public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: creates a hook in the user mapping flow (#37190)

Browse Source 
* wip

* Auth Info: refactored out into it's own service

* Auth: adds extension point where users are being mapped

* Update pkg/services/login/authinfoservice/service.go

Co-authored-by: Joan López de la Franca Beltran <joanjan14@gmail.com>

* Update pkg/services/login/authinfoservice/service.go

Co-authored-by: Joan López de la Franca Beltran <joanjan14@gmail.com>

* Auth: simplified code

* moved most authinfo stuff to its own package

* added back code

* linter

* simplified

Co-authored-by: Joan López de la Franca Beltran <joanjan14@gmail.com>
This commit is contained in:
Leonard Gram
2021-07-29 10:18:42 +02:00
committed by GitHub
co-authored by Joan López de la Franca Beltran
parent 4f340550ee
commit d51b2630c7
13 changed files with 374 additions and 351 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/sqlstore/team_test.go
-3
View File
@@ -90,8 +90,6 @@ func TestTeamCommandsAndQueries(t *testing.T) {
Convey("Should return latest auth module for users when getting team members", func() {
userId := userIds[1]
err := SetAuthInfo(&models.SetAuthInfoCommand{UserId: userId, AuthModule: "oauth_github", AuthId: "1234567"})
So(err, ShouldBeNil)
teamQuery := &models.SearchTeamsQuery{OrgId: testOrgID, Name: "group1 name", Page: 1, Limit: 10}
err = SearchTeams(teamQuery)
@@ -111,7 +109,6 @@ func TestTeamCommandsAndQueries(t *testing.T) {
So(memberQuery.Result[0].Login, ShouldEqual, "loginuser1")
So(memberQuery.Result[0].OrgId, ShouldEqual, testOrgID)
So(memberQuery.Result[0].External, ShouldEqual, true)
So(memberQuery.Result[0].AuthModule, ShouldEqual, "oauth_github")
})
Convey("Should be able to update users in a team", func() {
pkg/services/sqlstore/user_auth.go
-297
View File
@@ -1,297 +0,0 @@
package sqlstore
import (
"encoding/base64"
"errors"
"time"
"github.com/grafana/grafana/pkg/bus"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/setting"
"github.com/grafana/grafana/pkg/util"
)
var getTime = time.Now
const genericOAuthModule = "oauth_generic_oauth"
func init() {
bus.AddHandler("sql", GetUserByAuthInfo)
bus.AddHandler("sql", GetExternalUserInfoByLogin)
bus.AddHandler("sql", GetAuthInfo)
bus.AddHandler("sql", SetAuthInfo)
bus.AddHandler("sql", UpdateAuthInfo)
bus.AddHandler("sql", DeleteAuthInfo)
}
func GetUserByAuthInfo(query *models.GetUserByAuthInfoQuery) error {
user := &models.User{}
has := false
var err error
authQuery := &models.GetAuthInfoQuery{}
// Try to find the user by auth module and id first
if query.AuthModule != "" && query.AuthId != "" {
authQuery.AuthModule = query.AuthModule
authQuery.AuthId = query.AuthId
err = GetAuthInfo(authQuery)
if !errors.Is(err, models.ErrUserNotFound) {
if err != nil {
return err
}
// if user id was specified and doesn't match the user_auth entry, remove it
if query.UserId != 0 && query.UserId != authQuery.Result.UserId {
err = DeleteAuthInfo(&models.DeleteAuthInfoCommand{
UserAuth: authQuery.Result,
})
if err != nil {
sqlog.Error("Error removing user_auth entry", "error", err)
}
authQuery.Result = nil
} else {
has, err = x.Id(authQuery.Result.UserId).Get(user)
if err != nil {
return err
}
if !has {
// if the user has been deleted then remove the entry
