Authn: Add function to resolve identity from org and namespace id (#84555)

* Add function to get the namespaced id

* Add function to resolve an identity through authn.Service from org and namespace id

* Switch to resolve identity for re-authenticate in another org

pkg/services/user/identity.go

@@ -2,6 +2,7 @@ package user
 
 import (
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/grafana/grafana/pkg/models/roletype"
@@ -189,28 +190,31 @@ func (u *SignedInUser) GetOrgRole() roletype.RoleType {
 	return u.OrgRole
 }
 
-// GetNamespacedID returns the namespace and ID of the active entity
-// The namespace is one of the constants defined in pkg/services/auth/identity
-func (u *SignedInUser) GetNamespacedID() (string, string) {
+// GetID returns namespaced id for the entity
+func (u *SignedInUser) GetID() string {
 	switch {
 	case u.ApiKeyID != 0:
-		return identity.NamespaceAPIKey, fmt.Sprintf("%d", u.ApiKeyID)
+		return namespacedID(identity.NamespaceAPIKey, u.ApiKeyID)
 	case u.IsServiceAccount:
-		return identity.NamespaceServiceAccount, fmt.Sprintf("%d", u.UserID)
+		return namespacedID(identity.NamespaceServiceAccount, u.UserID)
 	case u.UserID > 0:
-		return identity.NamespaceUser, fmt.Sprintf("%d", u.UserID)
+		return namespacedID(identity.NamespaceUser, u.UserID)
 	case u.IsAnonymous:
-		return identity.NamespaceAnonymous, ""
-	case u.AuthenticatedBy == "render": //import cycle render
-		if u.UserID == 0 {
-			return identity.NamespaceRenderService, "0"
-		} else { // this should never happen as u.UserID > 0 already catches this
-			return identity.NamespaceUser, fmt.Sprintf("%d", u.UserID)
-		}
+		return identity.NamespaceAnonymous + ":"
+	case u.AuthenticatedBy == "render" && u.UserID == 0:
+		return namespacedID(identity.NamespaceRenderService, 0)
 	}
 
 	// backwards compatibility
-	return identity.NamespaceUser, fmt.Sprintf("%d", u.UserID)
+	return namespacedID(identity.NamespaceUser, u.UserID)
+}
+
+// GetNamespacedID returns the namespace and ID of the active entity
+// The namespace is one of the constants defined in pkg/services/auth/identity
+func (u *SignedInUser) GetNamespacedID() (string, string) {
+	parts := strings.Split(u.GetID(), ":")
+	// Safety: GetID always returns a ':' separated string
+	return parts[0], parts[1]
 }
 
 // FIXME: remove this method once all services are using an interface
@@ -238,3 +242,7 @@ func (u *SignedInUser) GetAuthenticatedBy() string {
 func (u *SignedInUser) GetIDToken() string {
 	return u.IDToken
 }
+
+func namespacedID(namespace string, id int64) string {
+	return fmt.Sprintf("%s:%d", namespace, id)
+}