Access Control: Add service accounts (#38994)

* Add extra fields to OSS types to support enterprise

* Create a service account at the same time as the API key

* Use service account credentials when accessing API with APIkey

* Add GetRole to service, merge RoleDTO and Role structs

This patch merges the identical OSS and Enterprise data structures, which improves the code for two reasons:

1.  Makes switching between OSS and Enterprise easier
2.  Reduces the chance of incompatibilities developing between the same functions in OSS and Enterprise

* If API key is not linked to a service account, continue login as usual

* Fallback to old auth if no service account linked to key

* Add CloneUserToServiceAccount

* Adding LinkAPIKeyToServiceAccount

* Handle api key link error

* Better error messages for OSS accesscontrol

* Set an invalid user id as default

* Re-arrange field names

* ServiceAccountId is integer

* Better error messages

Co-authored-by: Hugo Häggmark <hugo.haggmark@grafana.com>
Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

pkg/models/apikey.go

@@ -13,24 +13,27 @@ var (
 )
 
 type ApiKey struct {
-	Id      int64
-	OrgId   int64
-	Name    string
-	Key     string
-	Role    RoleType
-	Created time.Time
-	Updated time.Time
-	Expires *int64
+	Id               int64
+	OrgId            int64
+	Name             string
+	Key              string
+	Role             RoleType
+	Created          time.Time
+	Updated          time.Time
+	Expires          *int64
+	ServiceAccountId int64
 }
 
 // ---------------------
 // COMMANDS
 type AddApiKeyCommand struct {
-	Name          string   `json:"name" binding:"Required"`
-	Role          RoleType `json:"role" binding:"Required"`
-	OrgId         int64    `json:"-"`
-	Key           string   `json:"-"`
-	SecondsToLive int64    `json:"secondsToLive"`
+	Name                    string   `json:"name" binding:"Required"`
+	Role                    RoleType `json:"role" binding:"Required"`
+	OrgId                   int64    `json:"-"`
+	Key                     string   `json:"-"`
+	SecondsToLive           int64    `json:"secondsToLive"`
+	ServiceAccountId        int64    `json:"serviceAccount"`
+	CreateNewServiceAccount bool     `json:"createServiceAccount"`
 
 	Result *ApiKey `json:"-"`
 }

pkg/models/user.go

@@ -56,18 +56,19 @@ func (u *User) NameOrFallback() string {
 // COMMANDS
 
 type CreateUserCommand struct {
-	Email          string
-	Login          string
-	Name           string
-	Company        string
-	OrgId          int64
-	OrgName        string
-	Password       string
-	EmailVerified  bool
-	IsAdmin        bool
-	IsDisabled     bool
-	SkipOrgSetup   bool
-	DefaultOrgRole string
+	Email            string
+	Login            string
+	Name             string
+	Company          string
+	OrgId            int64
+	OrgName          string
+	Password         string
+	EmailVerified    bool
+	IsAdmin          bool
+	IsDisabled       bool
+	SkipOrgSetup     bool
+	DefaultOrgRole   string
+	IsServiceAccount bool
 
 	Result User
 }