err = DeleteAuthInfo(&models.DeleteAuthInfoCommand{
UserAuth: authQuery.Result,
})
if err != nil {
sqlog.Error("Error removing user_auth entry", "error", err)
}
authQuery.Result = nil
}
}
}
}
// If not found, try to find the user by id
if !has && query.UserId != 0 {
has, err = x.Id(query.UserId).Get(user)
if err != nil {
return err
}
}
// If not found, try to find the user by email address
if !has && query.Email != "" {
user = &models.User{Email: query.Email}
has, err = x.Get(user)
if err != nil {
return err
}
}
// If not found, try to find the user by login
if !has && query.Login != "" {
user = &models.User{Login: query.Login}
has, err = x.Get(user)
if err != nil {
return err
}
}
// No user found
if !has {
return models.ErrUserNotFound
}
// Special case for generic oauth duplicates
if query.AuthModule == genericOAuthModule && user.Id != 0 {
authQuery.UserId = user.Id
authQuery.AuthModule = query.AuthModule
err = GetAuthInfo(authQuery)
if !errors.Is(err, models.ErrUserNotFound) {
if err != nil {
return err
}
}
}
if authQuery.Result == nil && query.AuthModule != "" {
cmd2 := &models.SetAuthInfoCommand{
UserId: user.Id,
AuthModule: query.AuthModule,
AuthId: query.AuthId,
}
if err := SetAuthInfo(cmd2); err != nil {
return err
}
}
query.Result = user
return nil
}
func GetExternalUserInfoByLogin(query *models.GetExternalUserInfoByLoginQuery) error {
userQuery := models.GetUserByLoginQuery{LoginOrEmail: query.LoginOrEmail}
err := bus.Dispatch(&userQuery)
if err != nil {
return err
}
authInfoQuery := &models.GetAuthInfoQuery{UserId: userQuery.Result.Id}
if err := bus.Dispatch(authInfoQuery); err != nil {
return err
}
query.Result = &models.ExternalUserInfo{
UserId: userQuery.Result.Id,
Login: userQuery.Result.Login,
Email: userQuery.Result.Email,
Name: userQuery.Result.Name,
IsDisabled: userQuery.Result.IsDisabled,
AuthModule: authInfoQuery.Result.AuthModule,
AuthId: authInfoQuery.Result.AuthId,
}
return nil
}
func GetAuthInfo(query *models.GetAuthInfoQuery) error {
userAuth := &models.UserAuth{
UserId: query.UserId,
AuthModule: query.AuthModule,
AuthId: query.AuthId,
}
has, err := x.Desc("created").Get(userAuth)
if err != nil {
return err
}
if !has {
return models.ErrUserNotFound
}
secretAccessToken, err := decodeAndDecrypt(userAuth.OAuthAccessToken)
if err != nil {
return err
}
secretRefreshToken, err := decodeAndDecrypt(userAuth.OAuthRefreshToken)
if err != nil {
return err
}
secretTokenType, err := decodeAndDecrypt(userAuth.OAuthTokenType)
if err != nil {
return err
}
userAuth.OAuthAccessToken = secretAccessToken
userAuth.OAuthRefreshToken = secretRefreshToken
userAuth.OAuthTokenType = secretTokenType
query.Result = userAuth
return nil
}
func SetAuthInfo(cmd *models.SetAuthInfoCommand) error {
return inTransaction(func(sess *DBSession) error {
authUser := &models.UserAuth{
UserId: cmd.UserId,
AuthModule: cmd.AuthModule,
AuthId: cmd.AuthId,
Created: getTime(),
}
if cmd.OAuthToken != nil {
secretAccessToken, err := encryptAndEncode(cmd.OAuthToken.AccessToken)
if err != nil {
return err
}
secretRefreshToken, err := encryptAndEncode(cmd.OAuthToken.RefreshToken)
if err != nil {
return err
}
secretTokenType, err := encryptAndEncode(cmd.OAuthToken.TokenType)
if err != nil {
return err
}
authUser.OAuthAccessToken = secretAccessToken
authUser.OAuthRefreshToken = secretRefreshToken
