From a4431a7cbf21a577e85b548a690b99c0aa068d2e Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Wed, 1 Jun 2022 06:46:25 -0400 Subject: [PATCH] Settings: Sunset non-duration based login lifetime config (#49944) (#49990) (cherry picked from commit 39096208edee1915f20f82b2786ac4b63999de77) Co-authored-by: Emil Tullstedt --- docs/sources/auth/auth-proxy.md | 2 +- docs/sources/installation/upgrading.md | 8 +++++--- pkg/setting/setting.go | 21 +++++---------------- pkg/setting/setting_test.go | 10 ++-------- 4 files changed, 13 insertions(+), 28 deletions(-) diff --git a/docs/sources/auth/auth-proxy.md b/docs/sources/auth/auth-proxy.md index 70fff8ee09c..3a2440ba18b 100644 --- a/docs/sources/auth/auth-proxy.md +++ b/docs/sources/auth/auth-proxy.md @@ -306,5 +306,5 @@ With `enable_login_token` set to `true` Grafana will, after successful auth prox a login token and cookie. You only have to configure your auth proxy to provide headers for the /login route. Requests via other routes will be authenticated using the cookie. -Use settings `login_maximum_inactive_lifetime_days` and `login_maximum_lifetime_days` under `[auth]` to control session +Use settings `login_maximum_inactive_lifetime_duration` and `login_maximum_lifetime_duration` under `[auth]` to control session lifetime. [Read more about login tokens]({{< relref "overview/#login-and-short-lived-tokens" >}}) diff --git a/docs/sources/installation/upgrading.md b/docs/sources/installation/upgrading.md index 7e79b328496..87150534303 100644 --- a/docs/sources/installation/upgrading.md +++ b/docs/sources/installation/upgrading.md @@ -157,14 +157,16 @@ cookie_secure = true cookie_secure = true ``` -The `login_remember_days`, `cookie_username` and `cookie_remember_name` settings in the `security` section are no longer being used so they're safe to remove. +The `login_remember_days`, `login_maximum_inactive_lifetime_days`, `login_maximum_lifetime_days`, `cookie_username` and `cookie_remember_name` settings in the `security` section are no longer being used so they're safe to remove. + +If you have `login_maximum_lifetime_days` or `login_maximum_inactive_lifetime_days` configured, you need to change it to `login_maximum_lifetime_duration` or `login_maximum_inactive_lifetime_duration` and append `d` to the configuration value to retain the previous behavior. If you have `login_remember_days` configured to 0 (zero) you should change your configuration to this to accomplish similar behavior, i.e. a logged in user will maximum be logged in for 1 day until being forced to login again: ```ini [auth] -login_maximum_inactive_lifetime_days = 1 -login_maximum_lifetime_days = 1 +login_maximum_inactive_lifetime_duration = 1d +login_maximum_lifetime_duration = 1d ``` The default cookie name for storing the auth token is `grafana_session`. you can configure this with `login_cookie_name` in `[auth]` settings. diff --git a/pkg/setting/setting.go b/pkg/setting/setting.go index 861fe1358a1..c6f0b815376 100644 --- a/pkg/setting/setting.go +++ b/pkg/setting/setting.go @@ -1246,27 +1246,16 @@ func readAuthSettings(iniFile *ini.File, cfg *Cfg) (err error) { auth := iniFile.Section("auth") cfg.LoginCookieName = valueAsString(auth, "login_cookie_name", "grafana_session") - maxInactiveDaysVal := auth.Key("login_maximum_inactive_lifetime_days").MustString("") - if maxInactiveDaysVal != "" { - maxInactiveDaysVal = fmt.Sprintf("%sd", maxInactiveDaysVal) - cfg.Logger.Warn("[Deprecated] the configuration setting 'login_maximum_inactive_lifetime_days' is deprecated, please use 'login_maximum_inactive_lifetime_duration' instead") - } else { - maxInactiveDaysVal = "7d" - } - maxInactiveDurationVal := valueAsString(auth, "login_maximum_inactive_lifetime_duration", maxInactiveDaysVal) + + const defaultMaxInactiveLifetime = "7d" + maxInactiveDurationVal := valueAsString(auth, "login_maximum_inactive_lifetime_duration", defaultMaxInactiveLifetime) cfg.LoginMaxInactiveLifetime, err = gtime.ParseDuration(maxInactiveDurationVal) if err != nil { return err } - maxLifetimeDaysVal := auth.Key("login_maximum_lifetime_days").MustString("") - if maxLifetimeDaysVal != "" { - maxLifetimeDaysVal = fmt.Sprintf("%sd", maxLifetimeDaysVal) - cfg.Logger.Warn("[Deprecated] the configuration setting 'login_maximum_lifetime_days' is deprecated, please use 'login_maximum_lifetime_duration' instead") - } else { - maxLifetimeDaysVal = "30d" - } - maxLifetimeDurationVal := valueAsString(auth, "login_maximum_lifetime_duration", maxLifetimeDaysVal) + const defaultMaxLifetime = "30d" + maxLifetimeDurationVal := valueAsString(auth, "login_maximum_lifetime_duration", defaultMaxLifetime) cfg.LoginMaxLifetime, err = gtime.ParseDuration(maxLifetimeDurationVal) if err != nil { return err diff --git a/pkg/setting/setting_test.go b/pkg/setting/setting_test.go index 59f8033a5c9..826e6ad4e3b 100644 --- a/pkg/setting/setting_test.go +++ b/pkg/setting/setting_test.go @@ -301,9 +301,7 @@ func TestAuthDurationSettings(t *testing.T) { cfg := NewCfg() sec, err := f.NewSection("auth") require.NoError(t, err) - _, err = sec.NewKey("login_maximum_inactive_lifetime_days", "10") - require.NoError(t, err) - _, err = sec.NewKey("login_maximum_inactive_lifetime_duration", "") + _, err = sec.NewKey("login_maximum_inactive_lifetime_duration", "10d") require.NoError(t, err) err = readAuthSettings(f, cfg) require.NoError(t, err) @@ -323,9 +321,7 @@ func TestAuthDurationSettings(t *testing.T) { f = ini.Empty() sec, err = f.NewSection("auth") require.NoError(t, err) - _, err = sec.NewKey("login_maximum_lifetime_days", "24") - require.NoError(t, err) - _, err = sec.NewKey("login_maximum_lifetime_duration", "") + _, err = sec.NewKey("login_maximum_lifetime_duration", "24d") require.NoError(t, err) maxLifetimeDaysTest, err := time.ParseDuration("576h") require.NoError(t, err) @@ -347,8 +343,6 @@ func TestAuthDurationSettings(t *testing.T) { f = ini.Empty() sec, err = f.NewSection("auth") require.NoError(t, err) - _, err = sec.NewKey("login_maximum_lifetime_days", "") - require.NoError(t, err) _, err = sec.NewKey("login_maximum_lifetime_duration", "") require.NoError(t, err) maxLifetimeDurationTest, err = time.ParseDuration("720h")