public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AuthN: New service to support multiple authentication providers for plugins (#75979)

Browse Source 
* OnGoing

* Continue migrating structure

* Comment

* Add intermediary service

* Remove unused error so far

* no need for fmt use errors

* use RoleNone

* Docs

* Fix test

* Accounting for review feedback

* Rename oauthserver.ExternalService to OAuthClient

* Revert as the interface looks weird

* Update pluginintegration

* Rename oauthserver.ExternalService

* closer to what it was before
This commit is contained in:
Gabriel MABILLE
2023-10-05 18:13:06 +02:00
committed by GitHub
parent 03baf210b3
commit e902d8fd10
18 changed files with 369 additions and 256 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/pluginsintegration/serviceregistration/serviceregistration.go
+18 -12
View File
@@ -6,14 +6,14 @@ import (
"github.com/grafana/grafana/pkg/plugins/auth"
"github.com/grafana/grafana/pkg/plugins/plugindef"
"github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/extsvcauth/oauthserver"
"github.com/grafana/grafana/pkg/services/extsvcauth"
)
type Service struct {
os oauthserver.OAuth2Server
os extsvcauth.ExternalServiceRegistry
}
func ProvideService(os oauthserver.OAuth2Server) *Service {
func ProvideService(os extsvcauth.ExternalServiceRegistry) *Service {
s := &Service{
os: os,
}
@@ -22,7 +22,7 @@ func ProvideService(os oauthserver.OAuth2Server) *Service {
// RegisterExternalService is a simplified wrapper around SaveExternalService for the plugin use case.
func (s *Service) RegisterExternalService(ctx context.Context, svcName string, svc *plugindef.ExternalServiceRegistration) (*auth.ExternalService, error) {
impersonation := oauthserver.ImpersonationCfg{}
impersonation := extsvcauth.ImpersonationCfg{}
if svc.Impersonation != nil {
impersonation.Permissions = toAccessControlPermissions(svc.Impersonation.Permissions)
if svc.Impersonation.Enabled != nil {
@@ -37,7 +37,7 @@ func (s *Service) RegisterExternalService(ctx context.Context, svcName string, s
}
}
self := oauthserver.SelfCfg{}
self := extsvcauth.SelfCfg{}
if svc.Self != nil {
self.Permissions = toAccessControlPermissions(svc.Self.Permissions)
if svc.Self.Enabled != nil {
@@ -46,21 +46,27 @@ func (s *Service) RegisterExternalService(ctx context.Context, svcName string, s
self.Enabled = true
}
}
extSvc, err := s.os.SaveExternalService(ctx, &oauthserver.ExternalServiceRegistration{
Name: svcName,
Impersonation: impersonation,
Self: self,
Key: &oauthserver.KeyOption{Generate: true},
extSvc, err := s.os.SaveExternalService(ctx, &extsvcauth.ExternalServiceRegistration{
Name: svcName,
Impersonation: impersonation,
Self: self,
AuthProvider: extsvcauth.OAuth2Server,
OAuthProviderCfg: &extsvcauth.OAuthProviderCfg{Key: &extsvcauth.KeyOption{Generate: true}},
})
if err != nil {
return nil, err
}
privateKey := ""
if extSvc.OAuthExtra != nil {
privateKey = extSvc.OAuthExtra.KeyResult.PrivatePem
}
return &auth.ExternalService{
ClientID: extSvc.ID,
ClientSecret: extSvc.Secret,
PrivateKey: extSvc.KeyResult.PrivatePem,
}, nil
PrivateKey: privateKey}, nil
}
func toAccessControlPermissions(ps []plugindef.Permission) []accesscontrol.Permission {