Auth: Add skip_org_role_sync setting for GrafanaCom (#60553)

* add frontend settings and setting for grafanacom * removed println * add skip-org-role-sync on login * add deprecation notice for this field * remove println * remove newline * change and renamed variables * fix for reconfiguring the settings for grafanacom * add documentationf or grafanacom setup * WIP tests * added tests * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * updated steps * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * doc: updated the docs to reflect what happens to grafana.com users * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * add blankline * rephrase of doc improvements for explaing of the settings * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * add frontend setting for grafanacom. * WIP tests * refactor docs * frontend to adhere to skipping org role sync for GrafanaCom users * update docs to reflect desired behavior * tests: added test for skip and nonskip * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> Co-authored-by: Jo <joao.guerreiro@grafana.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2023-01-12 16:44:08 +01:00
parent e7b8b82c14
commit 91322bebb5
12 changed files with 278 additions and 16 deletions
@@ -148,6 +148,7 @@ func (hs *HTTPServer) getFrontendSettingsMap(c *models.ReqContext) (map[string]i
 			"OAuthSkipOrgRoleUpdateSync": hs.Cfg.OAuthSkipOrgRoleUpdateSync,
 			"SAMLSkipOrgRoleSync":        hs.Cfg.SectionWithEnvOverrides("auth.saml").Key("skip_org_role_sync").MustBool(false),
 			"LDAPSkipOrgRoleSync":        hs.Cfg.LDAPSkipOrgRoleSync,
+			"GrafanaComSkipOrgRoleSync":  hs.Cfg.GrafanaComSkipOrgRoleSync,
 			"DisableSyncLock":            hs.Cfg.DisableSyncLock,
 		},
 		"buildInfo": map[string]interface{}{
@@ -14,14 +14,29 @@ import (

 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/login/social"
+	"github.com/grafana/grafana/pkg/models/roletype"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
 	"github.com/grafana/grafana/pkg/services/hooks"
 	"github.com/grafana/grafana/pkg/services/licensing"
+	"github.com/grafana/grafana/pkg/services/org"
 	"github.com/grafana/grafana/pkg/services/secrets/fakes"
 	"github.com/grafana/grafana/pkg/setting"
 	"github.com/grafana/grafana/pkg/web"
 )

+func setupSocialHTTPServerWithConfig(t *testing.T, cfg *setting.Cfg) *HTTPServer {
+	sqlStore := db.InitTestDB(t)
+
+	return &HTTPServer{
+		Cfg:            cfg,
+		License:        &licensing.OSSLicensingService{Cfg: cfg},
+		SQLStore:       sqlStore,
+		SocialService:  social.ProvideService(cfg, featuremgmt.WithFeatures()),
+		HooksService:   hooks.ProvideService(),
+		SecretsService: fakes.NewFakeSecretsService(),
+	}
+}
+
 func setupOAuthTest(t *testing.T, cfg *setting.Cfg) *web.Mux {
 	t.Helper()

@@ -29,17 +44,7 @@ func setupOAuthTest(t *testing.T, cfg *setting.Cfg) *web.Mux {
 		cfg = setting.NewCfg()
 	}
 	cfg.ErrTemplateName = "error-template"
-
-	sqlStore := db.InitTestDB(t)
-
-	hs := &HTTPServer{
-		Cfg:            cfg,
-		License:        &licensing.OSSLicensingService{Cfg: cfg},
-		SQLStore:       sqlStore,
-		SocialService:  social.ProvideService(cfg, featuremgmt.WithFeatures()),
-		HooksService:   hooks.ProvideService(),
-		SecretsService: fakes.NewFakeSecretsService(),
-	}
+	hs := setupSocialHTTPServerWithConfig(t, cfg)

 	m := web.New()
 	m.Use(getContextHandler(t, cfg).Middleware)
@@ -159,3 +164,69 @@ func TestOAuthLogin_UsePKCE(t *testing.T) {
 		base64.RawURLEncoding.EncodeToString(shasum[:]),
 	)
 }
+
+func TestOAuthLogin_BuildExternalUserInfo(t *testing.T) {
+	t.Helper()
+	cfgOAuthSkipRoleSync := setting.NewCfg()
+	authOAuthSec := cfgOAuthSkipRoleSync.Raw.Section("auth")
+	_, err := authOAuthSec.NewKey("oauth_skip_org_role_update_sync", "true")
+	require.NoError(t, err)
+	cfgOAuthSkipRoleSync.ErrTemplateName = "error-template"
+
+	cfgOAuthOrgRoleSync := setting.NewCfg()
+	authOAutoWithoutSec := cfgOAuthOrgRoleSync.Raw.Section("auth")
+	_, err = authOAutoWithoutSec.NewKey("oauth_skip_org_role_update_sync", "false")
+	require.NoError(t, err)
+	cfgOAuthOrgRoleSync.ErrTemplateName = "error-template"
+
+	testcases := []struct {
+		name             string
+		cfg              *setting.Cfg
+		basicUser        *social.BasicUserInfo
+		expectedOrgRoles map[int64]org.RoleType
+	}{
+		{
+			name: "should return empty map of org role mapping if the role for the basic info is empty",
+			cfg:  cfgOAuthOrgRoleSync,
+			basicUser: &social.BasicUserInfo{
+				Id:    "1",
+				Name:  "first lastname",
+				Email: "example@github.com",
+				Login: "example",
+				Role:  "",
+			},
+			expectedOrgRoles: map[int64]org.RoleType{},
+		},
+		{
+			name: "should set internal role if role exists and we are skipping org role sync",
+			cfg:  cfgOAuthSkipRoleSync,
+			basicUser: &social.BasicUserInfo{
+				Id:    "1",
+				Name:  "first lastname",
+				Email: "example@github.com",
+				Login: "example",
+				Role:  roletype.RoleAdmin,
+			},
+			expectedOrgRoles: map[int64]org.RoleType{1: roletype.RoleAdmin},
+		},
+		{
+			name: "should return empty external role, if the role for the basic info is empty",
+			cfg:  cfgOAuthSkipRoleSync,
+			basicUser: &social.BasicUserInfo{
+				Id:    "1",
+				Name:  "first lastname",
+				Email: "example@github.com",
+				Login: "example",
+				Role:  "",
+			},
+			expectedOrgRoles: map[int64]org.RoleType{},
+		},
+	}
+	for _, tc := range testcases {
+		t.Logf("%s", tc.name)
+		cfg := tc.cfg
+		hs := setupSocialHTTPServerWithConfig(t, cfg)
+		externalUser := hs.buildExternalUserInfo(nil, tc.basicUser, "")
+		require.Equal(t, tc.expectedOrgRoles, externalUser.OrgRoles)
+	}
+}