public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthN: Cleanup authn package (#63456)

Browse Source 
* AuthN: Update comments for ClientParams

* AuthN: Update flag name from SyncTeamMembers to SyncTeams

* UserSync: rename function and fix order of parameters so it is correct

* UserSync: Fix so we skip check if no authModule or authID is passed

* UserSync: move quota check to create user function

* UserSync: Move FetchSyncedUserHook to UserSync

* UserSync: Move last seen user hook to user sync service

* ApiKey: Implement last seen hook as a client hook instead
This commit is contained in:
Karl Persson
2023-02-21 11:21:34 +01:00
committed by GitHub
parent 0caacb3333
commit 5ca8ea40c1
20 changed files with 219 additions and 281 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/clients/api_key.go
+21
View File
@@ -23,6 +23,7 @@ var (
errAPIKeyRevoked = errutil.NewBase(errutil.StatusUnauthorized, "api-key.revoked", errutil.WithPublicMessage("Revoked API key"))
)
var _ authn.HookClient = new(APIKey)
var _ authn.ContextAwareClient = new(APIKey)
func ProvideAPIKey(apiKeyService apikey.Service, userService user.Service) *APIKey {
@@ -141,6 +142,26 @@ func (s *APIKey) Priority() uint {
return 30
}
func (s *APIKey) Hook(ctx context.Context, identity *authn.Identity, r *authn.Request) error {
namespace, id := identity.NamespacedID()
if namespace != authn.NamespaceAPIKey {
return nil
}
go func(apikeyID int64) {
defer func() {
if err := recover(); err != nil {
s.log.Error("panic during user last seen sync", "err", err)
}
}()
if err := s.apiKeyService.UpdateAPIKeyLastUsedDate(context.Background(), apikeyID); err != nil {
s.log.Warn("failed to update last use date for api key", "id", apikeyID)
}
}(id)
return nil
}
func looksLikeApiKey(token string) bool {
return token != ""
}
pkg/services/authn/clients/grafana.go
+1 -1
View File
@@ -36,7 +36,7 @@ func (c *Grafana) AuthenticateProxy(ctx context.Context, r *authn.Request, usern
AuthID: username,
ClientParams: authn.ClientParams{
SyncUser: true,
SyncTeamMembers: true,
SyncTeams: true,
FetchSyncedUser: true,
AllowSignUp: c.cfg.AuthProxyAutoSignUp,
},
pkg/services/authn/clients/grafana_test.go
+5 -5
View File
@@ -50,7 +50,7 @@ func TestGrafana_AuthenticateProxy(t *testing.T) {
Groups: []string{"grp1", "grp2"},
ClientParams: authn.ClientParams{
SyncUser: true,
SyncTeamMembers: true,
SyncTeams: true,
AllowSignUp: true,
FetchSyncedUser: true,
LookUpParams: login.UserLookupParams{
@@ -71,9 +71,9 @@ func TestGrafana_AuthenticateProxy(t *testing.T) {
AuthModule: "authproxy",
AuthID: "test@test.com",
ClientParams: authn.ClientParams{
SyncUser: true,
SyncTeamMembers: true,
AllowSignUp: true,
SyncUser: true,
SyncTeams: true,
AllowSignUp: true,
LookUpParams: login.UserLookupParams{
Email: strPtr("test@test.com"),
Login: strPtr("test@test.com"),
@@ -110,7 +110,7 @@ func TestGrafana_AuthenticateProxy(t *testing.T) {
assert.Equal(t, tt.expectedIdentity.ClientParams.SyncUser, identity.ClientParams.SyncUser)
assert.Equal(t, tt.expectedIdentity.ClientParams.AllowSignUp, identity.ClientParams.AllowSignUp)
assert.Equal(t, tt.expectedIdentity.ClientParams.SyncTeamMembers, identity.ClientParams.SyncTeamMembers)
