public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OAuth: Add support for new user identity flags for grafana-azure-sdk-go (#98703)

Browse Source 
* added changes for rebase

* ran go mod tidy and ran a build

* ran a build

* Update docs/sources/setup-grafana/configure-grafana/_index.md

Co-authored-by: Jack Baldry <jack.baldry@grafana.com>

* Update docs/sources/setup-grafana/configure-grafana/_index.md

Co-authored-by: Jack Baldry <jack.baldry@grafana.com>

* Update docs/sources/setup-grafana/configure-grafana/_index.md

Co-authored-by: Jack Baldry <jack.baldry@grafana.com>

* updated go.work.sum to upstream

* added newline to match upstream

* added more specificity in documentation

---------

Co-authored-by: Jack Baldry <jack.baldry@grafana.com>
This commit is contained in:
John Naizer
2025-01-24 12:48:27 +00:00
committed by GitHub
co-authored by Jack Baldry
parent 33d82c43df
commit eb2d276a42
7 changed files with 117 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/setting/setting_azure.go
+12
View File
@@ -49,14 +49,20 @@ func (cfg *Cfg) readAzureSettings() {
azureAdSection := cfg.Raw.Section("auth.azuread")
if azureAdSection.Key("enabled").MustBool(false) {
tokenEndpointSettings.TokenUrl = azureAdSection.Key("token_url").String()
tokenEndpointSettings.ClientAuthentication = azureAdSection.Key("client_authentication").String()
tokenEndpointSettings.ClientId = azureAdSection.Key("client_id").String()
tokenEndpointSettings.ClientSecret = azureAdSection.Key("client_secret").String()
tokenEndpointSettings.ManagedIdentityClientId = azureAdSection.Key("managed_identity_client_id").String()
tokenEndpointSettings.FederatedCredentialAudience = azureAdSection.Key("federated_credential_audience").String()
}
// Override individual settings
if val := azureSection.Key("user_identity_token_url").String(); val != "" {
tokenEndpointSettings.TokenUrl = val
}
if val := azureSection.Key("user_identity_client_authentication").String(); val != "" {
tokenEndpointSettings.ClientAuthentication = val
}
if val := azureSection.Key("user_identity_client_id").String(); val != "" {
tokenEndpointSettings.ClientId = val
tokenEndpointSettings.ClientSecret = ""
@@ -64,6 +70,12 @@ func (cfg *Cfg) readAzureSettings() {
if val := azureSection.Key("user_identity_client_secret").String(); val != "" {
tokenEndpointSettings.ClientSecret = val
}
if val := azureSection.Key("user_identity_managed_identity_client_id").String(); val != "" {
tokenEndpointSettings.ManagedIdentityClientId = val
}
if val := azureSection.Key("user_identity_federated_credential_audience").String(); val != "" {
tokenEndpointSettings.FederatedCredentialAudience = val
}
if val := azureSection.Key("username_assertion").String(); val != "" && val == "username" {
tokenEndpointSettings.UsernameAssertion = true
}
pkg/setting/setting_azure_test.go
+33
View File
@@ -145,10 +145,16 @@ func TestAzureSettings(t *testing.T) {
require.NoError(t, err)
_, err = azureAdSection.NewKey("token_url", "URL_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("client_authentication", "METHOD_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("client_id", "ID_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("client_secret", "SECRET_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("managed_identity_client_id", "MANAGED_ID_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("federated_credential_audience", "AUDIENCE_1")
require.NoError(t, err)
azureSection, err := cfg.Raw.NewSection("azure")
require.NoError(t, err)
@@ -161,8 +167,11 @@ func TestAzureSettings(t *testing.T) {
assert.True(t, cfg.Azure.UserIdentityEnabled)
assert.Equal(t, "URL_1", cfg.Azure.UserIdentityTokenEndpoint.TokenUrl)
assert.Equal(t, "METHOD_1", cfg.Azure.UserIdentityTokenEndpoint.ClientAuthentication)
