public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Settings: Remove global variables for auth settings (#63795)

Browse Source 
* Setting: Remove global DisableLoginForm and add it to cfg

* Setting: Remove unused BasicAuthEnabled global

* Setting: Remove global OAuthAutoLogin and use from cfg

* Setting: Remove global AnonymousEnabled

* Setting: Remove global values for AuthProxy settings
This commit is contained in:
Karl Persson
2023-02-27 15:28:49 +01:00
committed by GitHub
parent a41e9b2dc7
commit 8484d0c4ef
9 changed files with 34 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/frontendsettings.go
+2 -2
View File
@@ -105,7 +105,7 @@ func (hs *HTTPServer) getFrontendSettings(c *contextmodel.ReqContext) (*dtos.Fro
AppUrl: hs.Cfg.AppURL,
AppSubUrl: hs.Cfg.AppSubURL,
AllowOrgCreate: (setting.AllowUserOrgCreate && c.IsSignedIn) || c.IsGrafanaAdmin,
AuthProxyEnabled: setting.AuthProxyEnabled,
AuthProxyEnabled: hs.Cfg.AuthProxyEnabled,
LdapEnabled: hs.Cfg.LDAPEnabled,
JwtHeaderName: hs.Cfg.JWTAuthHeaderName,
JwtUrlLogin: hs.Cfg.JWTAuthURLLogin,
@@ -132,7 +132,7 @@ func (hs *HTTPServer) getFrontendSettings(c *contextmodel.ReqContext) (*dtos.Fro
FeedbackLinksEnabled: hs.Cfg.FeedbackLinksEnabled,
ApplicationInsightsConnectionString: hs.Cfg.ApplicationInsightsConnectionString,
ApplicationInsightsEndpointUrl: hs.Cfg.ApplicationInsightsEndpointUrl,
DisableLoginForm: setting.DisableLoginForm,
DisableLoginForm: hs.Cfg.DisableLoginForm,
DisableUserSignUp: !setting.AllowUserSignUp,
LoginHint: setting.LoginHint,
PasswordHint: setting.PasswordHint,
pkg/api/login.go
+6 -4
View File
@@ -151,9 +151,10 @@ func (hs *HTTPServer) tryAutoLogin(c *contextmodel.ReqContext) bool {
}
}
// If no auto_login option configured for specific OAuth, use legacy option
if setting.OAuthAutoLogin && autoLoginProvidersLen == 0 {
if hs.Cfg.OAuthAutoLogin && autoLoginProvidersLen == 0 {
autoLoginProvidersLen = len(oauthInfos)
}
if samlAutoLogin {
autoLoginProvidersLen++
}
@@ -162,13 +163,14 @@ func (hs *HTTPServer) tryAutoLogin(c *contextmodel.ReqContext) bool {
c.Logger.Warn("Skipping auto login because multiple auth providers are configured with auto_login option")
return false
}
if autoLoginProvidersLen == 0 && setting.OAuthAutoLogin {
if hs.Cfg.OAuthAutoLogin && autoLoginProvidersLen == 0 {
c.Logger.Warn("Skipping auto login because no auth providers are configured")
return false
}
for providerName, provider := range oauthInfos {
if provider.AutoLogin || setting.OAuthAutoLogin {
if provider.AutoLogin || hs.Cfg.OAuthAutoLogin {
redirectUrl := hs.Cfg.AppSubURL + "/login/" + providerName
c.Logger.Info("OAuth auto login enabled. Redirecting to " + redirectUrl)
c.Redirect(redirectUrl, 307)
@@ -245,7 +247,7 @@ func (hs *HTTPServer) LoginPost(c *contextmodel.ReqContext) response.Response {
}, c)
}()
if setting.DisableLoginForm {
if hs.Cfg.DisableLoginForm {
resp = response.Error(http.StatusUnauthorized, "Login is disabled", nil)
return resp
}
pkg/api/login_test.go
+3 -3
View File
@@ -113,7 +113,7 @@ func TestLoginErrorCookieAPIEndpoint(t *testing.T) {
cfg.LoginCookieName = "grafana_session"
setting.SecretKey = "login_testing"
setting.OAuthAutoLogin = true
cfg.OAuthAutoLogin = true
oauthError := errors.New("User not a member of one of the required organizations")
encryptedError, err := hs.SecretsService.Encrypt(context.Background(), []byte(oauthError.Error()), secrets.WithoutScope())
@@ -498,7 +498,7 @@ func TestLoginOAuthRedirect(t *testing.T) {
return response.Empty(http.StatusOK)
})
setting.OAuthAutoLogin = true
hs.Cfg.OAuthAutoLogin = true
sc.m.Get(sc.url, sc.defaultHandler)
sc.fakeReqNoAssertions("GET", sc.url).exec()
@@ -525,7 +525,7 @@ func TestLoginInternal(t *testing.T) {
return response.Empty(http.StatusOK)
})
setting.OAuthAutoLogin = true
hs.Cfg.OAuthAutoLogin = true
sc.m.Get(sc.url, sc.defaultHandler)
sc.fakeReqNoAssertions("GET", sc.url).exec()
pkg/api/org_invite.go
+1 -1
View File
@@ -90,7 +90,7 @@ func (hs *HTTPServer) AddOrgInvite(c *contextmodel.ReqContext) response.Response
return hs.inviteExistingUserToOrg(c, usr, &inviteDto)
}
if setting.DisableLoginForm {
if hs.Cfg.DisableLoginForm {
return response.Error(400, "Cannot invite when login is disabled.", nil)
}
pkg/api/password.go
+1 -2
View File
@@ -11,7 +11,6 @@ import (
"github.com/grafana/grafana/pkg/services/login"
"github.com/grafana/grafana/pkg/services/notifications"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/setting"
"github.com/grafana/grafana/pkg/util"
"github.com/grafana/grafana/pkg/web"
)
@@ -21,7 +20,7 @@ func (hs *HTTPServer) SendResetPasswordEmail(c *contextmodel.ReqContext) respons
if err := web.Bind(c.Req, &form); err != nil {
return response.Error(http.StatusBadRequest, "bad request data", err)
}
if setting.DisableLoginForm {
if hs.Cfg.DisableLoginForm {
return response.Error(401, "Not allowed to reset password when login form is disabled", nil)
}
pkg/api/user.go
+3 -4
View File
@@ -14,7 +14,6 @@ import (
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/services/team"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/setting"
"github.com/grafana/grafana/pkg/util"
"github.com/grafana/grafana/pkg/web"
)
@@ -129,11 +128,11 @@ func (hs *HTTPServer) UpdateSignedInUser(c *contextmodel.ReqContext) response.Re
cmd.Email = strings.TrimSpace(cmd.Email)
cmd.Login = strings.TrimSpace(cmd.Login)
if setting.AuthProxyEnabled {
if setting.AuthProxyHeaderProperty == "email" && cmd.Email != c.Email {
if hs.Cfg.AuthProxyEnabled {
if hs.Cfg.AuthProxyHeaderProperty == "email" && cmd.Email != c.Email {
return response.Error(400, "Not allowed to change email when auth proxy is using email property", nil)
}
if setting.AuthProxyHeaderProperty == "username" && cmd.Login != c.Login {
if hs.Cfg.AuthProxyHeaderProperty == "username" && cmd.Login != c.Login {
return response.Error(400, "Not allowed to change username when auth proxy is using username property", nil)
}
}