public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth proxy: Ignore stale cache entries (#23979)

Browse Source 
* Auth proxy: Retry without cache if failing to get user
This commit is contained in:
Arve Knudsen
2020-06-17 18:43:16 +02:00
committed by GitHub
parent 491b8680f7
commit ea2bb7036c
5 changed files with 183 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/middleware/auth_proxy.go
+43 -19
View File
@@ -1,6 +1,8 @@
package middleware
import (
"errors"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/remotecache"
authproxy "github.com/grafana/grafana/pkg/middleware/auth_proxy"
@@ -10,6 +12,18 @@ import (
var header = setting.AuthProxyHeaderName
func logUserIn(auth *authproxy.AuthProxy, username string, logger log.Logger, ignoreCache bool) (int64, *authproxy.Error) {
logger.Debug("Trying to log user in", "username", username, "ignoreCache", ignoreCache)
// Try to log in user via various providers
id, err := auth.Login(logger, ignoreCache)
if err != nil {
logger.Error("Failed to login", "username", username, "message", err.Error(), "error", err.DetailsError,
"ignoreCache", ignoreCache)
return 0, err
}
return id, nil
}
func initContextWithAuthProxy(store *remotecache.RemoteCache, ctx *models.ReqContext, orgID int64) bool {
username := ctx.Req.Header.Get(header)
auth := authproxy.New(&authproxy.Options{
@@ -25,7 +39,7 @@ func initContextWithAuthProxy(store *remotecache.RemoteCache, ctx *models.ReqCon
return false
}
// If the there is no header - we can't move forward
// If there is no header - we can't move forward
if !auth.HasHeader() {
return false
}
@@ -41,37 +55,47 @@ func initContextWithAuthProxy(store *remotecache.RemoteCache, ctx *models.ReqCon
return true
}
// Try to log in user from various providers
id, err := auth.Login()
id, err := logUserIn(auth, username, logger, false)
if err != nil {
logger.Error(
"Failed to login",
"username", username,
"message", err.Error(),
"error", err.DetailsError,
)
ctx.Handle(407, err.Error(), err.DetailsError)
return true
}
// Get full user info
logger.Debug("Got user ID, getting full user info", "userID", id)
user, err := auth.GetSignedUser(id)
if err != nil {
logger.Error(
"Failed to get signed user",
"username", username,
"message", err.Error(),
"error", err.DetailsError,
)
ctx.Handle(407, err.Error(), err.DetailsError)
return true
// The reason we couldn't find the user corresponding to the ID might be that the ID was found from a stale
// cache entry. For example, if a user is deleted via the API, corresponding cache entries aren't invalidated
// because cache keys are computed from request header values and not just the user ID. Meaning that
// we can't easily derive cache keys to invalidate when deleting a user. To work around this, we try to
// log the user in again without the cache.
logger.Debug("Failed to get user info given ID, retrying without cache", "userID", id)
if err := auth.RemoveUserFromCache(logger); err != nil {
if !errors.Is(err, remotecache.ErrCacheItemNotFound) {
logger.Error("Got unexpected error when removing user from auth cache", "error", err)
}
}
id, err = logUserIn(auth, username, logger, true)
if err != nil {
ctx.Handle(407, err.Error(), err.DetailsError)
return true
}
user, err = auth.GetSignedUser(id)
if err != nil {
ctx.Handle(407, err.Error(), err.DetailsError)
return true
}
}
logger.Debug("Successfully got user info", "userID", user.UserId, "username", user.Login)
// Add user info to context
ctx.SignedInUser = user
ctx.IsSignedIn = true
// Remember user data it in cache
// Remember user data in cache
if err := auth.Remember(id); err != nil {
logger.Error(
"Failed to store user in cache",