public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: Support JWT configs tls_client_ca and jwk_set_bearer_token_file (#109095)

Browse Source 
* Auth.jwt: Support config tls_client_ca

* Auth.jwt: Support config jwk_set_bearer_token_file

* Docs: Document new JWKS url options and mention tls_skip_verify_insecure

* Docs: Fix note on JWKS response caching

* chore: Refactor getBearerToken into standalone function

* docs: Apply wording/formatting suggestions

Co-authored-by: Victor Cinaglia <victorcinaglia@gmail.com>

* chore: Simplify ca helper function using testcerts

Co-authored-by: Victor Cinaglia <victorcinaglia@gmail.com>

* chore: Update doc and add comment preventing potential erroneous optimization

Co-authored-by: Victor Cinaglia <victorcinaglia@gmail.com>

chore: Reword comment prevent an erroneous refactor

* docs: Update casing

Co-authored-by: Victor Cinaglia <victorcinaglia@gmail.com>

---------

Co-authored-by: Victor Cinaglia <victorcinaglia@gmail.com>
This commit is contained in:
Steffen Baarsgaard
2025-08-26 09:50:06 -03:00
committed by GitHub
co-authored by Victor Cinaglia
parent 145577831b
commit b047175330
6 changed files with 294 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/setting/setting_jwt.go
+4
View File
@@ -19,6 +19,7 @@ type AuthJWTSettings struct {
UsernameClaim string
ExpectClaims string
JWKSetURL string
JWKSetBearerTokenFile string
CacheTTL time.Duration
KeyFile string
KeyID string
@@ -33,6 +34,7 @@ type AuthJWTSettings struct {
GroupsAttributePath string
EmailAttributePath string
UsernameAttributePath string
TlsClientCa string
TlsSkipVerify bool
}
@@ -64,6 +66,7 @@ func (cfg *Cfg) readAuthJWTSettings() {
jwtSettings.UsernameClaim = valueAsString(authJWT, "username_claim", "")
jwtSettings.ExpectClaims = valueAsString(authJWT, "expect_claims", "{}")
jwtSettings.JWKSetURL = valueAsString(authJWT, "jwk_set_url", "")
jwtSettings.JWKSetBearerTokenFile = valueAsString(authJWT, "jwk_set_bearer_token_file", "")
jwtSettings.CacheTTL = authJWT.Key("cache_ttl").MustDuration(time.Minute * 60)
jwtSettings.KeyFile = valueAsString(authJWT, "key_file", "")
jwtSettings.KeyID = authJWT.Key("key_id").MustString("")
@@ -76,6 +79,7 @@ func (cfg *Cfg) readAuthJWTSettings() {
jwtSettings.GroupsAttributePath = valueAsString(authJWT, "groups_attribute_path", "")
jwtSettings.EmailAttributePath = valueAsString(authJWT, "email_attribute_path", "")
jwtSettings.UsernameAttributePath = valueAsString(authJWT, "username_attribute_path", "")
jwtSettings.TlsClientCa = valueAsString(authJWT, "tls_client_ca", "")
jwtSettings.TlsSkipVerify = authJWT.Key("tls_skip_verify_insecure").MustBool(false)
jwtSettings.OrgAttributePath = valueAsString(authJWT, "org_attribute_path", "")
jwtSettings.OrgMapping = util.SplitString(valueAsString(authJWT, "org_mapping", ""))