assert.Equal(t, "ID_1", cfg.Azure.UserIdentityTokenEndpoint.ClientId)
assert.Equal(t, "SECRET_1", cfg.Azure.UserIdentityTokenEndpoint.ClientSecret)
assert.Equal(t, "MANAGED_ID_1", cfg.Azure.UserIdentityTokenEndpoint.ManagedIdentityClientId)
assert.Equal(t, "AUDIENCE_1", cfg.Azure.UserIdentityTokenEndpoint.FederatedCredentialAudience)
})
t.Run("should not use token endpoint from Azure AD if not enabled", func(t *testing.T) {
@@ -174,10 +183,16 @@ func TestAzureSettings(t *testing.T) {
require.NoError(t, err)
_, err = azureAdSection.NewKey("token_url", "URL_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("client_authentication", "METHOD_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("client_id", "ID_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("client_secret", "SECRET_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("managed_identity_client_id", "MANAGED_ID_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("federated_credential_audience", "AUDIENCE_1")
require.NoError(t, err)
azureSection, err := cfg.Raw.NewSection("azure")
require.NoError(t, err)
@@ -190,8 +205,11 @@ func TestAzureSettings(t *testing.T) {
assert.True(t, cfg.Azure.UserIdentityEnabled)
assert.Empty(t, cfg.Azure.UserIdentityTokenEndpoint.TokenUrl)
assert.Empty(t, cfg.Azure.UserIdentityTokenEndpoint.ClientAuthentication)
assert.Empty(t, cfg.Azure.UserIdentityTokenEndpoint.ClientId)
assert.Empty(t, cfg.Azure.UserIdentityTokenEndpoint.ClientSecret)
assert.Empty(t, cfg.Azure.UserIdentityTokenEndpoint.ManagedIdentityClientId)
assert.Empty(t, cfg.Azure.UserIdentityTokenEndpoint.FederatedCredentialAudience)
})
t.Run("should override Azure AD settings", func(t *testing.T) {
@@ -203,10 +221,16 @@ func TestAzureSettings(t *testing.T) {
require.NoError(t, err)
_, err = azureAdSection.NewKey("token_url", "URL_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("client_authentication", "METHOD_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("client_id", "ID_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("client_secret", "SECRET_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("managed_identity_client_id", "MANAGED_ID_1")
require.NoError(t, err)
_, err = azureAdSection.NewKey("federated_credential_audience", "AUDIENCE_1")
require.NoError(t, err)
azureSection, err := cfg.Raw.NewSection("azure")
require.NoError(t, err)
@@ -214,10 +238,16 @@ func TestAzureSettings(t *testing.T) {
require.NoError(t, err)
_, err = azureSection.NewKey("user_identity_token_url", "URL_2")
require.NoError(t, err)
_, err = azureSection.NewKey("user_identity_client_authentication", "METHOD_2")
require.NoError(t, err)
_, err = azureSection.NewKey("user_identity_client_id", "ID_2")
require.NoError(t, err)
_, err = azureSection.NewKey("user_identity_client_secret", "SECRET_2")
require.NoError(t, err)
_, err = azureSection.NewKey("user_identity_managed_identity_client_id", "MANAGED_ID_2")
require.NoError(t, err)
_, err = azureSection.NewKey("user_identity_federated_credential_audience", "AUDIENCE_2")
require.NoError(t, err)
cfg.readAzureSettings()
require.NotNil(t, cfg.Azure)
@@ -225,8 +255,11 @@ func TestAzureSettings(t *testing.T) {
assert.True(t, cfg.Azure.UserIdentityEnabled)
assert.Equal(t, "URL_2", cfg.Azure.UserIdentityTokenEndpoint.TokenUrl)
assert.Equal(t, "METHOD_2", cfg.Azure.UserIdentityTokenEndpoint.ClientAuthentication)
assert.Equal(t, "ID_2", cfg.Azure.UserIdentityTokenEndpoint.ClientId)
assert.Equal(t, "SECRET_2", cfg.Azure.UserIdentityTokenEndpoint.ClientSecret)
assert.Equal(t, "MANAGED_ID_2", cfg.Azure.UserIdentityTokenEndpoint.ManagedIdentityClientId)
assert.Equal(t, "AUDIENCE_2", cfg.Azure.UserIdentityTokenEndpoint.FederatedCredentialAudience)
})
t.Run("should not use secret from Azure AD if client ID overridden", func(t *testing.T) {