public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: disable passwordless auth if any SAML/OAuth is enabled (#98227)

Browse Source 
* Auth: disable passwordless auth if any SAML/OAuth is enabled

* Update pkg/services/authn/authnimpl/registration.go

Co-authored-by: Victor Cinaglia <victor@grafana.com>

* simplify check if any auth providers are enabled

* add accidentally removed break statement, use IsEnabled with empty context to check if PasswordlessMagicLinkAuth enabled

* use IsClientEnabled

* Update pkg/api/frontendsettings.go

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

---------

Co-authored-by: Victor Cinaglia <victor@grafana.com>
Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
This commit is contained in:
colin-stuart
2025-01-09 11:44:16 -05:00
committed by GitHub
co-authored by Victor Cinaglia Misi
parent 9e9adbf5b5
commit 4581a82ac4
3 changed files with 40 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/frontendsettings.go
+19 -1
View File
@@ -15,6 +15,7 @@ import (
"github.com/grafana/grafana/pkg/login/social"
"github.com/grafana/grafana/pkg/plugins"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/authn"
contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
"github.com/grafana/grafana/pkg/services/datasources"
"github.com/grafana/grafana/pkg/services/featuremgmt"
@@ -360,7 +361,24 @@ func (hs *HTTPServer) getFrontendSettings(c *contextmodel.ReqContext) (*dtos.Fro
OktaSkipOrgRoleSync: parseSkipOrgRoleSyncEnabled(oauthProviders[social.OktaProviderName]),
DisableLogin: hs.Cfg.DisableLogin,
BasicAuthStrongPasswordPolicy: hs.Cfg.BasicAuthStrongPasswordPolicy,
PasswordlessEnabled: hs.Cfg.PasswordlessMagicLinkAuth.Enabled && hs.Features.IsEnabled(c.Req.Context(), featuremgmt.FlagPasswordlessMagicLinkAuthentication),
}
if hs.Cfg.PasswordlessMagicLinkAuth.Enabled && hs.Features.IsEnabled(c.Req.Context(), featuremgmt.FlagPasswordlessMagicLinkAuthentication) {
hasEnabledProviders := hs.samlEnabled() || hs.authnService.IsClientEnabled(authn.ClientLDAP)
if !hasEnabledProviders {
oauthInfos := hs.SocialService.GetOAuthInfoProviders()
for _, provider := range oauthInfos {
if provider.Enabled {
hasEnabledProviders = true
break
}
}
}
if !hasEnabledProviders {
frontendSettings.Auth.PasswordlessEnabled = true
}
}
if hs.pluginsCDNService != nil && hs.pluginsCDNService.IsEnabled() {