public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: change the error HTTP status codes (#18584)

Browse Source 
* Auth: change the error HTTP status codes

* Use 407 HTTP status code for incorrect credentials error

* Improve proxy auth logs

* Remove no longer needed TODO comment

Fixes #18439
This commit is contained in:
Oleg Gaidarenko
2019-08-20 20:13:27 +03:00
committed by GitHub
parent ec492e55dc
commit 6ca1a6c8da
3 changed files with 64 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/middleware/auth_proxy.go
+32 -6
View File
@@ -1,9 +1,11 @@
package middleware
import (
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/remotecache"
authproxy "github.com/grafana/grafana/pkg/middleware/auth_proxy"
m "github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/setting"
)
const (
@@ -12,13 +14,18 @@ const (
cachePrefix = authproxy.CachePrefix
)
var header = setting.AuthProxyHeaderName
func initContextWithAuthProxy(store *remotecache.RemoteCache, ctx *m.ReqContext, orgID int64) bool {
username := ctx.Req.Header.Get(header)
auth := authproxy.New(&authproxy.Options{
Store: store,
Ctx: ctx,
OrgID: orgID,
})
logger := log.New("auth.proxy")
// Bail if auth proxy is not enabled
if !auth.IsEnabled() {
return false
@@ -31,7 +38,11 @@ func initContextWithAuthProxy(store *remotecache.RemoteCache, ctx *m.ReqContext,
// Check if allowed to continue with this IP
if result, err := auth.IsAllowedIP(); !result {
ctx.Logger.Error("auth proxy: failed to check whitelisted ip addresses", "message", err.Error(), "error", err.DetailsError)
logger.Error(
"Failed to check whitelisted IP addresses",
"message", err.Error(),
"error", err.DetailsError,
)
ctx.Handle(407, err.Error(), err.DetailsError)
return true
}
@@ -39,16 +50,26 @@ func initContextWithAuthProxy(store *remotecache.RemoteCache, ctx *m.ReqContext,
// Try to log in user from various providers
id, err := auth.Login()
if err != nil {
ctx.Logger.Error("auth proxy: failed to login", "message", err.Error(), "error", err.DetailsError)
ctx.Handle(500, err.Error(), err.DetailsError)
logger.Error(
"Failed to login",
"username", username,
"message", err.Error(),
"error", err.DetailsError,
)
ctx.Handle(407, err.Error(), err.DetailsError)
return true
}
// Get full user info
user, err := auth.GetSignedUser(id)
if err != nil {
ctx.Logger.Error("auth proxy: failed to get signed in user", "message", err.Error(), "error", err.DetailsError)
ctx.Handle(500, err.Error(), err.DetailsError)
logger.Error(
"Failed to get signed user",
"username", username,
"message", err.Error(),
"error", err.DetailsError,
)
ctx.Handle(407, err.Error(), err.DetailsError)
return true
}
@@ -58,7 +79,12 @@ func initContextWithAuthProxy(store *remotecache.RemoteCache, ctx *m.ReqContext,
// Remember user data it in cache
if err := auth.Remember(id); err != nil {
ctx.Logger.Error("auth proxy: failed to store user in cache", "message", err.Error(), "error", err.DetailsError)
logger.Error(
"Failed to store user in cache",
"username", username,
"message", err.Error(),
"error", err.DetailsError,
)
ctx.Handle(500, err.Error(), err.DetailsError)
return true
}