authUser.OAuthTokenType = secretTokenType
authUser.OAuthExpiry = cmd.OAuthToken.Expiry
}
_, err := sess.Insert(authUser)
return err
})
}
func UpdateAuthInfo(cmd *models.UpdateAuthInfoCommand) error {
return inTransaction(func(sess *DBSession) error {
authUser := &models.UserAuth{
UserId: cmd.UserId,
AuthModule: cmd.AuthModule,
AuthId: cmd.AuthId,
Created: getTime(),
}
if cmd.OAuthToken != nil {
secretAccessToken, err := encryptAndEncode(cmd.OAuthToken.AccessToken)
if err != nil {
return err
}
secretRefreshToken, err := encryptAndEncode(cmd.OAuthToken.RefreshToken)
if err != nil {
return err
}
secretTokenType, err := encryptAndEncode(cmd.OAuthToken.TokenType)
if err != nil {
return err
}
authUser.OAuthAccessToken = secretAccessToken
authUser.OAuthRefreshToken = secretRefreshToken
authUser.OAuthTokenType = secretTokenType
authUser.OAuthExpiry = cmd.OAuthToken.Expiry
}
cond := &models.UserAuth{
UserId: cmd.UserId,
AuthModule: cmd.AuthModule,
}
upd, err := sess.Update(authUser, cond)
sqlog.Debug("Updated user_auth", "user_id", cmd.UserId, "auth_module", cmd.AuthModule, "rows", upd)
return err
})
}
func DeleteAuthInfo(cmd *models.DeleteAuthInfoCommand) error {
return inTransaction(func(sess *DBSession) error {
_, err := sess.Delete(cmd.UserAuth)
return err
})
}
// decodeAndDecrypt will decode the string with the standard bas64 decoder
// and then decrypt it with grafana's secretKey
func decodeAndDecrypt(s string) (string, error) {
// Bail out if empty string since it'll cause a segfault in util.Decrypt
if s == "" {
return "", nil
}
decoded, err := base64.StdEncoding.DecodeString(s)
if err != nil {
return "", err
}
decrypted, err := util.Decrypt(decoded, setting.SecretKey)
if err != nil {
return "", err
}
return string(decrypted), nil
}
// encryptAndEncode will encrypt a string with grafana's secretKey, and
// then encode it with the standard bas64 encoder
func encryptAndEncode(s string) (string, error) {
encrypted, err := util.Encrypt([]byte(s), setting.SecretKey)
if err != nil {
return "", err
}
return base64.StdEncoding.EncodeToString(encrypted), nil
}
pkg/services/sqlstore/user_auth_test.go
-248
View File
@@ -1,248 +0,0 @@
// +build integration
package sqlstore
import (
"context"
"fmt"
"github.com/stretchr/testify/require"
"testing"
"time"
"github.com/grafana/grafana/pkg/models"
"golang.org/x/oauth2"
)
//nolint:goconst
func TestUserAuth(t *testing.T) {
sqlStore := InitTestDB(t)
t.Run("Given 5 users", func(t *testing.T) {
for i := 0; i < 5; i++ {
cmd := models.CreateUserCommand{
Email: fmt.Sprint("user", i, "@test.com"),
Name: fmt.Sprint("user", i),
Login: fmt.Sprint("loginuser", i),
}
_, err := sqlStore.CreateUser(context.Background(), cmd)
require.Nil(t, err)
}
t.Run("Can find existing user", func(t *testing.T) {
// By Login
login := "loginuser0"
query := &models.GetUserByAuthInfoQuery{Login: login}
err := GetUserByAuthInfo(query)
require.Nil(t, err)
require.Equal(t, query.Result.Login, login)
// By ID
id := query.Result.Id
query = &models.GetUserByAuthInfoQuery{UserId: id}
err = GetUserByAuthInfo(query)
require.Nil(t, err)
require.Equal(t, query.Result.Id, id)
// By Email
email := "user1@test.com"
query = &models.GetUserByAuthInfoQuery{Email: email}
err = GetUserByAuthInfo(query)
require.Nil(t, err)
require.Equal(t, query.Result.Email, email)
