public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthN: Refactor basic auth client to support multiple password auth (#61153)

Browse Source 
* AuthN: add interface for password clients

* AuthN: Extract grafana password client

* AuthN: Rewrite basic client tests

* AuthN: Add Ldap client and rename method of PasswordClient

* AuthN: Configure multiple password clients

* AuthN: create ldap service and add tests
This commit is contained in:
Karl Persson
2023-01-09 16:40:29 +01:00
committed by GitHub
parent c3378aff8b
commit a49892c9ac
10 changed files with 413 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/clients/basic.go
+28 -35
View File
@@ -2,36 +2,35 @@ package clients
import (
"context"
"crypto/subtle"
"errors"
"strings"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/loginattempt"
"github.com/grafana/grafana/pkg/services/user"
"github.com/grafana/grafana/pkg/util"
"github.com/grafana/grafana/pkg/util/errutil"
)
var (
ErrBasicAuthCredentials = errutil.NewBase(errutil.StatusUnauthorized, "basic-auth.invalid-credentials", errutil.WithPublicMessage("Invalid username or password"))
ErrDecodingBasicAuthHeader = errutil.NewBase(errutil.StatusBadRequest, "basic-auth.invalid-header", errutil.WithPublicMessage("Invalid Basic Auth Header"))
errDecodingBasicAuthHeader = errutil.NewBase(errutil.StatusBadRequest, "basic-auth.invalid-header", errutil.WithPublicMessage("Invalid Basic Auth Header"))
errBasicAuthCredentials = errutil.NewBase(errutil.StatusUnauthorized, "basic-auth.invalid-credentials", errutil.WithPublicMessage("Invalid username or password"))
)
var _ authn.Client = new(Basic)
func ProvideBasic(userService user.Service, loginAttempts loginattempt.Service) *Basic {
return &Basic{userService, loginAttempts}
func ProvideBasic(loginAttempts loginattempt.Service, clients ...authn.PasswordClient) *Basic {
return &Basic{clients, loginAttempts}
}
type Basic struct {
userService user.Service
clients []authn.PasswordClient
loginAttempts loginattempt.Service
}
func (c *Basic) Authenticate(ctx context.Context, r *authn.Request) (*authn.Identity, error) {
username, password, err := util.DecodeBasicAuthHeader(getBasicAuthHeaderFromRequest(r))
if err != nil {
return nil, ErrDecodingBasicAuthHeader.Errorf("failed to decode basic auth header: %w", err)
return nil, errDecodingBasicAuthHeader.Errorf("failed to decode basic auth header: %w", err)
}
ok, err := c.loginAttempts.Validate(ctx, username)
@@ -39,37 +38,37 @@ func (c *Basic) Authenticate(ctx context.Context, r *authn.Request) (*authn.Iden
return nil, err
}
if !ok {
return nil, ErrBasicAuthCredentials.Errorf("too many consecutive incorrect login attempts for user - login for user temporarily blocked")
return nil, errBasicAuthCredentials.Errorf("too many consecutive incorrect login attempts for user - login for user temporarily blocked")
}
if len(password) == 0 {
return nil, ErrBasicAuthCredentials.Errorf("no password provided")
return nil, errBasicAuthCredentials.Errorf("no password provided")
}
// FIXME (kalleep): decide if we should handle ldap here
usr, err := c.userService.GetByLogin(ctx, &user.GetUserByLoginQuery{LoginOrEmail: username})
if err != nil {
return nil, ErrBasicAuthCredentials.Errorf("failed to fetch user: %w", err)
for _, pwClient := range c.clients {
identity, err := pwClient.AuthenticatePassword(ctx, r.OrgID, username, password)
if err != nil {
if errors.Is(err, errIdentityNotFound) {
// continue to next password client if identity could not be found
continue
}
if errors.Is(err, errInvalidPassword) {
// only add login attempt if identity was found but the provided password was invalid
_ = c.loginAttempts.Add(ctx, username, r.HTTPRequest.RemoteAddr)
}
return nil, errBasicAuthCredentials.Errorf("failed to authenticate identity: %w", err)
}
return identity, nil
}
if ok := comparePassword(password, usr.Salt, usr.Password); !ok {
_ = c.loginAttempts.Add(ctx, username, r.HTTPRequest.RemoteAddr)
return nil, ErrBasicAuthCredentials.Errorf("incorrect password provided")
}
signedInUser, err := c.userService.GetSignedInUserWithCacheCtx(ctx, &user.GetSignedInUserQuery{
UserID: usr.ID,
OrgID: r.OrgID,
})
if err != nil {
return nil, ErrBasicAuthCredentials.Errorf("failed to fetch user: %w", err)
}
return authn.IdentityFromSignedInUser(authn.NamespacedID(authn.NamespaceUser, signedInUser.UserID), signedInUser, authn.ClientParams{}), nil
return nil, errBasicAuthCredentials.Errorf("failed to authenticate identity using basic auth")
}
func (c *Basic) Test(ctx context.Context, r *authn.Request) bool {
if len(c.clients) == 0 {
return false
}
return looksLikeBasicAuthRequest(r)
}
@@ -93,9 +92,3 @@ func getBasicAuthHeaderFromRequest(r *authn.Request) string {
return header
}
func comparePassword(password, salt, hash string) bool {
// It is ok to ignore the error here because util.EncodePassword can never return a error
hashedPassword, _ := util.EncodePassword(password, salt)
return subtle.ConstantTimeCompare([]byte(hashedPassword), []byte(hash)) == 1
}