assert.Equal(t, tt.expectedIdentity.ClientParams.SyncTeams, identity.ClientParams.SyncTeams)
assert.Equal(t, tt.expectedIdentity.ClientParams.EnableDisabledUsers, identity.ClientParams.EnableDisabledUsers)
assert.EqualValues(t, tt.expectedIdentity.ClientParams.LookUpParams.Email, identity.ClientParams.LookUpParams.Email)
pkg/services/authn/clients/ldap.go
+1 -1
View File
@@ -82,7 +82,7 @@ func identityFromLDAPInfo(orgID int64, info *login.ExternalUserInfo, allowSignup
Groups: info.Groups,
ClientParams: authn.ClientParams{
SyncUser: true,
SyncTeamMembers: true,
SyncTeams: true,
EnableDisabledUsers: true,
FetchSyncedUser: true,
AllowSignUp: allowSignup,
pkg/services/authn/clients/ldap_test.go
+2 -2
View File
@@ -49,7 +49,7 @@ func TestLDAP_AuthenticateProxy(t *testing.T) {
Groups: []string{"1", "2"},
ClientParams: authn.ClientParams{
SyncUser: true,
SyncTeamMembers: true,
SyncTeams: true,
EnableDisabledUsers: true,
FetchSyncedUser: true,
LookUpParams: login.UserLookupParams{
@@ -113,7 +113,7 @@ func TestLDAP_AuthenticatePassword(t *testing.T) {
Groups: []string{"1", "2"},
ClientParams: authn.ClientParams{
SyncUser: true,
SyncTeamMembers: true,
SyncTeams: true,
EnableDisabledUsers: true,
FetchSyncedUser: true,
LookUpParams: login.UserLookupParams{
pkg/services/authn/clients/oauth.go
+1 -1
View File
@@ -135,7 +135,7 @@ func (c *OAuth) Authenticate(ctx context.Context, r *authn.Request) (*authn.Iden
OrgRoles: getOAuthOrgRole(userInfo, c.cfg),
ClientParams: authn.ClientParams{
SyncUser: true,
SyncTeamMembers: true,
SyncTeams: true,
FetchSyncedUser: true,
AllowSignUp: c.connector.IsSignupAllowed(),
LookUpParams: login.UserLookupParams{Email: &userInfo.Email},
pkg/services/authn/clients/oauth_test.go
+2 -2
View File
@@ -136,7 +136,7 @@ func TestOAuth_Authenticate(t *testing.T) {
OrgRoles: map[int64]org.RoleType{1: org.RoleAdmin},
ClientParams: authn.ClientParams{
SyncUser: true,
SyncTeamMembers: true,
SyncTeams: true,
AllowSignUp: true,
FetchSyncedUser: true,
LookUpParams: login.UserLookupParams{Email: strPtr("some@email.com")},
@@ -180,7 +180,7 @@ func TestOAuth_Authenticate(t *testing.T) {
assert.Equal(t, tt.expectedIdentity.ClientParams.SyncUser, identity.ClientParams.SyncUser)
assert.Equal(t, tt.expectedIdentity.ClientParams.AllowSignUp, identity.ClientParams.AllowSignUp)
assert.Equal(t, tt.expectedIdentity.ClientParams.SyncTeamMembers, identity.ClientParams.SyncTeamMembers)
assert.Equal(t, tt.expectedIdentity.ClientParams.SyncTeams, identity.ClientParams.SyncTeams)
assert.Equal(t, tt.expectedIdentity.ClientParams.EnableDisabledUsers, identity.ClientParams.EnableDisabledUsers)
assert.EqualValues(t, tt.expectedIdentity.ClientParams.LookUpParams.Email, identity.ClientParams.LookUpParams.Email)
pkg/services/authn/clients/session.go
-1
View File
@@ -65,7 +65,6 @@ func (s *Session) Authenticate(ctx context.Context, r *authn.Request) (*authn.Id
return nil, err
}
// FIXME (jguer): oauth token refresh not implemented
identity := authn.IdentityFromSignedInUser(authn.NamespacedID(authn.NamespaceUser, signedInUser.UserID), signedInUser, authn.ClientParams{})
identity.SessionToken = token