public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SCIM: Add access control for non provisioned users (#103596)

Browse Source 
* Add hook to validate access for users based on provisioning logic

* Wire the hook

* Add tests

* declare new variables for errors

* rework the authorization flow for provisioned users

* Add scim feature to testinfra opts

* Grant access if the identity doesn't have associated a user

* skip external uid check for subsequent calls

* Update tests
This commit is contained in:
linoman
2025-04-08 22:50:39 +02:00
committed by GitHub
parent b631d904ae
commit eeb4c045d3
4 changed files with 375 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/authnimpl/registration.go
+3 -2
View File
@@ -131,11 +131,12 @@ func ProvideRegistration(
}
// FIXME (jguer): move to User package
userSync := sync.ProvideUserSync(userService, userProtectionService, authInfoService, quotaService, tracer, features)
userSync := sync.ProvideUserSync(userService, userProtectionService, authInfoService, quotaService, tracer, features, cfg)
orgSync := sync.ProvideOrgSync(userService, orgService, accessControlService, cfg, tracer)
authnSvc.RegisterPostAuthHook(userSync.SyncUserHook, 10)
authnSvc.RegisterPostAuthHook(userSync.EnableUserHook, 20)
authnSvc.RegisterPostAuthHook(orgSync.SyncOrgRolesHook, 30)
authnSvc.RegisterPostAuthHook(userSync.ValidateUserProvisioningHook, 30)
authnSvc.RegisterPostAuthHook(orgSync.SyncOrgRolesHook, 40)
authnSvc.RegisterPostAuthHook(userSync.SyncLastSeenHook, 130)
authnSvc.RegisterPostAuthHook(sync.ProvideOAuthTokenSync(oauthTokenService, sessionService, socialService, tracer, features).SyncOauthTokenHook, 60)
authnSvc.RegisterPostAuthHook(userSync.FetchSyncedUserHook, 100)