public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: Remove oauth skip org role sync (#84972)

Browse Source 
* remove oauth wide skip org role sync

* we are warning from config

* set it to false

* removed from config ini files and updated docs
This commit is contained in:
Eric Leijonmarck
2024-03-22 15:34:05 +01:00
committed by GitHub
parent f2c7023fe6
commit bb792ff540
11 changed files with 8 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/frontendsettings.go
-1
View File
@@ -327,7 +327,6 @@ func (hs *HTTPServer) getFrontendSettings(c *contextmodel.ReqContext) (*dtos.Fro
oauthProviders := hs.SocialService.GetOAuthInfoProviders()
frontendSettings.Auth = dtos.FrontendSettingsAuthDTO{
AuthProxyEnableLoginToken: hs.Cfg.AuthProxy.EnableLoginToken,
OAuthSkipOrgRoleUpdateSync: hs.Cfg.OAuthSkipOrgRoleUpdateSync,
SAMLSkipOrgRoleSync: hs.Cfg.SAMLSkipOrgRoleSync,
LDAPSkipOrgRoleSync: hs.Cfg.LDAPSkipOrgRoleSync,
JWTAuthSkipOrgRoleSync: hs.Cfg.JWTAuth.SkipOrgRoleSync,
pkg/login/social/connectors/azuread_oauth_test.go
+2 -4
View File
@@ -800,8 +800,7 @@ func TestSocialAzureAD_SkipOrgRole(t *testing.T) {
SkipOrgRoleSync: false,
},
cfg: &setting.Cfg{
AutoAssignOrgRole: "",
OAuthSkipOrgRoleUpdateSync: false,
AutoAssignOrgRole: "",
},
},
claims: &azureClaims{
@@ -831,8 +830,7 @@ func TestSocialAzureAD_SkipOrgRole(t *testing.T) {
SkipOrgRoleSync: false,
},
cfg: &setting.Cfg{
AutoAssignOrgRole: "",
OAuthSkipOrgRoleUpdateSync: false,
AutoAssignOrgRole: "",
},
},
claims: &azureClaims{
pkg/login/social/connectors/gitlab_oauth_test.go
+1 -2
View File
@@ -362,8 +362,7 @@ func TestSocialGitlab_extractFromToken(t *testing.T) {
TokenUrl: tc.config.Endpoint.TokenURL,
},
&setting.Cfg{
AutoAssignOrgRole: "",
OAuthSkipOrgRoleUpdateSync: false,
AutoAssignOrgRole: "",
}, &ssosettingstests.MockService{},
featuremgmt.WithFeatures())
pkg/login/social/connectors/okta_oauth_test.go
+1 -2
View File
@@ -111,8 +111,7 @@ func TestSocialOkta_UserInfo(t *testing.T) {
SkipOrgRoleSync: tt.settingSkipOrgRoleSync,
},
&setting.Cfg{
AutoAssignOrgRole: tt.autoAssignOrgRole,
OAuthSkipOrgRoleUpdateSync: false,
AutoAssignOrgRole: tt.autoAssignOrgRole,
},
&ssosettingstests.MockService{},
featuremgmt.WithFeatures())
pkg/services/authn/clients/oauth.go
-3
View File
@@ -162,9 +162,6 @@ func (c *OAuth) Authenticate(ctx context.Context, r *authn.Request) (*authn.Iden
}
orgRoles, isGrafanaAdmin, _ := getRoles(c.cfg, func() (org.RoleType, *bool, error) {
if c.cfg.OAuthSkipOrgRoleUpdateSync {
return "", nil, nil
}
return userInfo.Role, userInfo.IsGrafanaAdmin, nil
})
pkg/services/login/authinfo.go
-6
View File
@@ -78,12 +78,6 @@ func IsExternallySynced(cfg *setting.Cfg, authModule string, oauthInfo *social.O
case JWTModule:
return !cfg.JWTAuth.SkipOrgRoleSync
}
// then check the rest of the oauth providers
// FIXME: remove this once we remove the setting
// is a deprecated setting that is used to skip org role sync for all external oauth providers
if cfg.OAuthSkipOrgRoleUpdateSync {
return false
}
switch authModule {
case GoogleAuthModule, OktaAuthModule, AzureADAuthModule, GitLabAuthModule, GithubAuthModule, GrafanaComAuthModule, GenericOAuthModule:
if oauthInfo == nil {
pkg/services/login/authinfo_test.go
-8
View File
@@ -32,14 +32,6 @@ func TestIsExternallySynced(t *testing.T) {
provider: AzureADAuthModule,
expected: false,
},
// FIXME: remove this test as soon as we remove the deprecated setting for skipping org role sync for all external oauth providers
{
name: "AzureAD external user should return that it is not externally synced when oauth org role sync is set",
cfg: &setting.Cfg{OAuthSkipOrgRoleUpdateSync: true},
oauthInfo: &social.OAuthInfo{Enabled: true, SkipOrgRoleSync: false},
provider: AzureADAuthModule,
expected: false,
},
{
name: "AzureAD external user should return that it is not externally synced when the provider is not enabled",
cfg: &setting.Cfg{},
pkg/setting/setting.go
+2 -4
View File
@@ -1571,11 +1571,9 @@ func readAuthSettings(iniFile *ini.File, cfg *Cfg) (err error) {
cfg.OAuthCookieMaxAge = auth.Key("oauth_state_cookie_max_age").MustInt(600)
cfg.SignoutRedirectUrl = valueAsString(auth, "signout_redirect_url", "")
// Deprecated
cfg.OAuthSkipOrgRoleUpdateSync = auth.Key("oauth_skip_org_role_update_sync").MustBool(false)
if cfg.OAuthSkipOrgRoleUpdateSync {
cfg.Logger.Warn("[Deprecated] The oauth_skip_org_role_update_sync configuration setting is deprecated. Please use skip_org_role_sync inside the auth provider section instead.")
}
cfg.OAuthSkipOrgRoleUpdateSync = false
cfg.DisableLogin = auth.Key("disable_login").MustBool(false)