From 8c5cc1a7cc9007a9ab412016b49e982d3dbb3e71 Mon Sep 17 00:00:00 2001 From: "grafana-delivery-bot[bot]" <132647405+grafana-delivery-bot[bot]@users.noreply.github.com> Date: Wed, 20 Sep 2023 21:02:41 +0200 Subject: [PATCH] [v10.1.x] LDAP: FIX Enable users on successfull login (#75176) LDAP: FIX Enable users on successfull login (#75073) * LDAP: Enable users on successfull login * Force enable ldap users on successful login * Fix tests * Fix tests (cherry picked from commit c8149d50f964fd6a5b35ae89ca8bcaf657e39a9d) Co-authored-by: Gabriel MABILLE --- pkg/services/authn/clients/ldap.go | 10 +++++++++- pkg/services/authn/clients/ldap_test.go | 2 ++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/pkg/services/authn/clients/ldap.go b/pkg/services/authn/clients/ldap.go index 3948572205b..a9520730f44 100644 --- a/pkg/services/authn/clients/ldap.go +++ b/pkg/services/authn/clients/ldap.go @@ -107,7 +107,7 @@ func (c *LDAP) disableUser(ctx context.Context, username string) (*authn.Identit } func (c *LDAP) identityFromLDAPInfo(orgID int64, info *login.ExternalUserInfo) *authn.Identity { - return &authn.Identity{ + id := &authn.Identity{ OrgID: orgID, OrgRoles: info.OrgRoles, Login: info.Login, @@ -131,4 +131,12 @@ func (c *LDAP) identityFromLDAPInfo(orgID int64, info *login.ExternalUserInfo) * }, }, } + + // The ldap service is not aware of the internal state of the user. Fetching the user + // from the store to know if that user is disabled or not, is almost as costly as + // running an update systematically. We are setting IsDisabled to true so that the + // EnableDisabledUserHook force-enable that user. + id.IsDisabled = true + + return id } diff --git a/pkg/services/authn/clients/ldap_test.go b/pkg/services/authn/clients/ldap_test.go index 2477656accc..cd45ad8987e 100644 --- a/pkg/services/authn/clients/ldap_test.go +++ b/pkg/services/authn/clients/ldap_test.go @@ -60,6 +60,7 @@ func TestLDAP_AuthenticateProxy(t *testing.T) { AuthenticatedBy: login.LDAPAuthModule, AuthID: "123", Groups: []string{"1", "2"}, + IsDisabled: true, // Users are marked as disabled to force enablement on successful login ClientParams: authn.ClientParams{ SyncUser: true, SyncTeams: true, @@ -129,6 +130,7 @@ func TestLDAP_AuthenticatePassword(t *testing.T) { AuthenticatedBy: login.LDAPAuthModule, AuthID: "123", Groups: []string{"1", "2"}, + IsDisabled: true, // Users are marked as disabled to force enablement on successful login ClientParams: authn.ClientParams{ SyncUser: true, SyncTeams: true,