Commit Graph

14 Commits

Author SHA1 Message Date
Karl Persson 16fda6f686 Authz: Setup access claims for service identity (#100986)
* Setup access claims for service identity and add them to identityes without any claims
2025-02-20 13:54:47 +01:00
Karl Persson b16e290444 Auth: Remove feature toggle authAPIAccessTokenAuth (#100055)
Remove feature toggle
2025-02-04 16:31:24 +01:00
colin-stuart 4581a82ac4 Auth: disable passwordless auth if any SAML/OAuth is enabled (#98227)
* Auth: disable passwordless auth if any SAML/OAuth is enabled

* Update pkg/services/authn/authnimpl/registration.go

Co-authored-by: Victor Cinaglia <victor@grafana.com>

* simplify check if any auth providers are enabled

* add accidentally removed break statement, use IsEnabled with empty context to check if PasswordlessMagicLinkAuth enabled

* use IsClientEnabled

* Update pkg/api/frontendsettings.go

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

---------

Co-authored-by: Victor Cinaglia <victor@grafana.com>
Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
2025-01-09 11:44:16 -05:00
Misi 84b8296ffb OAuth: Use the attached external session data in OAuthToken and OAuthTokenSync (#96655)
* wip

* wip + tests

* wip

* wip opt2

* Use authn.Identity struct's SessionToken

* Merge fixes

* Handle disabling the feature flag correctly

* Fix test

* Cleanup

* Remove HasOAuthEntry from the OAuthTokenService interface

* Remove unused function
2024-11-27 11:06:39 +01:00
colin-stuart 6abe99efd6 Auth: Passwordless Login Option Using Magic Links (#95436)
* initial passwordless client

* passwordless login page

* Working basic e2e flow

* Add todo comments

* Improve the passwordless login flow

* improved passwordless login, backend for passwordless signup

* add expiration to emails

* update email templates & render username & name fields on signup

* improve email templates

* change login page text while awaiting passwordless code

* fix merge conflicts

* use claims.TypeUser

* add initial passwordless tests

* better error messages

* simplified error name

* remove completed TODOs

* linting & minor test improvements & rename passwordless routes

* more linting fixes

* move code generation to its own func, use locationService to get query params

* fix ampersand in email templates & use passwordless api routes in LoginCtrl

* txt emails more closely match html email copy

* move passwordless auth behind experimental feature toggle

* fix PasswordlessLogin property failing typecheck

* make update-workspace

* user correct placeholder

* Update emails/templates/passwordless_verify_existing_user.txt

Co-authored-by: Dan Cech <dcech@grafana.com>

* Update emails/templates/passwordless_verify_existing_user.mjml

Co-authored-by: Dan Cech <dcech@grafana.com>

* Update emails/templates/passwordless_verify_new_user.txt

Co-authored-by: Dan Cech <dcech@grafana.com>

* Update emails/templates/passwordless_verify_new_user.txt

Co-authored-by: Dan Cech <dcech@grafana.com>

* Update emails/templates/passwordless_verify_new_user.mjml

Co-authored-by: Dan Cech <dcech@grafana.com>

* use &amp; in email templates

* Update emails/templates/passwordless_verify_existing_user.txt

Co-authored-by: Dan Cech <dcech@grafana.com>

* remove IP address validation

* struct for passwordless settings

* revert go.work.sum changes

* mock locationService.getSearch in failing test

---------

Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
2024-11-14 08:50:55 -05:00
Karl Persson 8d74296b6c Authn: Always set namespace (#96230)
* Rename from AllowedKubernetesNamespace to Namespace

* Use a sync hook to always set namespace for Identity.

* format

* Don't set uid when authenticating as user
2024-11-12 10:12:47 +01:00
Gabriel MABILLE 7ef13497a8 AuthN: Ext JWT support actions (#92486) 2024-09-19 14:25:43 +02:00
Mihai Doarna bbd1611265 SSO: Register LDAP service if LDAP is enabled in SSO settings (#90228)
register LDAP service if LDAP is enabled in SSO settings
2024-07-11 13:53:43 +03:00
Jeff Levin cfe8317d45 Add auth spans and remove deduplication code for scopes (#89804)
Adds more spans for timing in accesscontrol and remove permission deduplicating code after benchmarking

---------

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
Co-authored-by: Dave Henderson <dave.henderson@grafana.com>
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2024-07-02 22:08:57 -08:00
Misi ed6b3e9e7c Auth: Introduce pre-logout hooks + add GCOM LogoutHook (#88475)
* Introduce preLogoutHooks in authn service

* Add gcom_logout_hook

* Config the api token from the Grafana config file

* Simplify

* Add tests for logout hook

* Clean up

* Update

* Address PR comment

* Fix
2024-05-30 15:52:16 +02:00
Karl Persson 5c27f223af Authn: Support access token wildcard namespace (#87816)
* Authn+ExtJWT: allow wildcard namespace for access tokens and restructure validation
2024-05-16 10:47:20 +02:00
Karl Persson 895222725c Session: set authID and authenticatedBy (#85806)
* Authn: Resolve authenticate by and auth id when fethcing signed in user

* Change logout client interface to only take Requester interface

* Session: Fetch external auth info when authenticating sessions

* Use authenticated by from identity

* Move call to get auth-info into session client and use GetAuthenticatedBy in various places
2024-04-11 10:25:29 +02:00
Misi 8796d2d307 Auth: Convert SetDefaultOrgHook to PostLoginHook (#85649)
* Convert SetDefaultOrgHook to PostLoginHook
2024-04-05 16:03:51 +02:00
Karl Persson 504870f10a Auth: Decouple client and hook registration (#85084) 2024-04-04 09:33:00 +02:00