public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auth: Add support for forcing authentication in anonymous mode and modify SignIn to use it instead of redirect (#25567)

Browse Source 
* Forbid additional redirect urls

* Optionally force login in anonymous mode

* Update LoginCtrl page to ignore redirect parameter

* Modify SignIn to set forceLogin query instead of redirect

* Pass appUrl to frontend and use URL API for updating url query

* Apply suggestions from code review

Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>

* Fix SignIn test

Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>
This commit is contained in:
Sofia Papagiannaki
2020-06-16 16:33:44 +03:00
committed by GitHub
co-authored by Arve Knudsen
parent b4136c1eca
commit fefbbc65a8
10 changed files with 133 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/middleware/auth.go
+12 -2
View File
@@ -51,8 +51,16 @@ func notAuthorized(c *models.ReqContext) {
if setting.AppSubUrl != "" && !strings.HasPrefix(redirectTo, setting.AppSubUrl) {
redirectTo = setting.AppSubUrl + c.Req.RequestURI
}
WriteCookie(c.Resp, "redirect_to", url.QueryEscape(redirectTo), 0, newCookieOptions)
// remove forceLogin query param if it exists
if parsed, err := url.ParseRequestURI(redirectTo); err == nil {
params := parsed.Query()
params.Del("forceLogin")
parsed.RawQuery = params.Encode()
WriteCookie(c.Resp, "redirect_to", url.QueryEscape(parsed.String()), 0, newCookieOptions)
} else {
c.Logger.Debug("Failed parsing request URI; redirect cookie will not be set", "redirectTo", redirectTo, "error", err)
}
c.Redirect(setting.AppSubUrl + "/login")
}
@@ -79,7 +87,9 @@ func RoleAuth(roles ...models.RoleType) macaron.Handler {
func Auth(options *AuthOptions) macaron.Handler {
return func(c *models.ReqContext) {
if !c.IsSignedIn && options.ReqSignedIn && !c.AllowAnonymous {
forceLogin := c.AllowAnonymous && c.QueryBool("forceLogin")
requireLogin := !c.AllowAnonymous || forceLogin
if !c.IsSignedIn && options.ReqSignedIn && requireLogin {
notAuthorized(c)
return
}