext) (*navtree.NavLink
})
}
if (authConfigUIAvailable && hasAccess(evalAuthenticationSettings())) || s.features.IsEnabled(ctx, featuremgmt.FlagSsoSettingsApi) {
if authConfigUIAvailable && hasAccess(ssoutils.EvalAuthenticationSettings(s.cfg)) ||
(hasAccess(ssoutils.OauthSettingsEvaluator(s.cfg)) && s.features.IsEnabled(ctx, featuremgmt.FlagSsoSettingsApi)) {
configNodes = append(configNodes, &navtree.NavLink{
Text: "Authentication",
Id: "authentication",
@@ -150,10 +152,3 @@ func enableServiceAccount(s *ServiceImpl, c *contextmodel.ReqContext) bool {
hasAccess := ac.HasAccess(s.accessControl, c)
return hasAccess(serviceaccounts.AccessEvaluator)
}
func evalAuthenticationSettings() ac.Evaluator {
return ac.EvalAny(ac.EvalAll(
ac.EvalPermission(ac.ActionSettingsWrite, ac.ScopeSettingsSAML),
ac.EvalPermission(ac.ActionSettingsRead, ac.ScopeSettingsSAML),
), ac.EvalPermission(ac.ActionLDAPStatusRead))
}