From d3b09058993e49869a4d2f3c4fb650826055c73a Mon Sep 17 00:00:00 2001
From: Eric Perrino <ericpp@gmail.com>
Date: Fri, 7 Oct 2016 01:49:58 -0500
Subject: [PATCH] Added allow_sign_up setting to auth.ldap to be able to
 disable automatic user creation for LDAP logins (#6191)

---
 conf/defaults.ini      | 1 +
 conf/sample.ini        | 1 +
 pkg/login/ldap.go      | 5 ++++-
 pkg/setting/setting.go | 6 ++++--
 4 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/conf/defaults.ini b/conf/defaults.ini
index 209f0e24350..b6d6f9ee932 100644
--- a/conf/defaults.ini
+++ b/conf/defaults.ini
@@ -267,6 +267,7 @@ auto_sign_up = true
 [auth.ldap]
 enabled = false
 config_file = /etc/grafana/ldap.toml
+allow_sign_up = true
 
 #################################### SMTP / Emailing #####################
 [smtp]
diff --git a/conf/sample.ini b/conf/sample.ini
index cc0e982a114..fd6dd79c256 100644
--- a/conf/sample.ini
+++ b/conf/sample.ini
@@ -252,6 +252,7 @@
 [auth.ldap]
 ;enabled = false
 ;config_file = /etc/grafana/ldap.toml
+;allow_sign_up = true
 
 #################################### SMTP / Emailing ##########################
 [smtp]
diff --git a/pkg/login/ldap.go b/pkg/login/ldap.go
index d8c916bb765..cee7096dc45 100644
--- a/pkg/login/ldap.go
+++ b/pkg/login/ldap.go
@@ -13,6 +13,7 @@ import (
 	"github.com/grafana/grafana/pkg/bus"
 	"github.com/grafana/grafana/pkg/log"
 	m "github.com/grafana/grafana/pkg/models"
+	"github.com/grafana/grafana/pkg/setting"
 )
 
 type ldapAuther struct {
@@ -132,8 +133,10 @@ func (a *ldapAuther) getGrafanaUserFor(ldapUser *ldapUserInfo) (*m.User, error)
 	// get user from grafana db
 	userQuery := m.GetUserByLoginQuery{LoginOrEmail: ldapUser.Username}
 	if err := bus.Dispatch(&userQuery); err != nil {
-		if err == m.ErrUserNotFound {
+		if err == m.ErrUserNotFound && setting.LdapAllowSignup {
 			return a.createGrafanaUser(ldapUser)
+		} else if err == m.ErrUserNotFound {
+			return nil, ErrInvalidCredentials
 		} else {
 			return nil, err
 		}
diff --git a/pkg/setting/setting.go b/pkg/setting/setting.go
index 46f70215c1f..3086e7b9239 100644
--- a/pkg/setting/setting.go
+++ b/pkg/setting/setting.go
@@ -134,8 +134,9 @@ var (
 	GoogleTagManagerId string
 
 	// LDAP
-	LdapEnabled    bool
-	LdapConfigFile string
+	LdapEnabled     bool
+	LdapConfigFile  string
+	LdapAllowSignup bool = true
 
 	// SMTP email settings
 	Smtp SmtpSettings
@@ -551,6 +552,7 @@ func NewConfigContext(args *CommandLineArgs) error {
 	ldapSec := Cfg.Section("auth.ldap")
 	LdapEnabled = ldapSec.Key("enabled").MustBool(false)
 	LdapConfigFile = ldapSec.Key("config_file").String()
+	LdapAllowSignup = ldapSec.Key("allow_sign_up").MustBool(true)
 
 	alerting := Cfg.Section("alerting")
 	AlertingEnabled = alerting.Key("enabled").MustBool(false)