Commit Graph
131 Commits
Author SHA1 Message Date
Misi 84b8296ffb OAuth: Use the attached external session data in OAuthToken and OAuthTokenSync (#96655)
* wip

* wip + tests

* wip

* wip opt2

* Use authn.Identity struct's SessionToken

* Merge fixes

* Handle disabling the feature flag correctly

* Fix test

* Cleanup

* Remove HasOAuthEntry from the OAuthTokenService interface

* Remove unused function
2024-11-27 11:06:39 +01:00
6abe99efd6 Auth: Passwordless Login Option Using Magic Links (#95436)
* initial passwordless client

* passwordless login page

* Working basic e2e flow

* Add todo comments

* Improve the passwordless login flow

* improved passwordless login, backend for passwordless signup

* add expiration to emails

* update email templates & render username & name fields on signup

* improve email templates

* change login page text while awaiting passwordless code

* fix merge conflicts

* use claims.TypeUser

* add initial passwordless tests

* better error messages

* simplified error name

* remove completed TODOs

* linting & minor test improvements & rename passwordless routes

* more linting fixes

* move code generation to its own func, use locationService to get query params

* fix ampersand in email templates & use passwordless api routes in LoginCtrl

* txt emails more closely match html email copy

* move passwordless auth behind experimental feature toggle

* fix PasswordlessLogin property failing typecheck

* make update-workspace

* user correct placeholder

* Update emails/templates/passwordless_verify_existing_user.txt

Co-authored-by: Dan Cech <dcech@grafana.com>

* Update emails/templates/passwordless_verify_existing_user.mjml

Co-authored-by: Dan Cech <dcech@grafana.com>

* Update emails/templates/passwordless_verify_new_user.txt

Co-authored-by: Dan Cech <dcech@grafana.com>

* Update emails/templates/passwordless_verify_new_user.txt

Co-authored-by: Dan Cech <dcech@grafana.com>

* Update emails/templates/passwordless_verify_new_user.mjml

Co-authored-by: Dan Cech <dcech@grafana.com>

* use &amp; in email templates

* Update emails/templates/passwordless_verify_existing_user.txt

Co-authored-by: Dan Cech <dcech@grafana.com>

* remove IP address validation

* struct for passwordless settings

* revert go.work.sum changes

* mock locationService.getSearch in failing test

---------

Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com>
Co-authored-by: Dan Cech <dcech@grafana.com>
2024-11-14 08:50:55 -05:00
Jo ddf766567b RemoteCache: Refactor remote cache settings (#95672)
* refactor remote cache settings

* fix cache error getting treating as application error

* fix cache error getting treating as application error
2024-11-04 17:35:31 +01:00
linomanandMihaly Gyongyosi 21d26de4d8 Session Refactor: Add SAMLSession (#94490)
* add saml session struct

* resolve saml session

* Add NameID

---------

Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com>
2024-10-10 16:57:34 +02:00
Ryan McKinley 99d8025829 Chore: Move identity and errutil to apimachinery module (#89116) 2024-06-13 07:11:35 +03:00
Karl Persson 8520892923 User: Fix GetByID (#86282)
* Auth: Remove unused lookup param

* Remove case sensitive lookup for GetByID
2024-04-16 15:24:34 +02:00
Eric Leijonmarck bb792ff540 Auth: Remove oauth skip org role sync (#84972)
* remove oauth wide skip org role sync

* we are warning from config

* set it to false

* removed from config ini files and updated docs
2024-03-22 15:34:05 +01:00
Jo 6f62d970e3 JWT Authentication: Add support for specifying groups in auth.jwt for teamsync (#82175)
* merge JSON search logic

* document public methods

* improve test coverage

* use separate JWT setting struct

* correct use of cfg.JWTAuth

* add group tests

* fix DynMap typing

* add settings to default ini

* add groups option to devenv path

* fix test

* lint

* revert jwt-proxy change

* remove redundant check

* fix parallel test
2024-02-09 16:35:58 +01:00
Dan Cech 790e1feb93 Chore: Update test database initialization (#81673)
* streamline initialization of test databases, support on-disk sqlite test db

* clean up test databases

* introduce testsuite helper

* use testsuite everywhere we use a test db

* update documentation

* improve error handling

* disable entity integration test until we can figure out locking error
2024-02-09 09:35:39 -05:00
Jo f3f36e37fa AuthInfo: No mandatory auth_id in Auth Info service (#81335)
* fix auth info update not having mandatory auth_id

* remove uneeded newline
2024-01-26 11:54:00 +01:00
Jo 9f5a8bf926 AuthInfo: Revert #81013. Fix cache invalidation (#81050)
* Revert "Auth: Revert "Auth: Cache Auth Info" (#81013)"

This reverts commit ce84f7c540.

