public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SAML: change the config option for making SAML UI accessible to org Admins (#67399)

Browse Source 
* change from role grant overrides to SAML UI specific config option

* update permissions needed to access SAML UI

* PR feedback: change config name, change required perms to write, add a comment
This commit is contained in:
Ieva
2023-04-28 11:48:26 +01:00
committed by GitHub
parent 8b6160bc66
commit 533f8caafd
8 changed files with 22 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/accesscontrol/acimpl/service_test.go
-71
View File
@@ -161,77 +161,6 @@ func TestService_DeclareFixedRoles(t *testing.T) {
}
}
func TestService_DeclareFixedRoles_Overrides(t *testing.T) {
tests := []struct {
name string
registration accesscontrol.RoleRegistration
overrides map[string][]string
wantGrants []string
wantErr bool
}{
{
name: "no grant override",
registration: accesscontrol.RoleRegistration{
Role: accesscontrol.RoleDTO{Name: "fixed:test:test"},
Grants: []string{"Admin"},
AllowGrantsOverride: true,
},
wantGrants: []string{"Admin"},
wantErr: false,
},
{
name: "should account for grant overrides",
registration: accesscontrol.RoleRegistration{
Role: accesscontrol.RoleDTO{Name: "fixed:test:test"},
Grants: []string{"Admin"},
AllowGrantsOverride: true,
},
overrides: map[string][]string{"fixed_test_test": {"Viewer", "Grafana Admin"}},
wantGrants: []string{"Viewer", "Grafana Admin"},
wantErr: false,
},
{
name: "should not account for grant overrides",
registration: accesscontrol.RoleRegistration{
Role: accesscontrol.RoleDTO{Name: "fixed:test:test"},
Grants: []string{"Admin"},
AllowGrantsOverride: false,
},
overrides: map[string][]string{"fixed_test_test": {"Viewer", "Grafana Admin"}},
wantGrants: []string{"Admin"},
wantErr: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
ac := setupTestEnv(t)
// Reset the registations
ac.registrations = accesscontrol.RegistrationList{}
ac.cfg.RBACGrantOverrides = tt.overrides
// Test
err := ac.DeclareFixedRoles(tt.registration)
if tt.wantErr {
require.Error(t, err)
return
}
require.NoError(t, err)
registrationCnt := 0
grants := []string{}
ac.registrations.Range(func(registration accesscontrol.RoleRegistration) bool {
registrationCnt++
grants = registration.Grants
return true
})
require.Equal(t, 1, registrationCnt,
"expected service registration list to contain the registration")
require.ElementsMatch(t, tt.wantGrants, grants)
})
}
}
func TestService_DeclarePluginRoles(t *testing.T) {
tests := []struct {
name string