// Don't find nonexistent user
email = "nonexistent@test.com"
query = &models.GetUserByAuthInfoQuery{Email: email}
err = GetUserByAuthInfo(query)
require.Equal(t, err, models.ErrUserNotFound)
require.Nil(t, query.Result)
})
t.Run("Can set & locate by AuthModule and AuthId", func(t *testing.T) {
// get nonexistent user_auth entry
query := &models.GetUserByAuthInfoQuery{AuthModule: "test", AuthId: "test"}
err := GetUserByAuthInfo(query)
require.Equal(t, err, models.ErrUserNotFound)
require.Nil(t, query.Result)
// create user_auth entry
login := "loginuser0"
query.Login = login
err = GetUserByAuthInfo(query)
require.Nil(t, err)
require.Equal(t, query.Result.Login, login)
// get via user_auth
query = &models.GetUserByAuthInfoQuery{AuthModule: "test", AuthId: "test"}
err = GetUserByAuthInfo(query)
require.Nil(t, err)
require.Equal(t, query.Result.Login, login)
// get with non-matching id
id := query.Result.Id
query.UserId = id + 1
err = GetUserByAuthInfo(query)
require.Nil(t, err)
require.Equal(t, query.Result.Login, "loginuser1")
// get via user_auth
query = &models.GetUserByAuthInfoQuery{AuthModule: "test", AuthId: "test"}
err = GetUserByAuthInfo(query)
require.Nil(t, err)
require.Equal(t, query.Result.Login, "loginuser1")
// remove user
_, err = x.Exec("DELETE FROM "+dialect.Quote("user")+" WHERE id=?", query.Result.Id)
require.Nil(t, err)
// get via user_auth for deleted user
query = &models.GetUserByAuthInfoQuery{AuthModule: "test", AuthId: "test"}
err = GetUserByAuthInfo(query)
require.Equal(t, err, models.ErrUserNotFound)
require.Nil(t, query.Result)
})
t.Run("Can set & retrieve oauth token information", func(t *testing.T) {
token := &oauth2.Token{
AccessToken: "testaccess",
RefreshToken: "testrefresh",
Expiry: time.Now(),
TokenType: "Bearer",
}
// Find a user to set tokens on
login := "loginuser0"
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "test", AuthId: "test"}
err := GetUserByAuthInfo(query)
require.Nil(t, err)
require.Equal(t, query.Result.Login, login)
cmd := &models.UpdateAuthInfoCommand{
UserId: query.Result.Id,
AuthId: query.AuthId,
AuthModule: query.AuthModule,
OAuthToken: token,
}
err = UpdateAuthInfo(cmd)
require.Nil(t, err)
getAuthQuery := &models.GetAuthInfoQuery{
UserId: query.Result.Id,
}
err = GetAuthInfo(getAuthQuery)
require.Nil(t, err)
require.Equal(t, getAuthQuery.Result.OAuthAccessToken, token.AccessToken)
require.Equal(t, getAuthQuery.Result.OAuthRefreshToken, token.RefreshToken)
require.Equal(t, getAuthQuery.Result.OAuthTokenType, token.TokenType)
})
t.Run("Always return the most recently used auth_module", func(t *testing.T) {
// Restore after destructive operation
sqlStore = InitTestDB(t)
for i := 0; i < 5; i++ {
cmd := models.CreateUserCommand{
Email: fmt.Sprint("user", i, "@test.com"),
Name: fmt.Sprint("user", i),
Login: fmt.Sprint("loginuser", i),
}
_, err := sqlStore.CreateUser(context.Background(), cmd)
require.Nil(t, err)
}
// Find a user to set tokens on
login := "loginuser0"
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
// Make the first log-in during the past
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "test1", AuthId: "test1"}
err := GetUserByAuthInfo(query)
getTime = time.Now
require.Nil(t, err)
require.Equal(t, query.Result.Login, login)
// Add a second auth module for this user
