OAuth: Support role mapping for GitLab OAuth (#30025)

* Support `role_attribute_path` for GitLab OAuth

Allow role mapping for GitLab accounts.

Example:

  [auth.gitlab]
  role_attribute_path = is_admin && 'Admin' || 'Viewer'

* Support `role_attribute_path` for GitLab OAuth

Allow role mapping for GitLab accounts.

Example:

  [auth.gitlab]
  role_attribute_path = is_admin && 'Admin' || 'Viewer'

* docs: add docs for role_attribute_path

* Apply suggestions from code review

Co-authored-by: Peter Leitzen <splattael@users.noreply.github.com>

* docs: update example

example should suggest a full configuration

* Apply suggestions from code review

Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>

* Apply suggestions from code review

Co-authored-by: Fiona Artiaga <89225282+GrafanaWriter@users.noreply.github.com>

* docs: add suggestions from tech writers

Co-authored-by: Henry Sachs <Henry.Sachs@deutschebahn.com>
Co-authored-by: Henry Sachs <henrysachs@gmail.com>
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Co-authored-by: Fiona Artiaga <89225282+GrafanaWriter@users.noreply.github.com>

pkg/login/social/gitlab_oauth.go

@@ -13,8 +13,9 @@ import (
 
 type SocialGitlab struct {
 	*SocialBase
-	allowedGroups []string
-	apiUrl        string
+	allowedGroups     []string
+	apiUrl            string
+	roleAttributePath string
 }
 
 func (s *SocialGitlab) Type() int {
@@ -114,12 +115,18 @@ func (s *SocialGitlab) UserInfo(client *http.Client, token *oauth2.Token) (*Basi
 
 	groups := s.GetGroups(client)
 
+	role, err := s.extractRole(response.Body)
+	if err != nil {
+		s.log.Error("Failed to extract role", "error", err)
+	}
+
 	userInfo := &BasicUserInfo{
 		Id:     fmt.Sprintf("%d", data.Id),
 		Name:   data.Name,
 		Login:  data.Username,
 		Email:  data.Email,
 		Groups: groups,
+		Role:   role,
 	}
 
 	if !s.IsGroupMember(groups) {
@@ -128,3 +135,16 @@ func (s *SocialGitlab) UserInfo(client *http.Client, token *oauth2.Token) (*Basi
 
 	return userInfo, nil
 }
+
+func (s *SocialGitlab) extractRole(rawJSON []byte) (string, error) {
+	if s.roleAttributePath == "" {
+		return "", nil
+	}
+
+	role, err := s.searchJSONForStringAttr(s.roleAttributePath, rawJSON)
+
+	if err != nil {
+		return "", err
+	}
+	return role, nil
+}

pkg/login/social/social.go

@@ -126,9 +126,10 @@ func ProvideService(cfg *setting.Cfg) *SocialService {
 		// GitLab.
 		if name == "gitlab" {
 			ss.socialMap["gitlab"] = &SocialGitlab{
-				SocialBase:    newSocialBase(name, &config, info),
-				apiUrl:        info.ApiUrl,
-				allowedGroups: util.SplitString(sec.Key("allowed_groups").String()),
+				SocialBase:        newSocialBase(name, &config, info),
+				apiUrl:            info.ApiUrl,
+				allowedGroups:     util.SplitString(sec.Key("allowed_groups").String()),
+				roleAttributePath: info.RoleAttributePath,
 			}
 		}