public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: disable passwordless auth if any SAML/OAuth is enabled (#98227)

Browse Source 
* Auth: disable passwordless auth if any SAML/OAuth is enabled

* Update pkg/services/authn/authnimpl/registration.go

Co-authored-by: Victor Cinaglia <victor@grafana.com>

* simplify check if any auth providers are enabled

* add accidentally removed break statement, use IsEnabled with empty context to check if PasswordlessMagicLinkAuth enabled

* use IsClientEnabled

* Update pkg/api/frontendsettings.go

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

---------

Co-authored-by: Victor Cinaglia <victor@grafana.com>
Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
This commit is contained in:
colin-stuart
2025-01-09 11:44:16 -05:00
committed by GitHub
co-authored by Victor Cinaglia Misi
parent 9e9adbf5b5
commit 4581a82ac4
3 changed files with 40 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/authnimpl/registration.go
+20 -3
View File
@@ -1,6 +1,8 @@
package authnimpl
import (
"context"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/remotecache"
"github.com/grafana/grafana/pkg/infra/tracing"
@@ -80,9 +82,24 @@ func ProvideRegistration(
}
}
if cfg.PasswordlessMagicLinkAuth.Enabled && features.IsEnabledGlobally(featuremgmt.FlagPasswordlessMagicLinkAuthentication) {
passwordless := clients.ProvidePasswordless(cfg, loginAttempts, userService, tempUserService, notificationService, cache)
authnSvc.RegisterClient(passwordless)
if cfg.PasswordlessMagicLinkAuth.Enabled && features.IsEnabled(context.Background(), featuremgmt.FlagPasswordlessMagicLinkAuthentication) {
hasEnabledProviders := authnSvc.IsClientEnabled(authn.ClientSAML) || authnSvc.IsClientEnabled(authn.ClientLDAP)
if !hasEnabledProviders {
oauthInfos := socialService.GetOAuthInfoProviders()
for _, provider := range oauthInfos {
if provider.Enabled {
hasEnabledProviders = true
break
}
}
}
if hasEnabledProviders {
logger.Error("Failed to configure passwordless magic link auth: cannot enable both passwordless magic link auth & SSO")
} else {
passwordless := clients.ProvidePasswordless(cfg, loginAttempts, userService, tempUserService, notificationService, cache)
authnSvc.RegisterClient(passwordless)
}
}
if cfg.AuthProxy.Enabled && len(proxyClients) > 0 {