Auth: Remove Email Lookup from oauth integrations (#894)

Remove email lookup from oauth integrations

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>

pkg/services/authn/clients/oauth.go

@@ -140,6 +140,11 @@ func (c *OAuth) Authenticate(ctx context.Context, r *authn.Request) (*authn.Iden
 		return userInfo.Role, userInfo.IsGrafanaAdmin, nil
 	})
 
+	lookupParams := login.UserLookupParams{}
+	if c.cfg.OAuthAllowInsecureEmailLookup {
+		lookupParams.Email = &userInfo.Email
+	}
+
 	return &authn.Identity{
 		Login:          userInfo.Login,
 		Name:           userInfo.Name,
@@ -158,7 +163,7 @@ func (c *OAuth) Authenticate(ctx context.Context, r *authn.Request) (*authn.Iden
 			AllowSignUp:     c.connector.IsSignupAllowed(),
 			// skip org role flag is checked and handled in the connector. For now we can skip the hook if no roles are passed
 			SyncOrgRoles: len(orgRoles) > 0,
-			LookUpParams: login.UserLookupParams{Email: &userInfo.Email},
+			LookUpParams: lookupParams,
 		},
 	}, nil
 }

pkg/services/authn/clients/oauth_test.go

@@ -20,9 +20,10 @@ import (
 
 func TestOAuth_Authenticate(t *testing.T) {
 	type testCase struct {
-		desc     string
-		req      *authn.Request
-		oauthCfg *social.OAuthInfo
+		desc                  string
+		req                   *authn.Request
+		oauthCfg              *social.OAuthInfo
+		allowInsecureTakeover bool
 
 		addStateCookie   bool
 		stateCookieValue string
@@ -127,6 +128,45 @@ func TestOAuth_Authenticate(t *testing.T) {
 				Role:   "Admin",
 				Groups: []string{"grp1", "grp2"},
 			},
+			expectedIdentity: &authn.Identity{
+				Email:      "some@email.com",
+				AuthModule: "oauth_azuread",
+				AuthID:     "123",
+				Name:       "name",
+				Groups:     []string{"grp1", "grp2"},
+				OAuthToken: &oauth2.Token{},
+				OrgRoles:   map[int64]org.RoleType{1: org.RoleAdmin},
+				ClientParams: authn.ClientParams{
+					SyncUser:        true,
+					SyncTeams:       true,
+					AllowSignUp:     true,
+					FetchSyncedUser: true,
+					SyncOrgRoles:    true,
+					LookUpParams:    login.UserLookupParams{},
+				},
+			},
+		},
+		{
+			desc: "should return identity for valid request - and lookup user by email",
+			req: &authn.Request{HTTPRequest: &http.Request{
+				Header: map[string][]string{},
+				URL:    mustParseURL("http://grafana.com/?state=some-state"),
+			},
+			},
+			oauthCfg:              &social.OAuthInfo{UsePKCE: true},
+			allowInsecureTakeover: true,
+			addStateCookie:        true,
+			stateCookieValue:      "some-state",
+			addPKCECookie:         true,
+			pkceCookieValue:       "some-pkce-value",
+			isEmailAllowed:        true,
+			userInfo: &social.BasicUserInfo{
+				Id:     "123",
+				Name:   "name",
+				Email:  "some@email.com",
+				Role:   "Admin",
+				Groups: []string{"grp1", "grp2"},
+			},
 			expectedIdentity: &authn.Identity{
 				Email:      "some@email.com",
 				AuthModule: "oauth_azuread",
@@ -151,6 +191,10 @@ func TestOAuth_Authenticate(t *testing.T) {
 		t.Run(tt.desc, func(t *testing.T) {
 			cfg := setting.NewCfg()
 
+			if tt.allowInsecureTakeover {
+				cfg.OAuthAllowInsecureEmailLookup = true
+			}
+
 			if tt.addStateCookie {
 				v := tt.stateCookieValue
 				if v != "" {