// Have this module's last log-in be more recent
getTime = func() time.Time { return time.Now().AddDate(0, 0, -1) }
query = &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "test2", AuthId: "test2"}
err = GetUserByAuthInfo(query)
getTime = time.Now
require.Nil(t, err)
require.Equal(t, query.Result.Login, login)
// Get the latest entry by not supply an authmodule or authid
getAuthQuery := &models.GetAuthInfoQuery{
UserId: query.Result.Id,
}
err = GetAuthInfo(getAuthQuery)
require.Nil(t, err)
require.Equal(t, getAuthQuery.Result.AuthModule, "test2")
// "log in" again with the first auth module
updateAuthCmd := &models.UpdateAuthInfoCommand{UserId: query.Result.Id, AuthModule: "test1", AuthId: "test1"}
err = UpdateAuthInfo(updateAuthCmd)
require.Nil(t, err)
// Get the latest entry by not supply an authmodule or authid
getAuthQuery = &models.GetAuthInfoQuery{
UserId: query.Result.Id,
}
err = GetAuthInfo(getAuthQuery)
require.Nil(t, err)
require.Equal(t, getAuthQuery.Result.AuthModule, "test1")
})
t.Run("Can set & locate by generic oauth auth module and user id", func(t *testing.T) {
// Find a user to set tokens on
login := "loginuser0"
// Expect to pass since there's a matching login user
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: genericOAuthModule, AuthId: ""}
err := GetUserByAuthInfo(query)
getTime = time.Now
require.Nil(t, err)
require.Equal(t, query.Result.Login, login)
// Should throw a "user not found" error since there's no matching login user
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
query = &models.GetUserByAuthInfoQuery{Login: "aloginuser", AuthModule: genericOAuthModule, AuthId: ""}
err = GetUserByAuthInfo(query)
getTime = time.Now
require.NotNil(t, err)
require.Nil(t, query.Result)
})
})
}
pkg/services/sqlstore/user_test.go
+1 -145
View File
@@ -6,7 +6,6 @@ import (
"context"
"fmt"
"testing"
"time"
"github.com/grafana/grafana/pkg/models"
"github.com/grafana/grafana/pkg/setting"
@@ -119,7 +118,7 @@ func TestUserDataAccess(t *testing.T) {
t.Run("Testing DB - multiple users", func(t *testing.T) {
ss = InitTestDB(t)
users := createFiveTestUsers(t, ss, func(i int) *models.CreateUserCommand {
createFiveTestUsers(t, ss, func(i int) *models.CreateUserCommand {
return &models.CreateUserCommand{
Email: fmt.Sprint("user", i, "@test.com"),
Name: fmt.Sprint("user", i),
@@ -188,48 +187,6 @@ func TestUserDataAccess(t *testing.T) {
require.Nil(t, err)
require.Len(t, query.Result.Users, 1)
require.EqualValues(t, query.Result.TotalCount, 1)
// Return list users based on their auth type
for index, user := range users {
authModule := "killa"
// define every second user as ldap
if index%2 == 0 {
authModule = "ldap"
}
cmd2 := &models.SetAuthInfoCommand{
UserId: user.Id,
AuthModule: authModule,
AuthId: "gorilla",
}
err := SetAuthInfo(cmd2)
require.Nil(t, err)
}
query = models.SearchUsersQuery{AuthModule: "ldap"}
err = SearchUsers(&query)
require.Nil(t, err)
require.Len(t, query.Result.Users, 3)
zero, second, fourth := false, false, false
for _, user := range query.Result.Users {
if user.Name == "user0" {
zero = true
}
if user.Name == "user2" {
second = true
}
if user.Name == "user4" {
fourth = true
}
}
require.True(t, zero)
require.True(t, second)
require.True(t, fourth)
})
t.Run("Testing DB - return list users based on their is_disabled flag", func(t *testing.T) {
@@ -490,107 +447,6 @@ func TestUserDataAccess(t *testing.T) {
IsDisabled: false,
}
})
// Find a user to set tokens on
login := "loginuser0"
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
// Make the first log-in during the past
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
query := &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "ldap", AuthId: "ldap0"}
err := GetUserByAuthInfo(query)
getTime = time.Now
require.Nil(t, err)
require.Equal(t, query.Result.Login, login)
// Add a second auth module for this user
// Have this module's last log-in be more recent
getTime = func() time.Time { return time.Now().AddDate(0, 0, -1) }
query = &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "oauth", AuthId: "oauth0"}
err = GetUserByAuthInfo(query)
getTime = time.Now
require.Nil(t, err)
require.Equal(t, query.Result.Login, login)
// Return the only most recently used auth_module
searchUserQuery := &models.SearchUsersQuery{}
err = SearchUsers(searchUserQuery)
require.Nil(t, err)
require.Len(t, searchUserQuery.Result.Users, 5)
for _, user := range searchUserQuery.Result.Users {
if user.Login == login {
require.Len(t, user.AuthModule, 1)
require.Equal(t, user.AuthModule[0], "oauth")
}
}
// "log in" again with the first auth module
updateAuthCmd := &models.UpdateAuthInfoCommand{UserId: query.Result.Id, AuthModule: "ldap", AuthId: "ldap1"}
err = UpdateAuthInfo(updateAuthCmd)
require.Nil(t, err)
searchUserQuery = &models.SearchUsersQuery{}
err = SearchUsers(searchUserQuery)
require.Nil(t, err)
for _, user := range searchUserQuery.Result.Users {
if user.Login == login {
require.Len(t, user.AuthModule, 1)
require.Equal(t, user.AuthModule[0], "ldap")
}
}
// Re-init DB
ss = InitTestDB(t)
createFiveTestUsers(t, ss, func(i int) *models.CreateUserCommand {
return &models.CreateUserCommand{
Email: fmt.Sprint("user", i, "@test.com"),
Name: fmt.Sprint("user", i),
Login: fmt.Sprint("loginuser", i),
IsDisabled: false,
}
})
// Search LDAP users
for i := 0; i < 5; i++ {
// Find a user to set tokens on
login = fmt.Sprint("loginuser", i)
// Calling GetUserByAuthInfoQuery on an existing user will populate an entry in the user_auth table
// Make the first log-in during the past
getTime = func() time.Time { return time.Now().AddDate(0, 0, -2) }
query = &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "ldap", AuthId: fmt.Sprint("ldap", i)}
err = GetUserByAuthInfo(query)
getTime = time.Now
require.Nil(t, err)
require.Equal(t, query.Result.Login, login)
}
// Log in first user with oauth
login = "loginuser0"
getTime = func() time.Time { return time.Now().AddDate(0, 0, -1) }
query = &models.GetUserByAuthInfoQuery{Login: login, AuthModule: "oauth", AuthId: "oauth0"}
err = GetUserByAuthInfo(query)
getTime = time.Now
require.Nil(t, err)
require.Equal(t, query.Result.Login, login)
// Should only return users recently logged in with ldap when filtered by ldap auth module
searchUserQuery = &models.SearchUsersQuery{AuthModule: "ldap"}
err = SearchUsers(searchUserQuery)
require.Nil(t, err)
require.Len(t, searchUserQuery.Result.Users, 4)
for _, user := range searchUserQuery.Result.Users {
if user.Login == login {
require.Len(t, user.AuthModule, 1)
require.Equal(t, user.AuthModule[0], "ldap")
}
}
})
t.Run("Testing DB - grafana admin users", func(t *testing.T) {