* fix cache invalidation during user takeover

* fix incomplete test
2024-01-23 15:26:38 +01:00
Misi ce84f7c540 Auth: Revert "Auth: Cache Auth Info" (#81013)
Revert "Auth: Cache Auth Info"
2024-01-22 21:25:24 +02:00
Jo c767481dee Auth: Cache Auth Info (#80620)
* leverage cache for auth info

* fix tests and integration

* fix panic

* fix panic
2024-01-18 15:22:19 +01:00
Misi ce1450d4d3 Chore: Configure SkipOrgRoleSync from OAuthInfo for OAuth connectors (#79443)
* Configure SkipOrgRoleSync from OAuthInfo

* Remove skipOrgRoleSync from socialbase and connectors

* Add test to socialimpl.ProvideService

* Deprecate AuthSettings' fields

* clean up misleading init of frontendsettings.Auth
2023-12-15 10:58:08 +01:00
Karl Persson 1eb19befaa Login: refactor auth info package (#78459)
* Remove unused stats and metrics

* No longer collect metrics

* Remove unused dependency

* Move database from sub package
2023-11-21 14:47:23 +01:00
Karl Persson d42201dbf4 Login: remove unused function (#78442)
* Move test to the db so we test the queries and not just testing the mock

* Remove unused function and dependencies

* Remove unused functions from the database

* Add some integration tests
2023-11-21 11:44:13 +01:00
Karl PerssonandGabriel MABILLE 72db9739c7 UserAuth: clean-up auth entries on update (#78377)
* UserAuth: clean-up auth entries on update

* Update pkg/services/login/authinfoservice/database/database.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2023-11-20 14:58:32 +01:00
Karl Persson a929e3f2cf Auth: Remove unused function (#78332)
Remove unused function
2023-11-17 17:07:39 +01:00
Ryan McKinley 025b2f3011 Chore: use any rather than interface{} (#74066) 2023-08-30 18:46:47 +03:00
Karl Persson 618daf0518 Login: remove login.Service (#73542) 2023-08-21 13:15:31 +02:00
Ieva 3a2538c2ca Auth: lock down Grafana admin sync for SAML (#72828)
lock down Grafana admin sync for SAML
2023-08-03 18:02:40 +02:00
Ieva d3b481dac8 Auth: Lock down Grafana admin role updates if the role is externally synced (#72677)
* lock down server admin role updates on the frontend if the user is externally synced

* add tests

* lock Grafana Server admin role updates from the backend

* rename variables

* check that the user has auth info

* add LDAP to providers for which Grafana Server admin role can be synced

* linting
2023-08-01 16:39:08 +01:00
Ieva 59eb2f68b7 AuthN: Lock down manual role updates for users synced through Grafana Com portal (#72044)
take into account auth.grafananet config section when checking if gcom auth is enabled
2023-07-21 15:22:28 +01:00
MisiandGabriel MABILLE 5efc3386d3 AuthZ: Extend /api/search to work with self-contained permissions (#70749)
* Search sql filter draft, unfinished

* Search works for empty roles

* Add current AuthModule to SignedInUser

* clean up, changes to the search

* Use constant prefixes

* Change AuthModule to AuthenticatedBy

* Add tests for using the permissions from the SignedInUser

* Refactor and simplify code

* Fix sql generation for pg and mysql

* Fixes, clean up

* Add test for empty permission list

* Fix

* Fix any vs all in case of edit permission

* Update pkg/services/authn/authn.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Update pkg/services/sqlstore/permissions/dashboard_test.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Fixes, changes based on the review

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2023-07-12 12:31:36 +02:00
Jo 932c24986d Auth: Resolve isGrafanaAdmin for debug logging (#71145)
resolve isGrafanaAdmin for debug logging
2023-07-10 11:14:51 +02:00
Jo 26b66fda4b Auth: Support Gitlab OIDC scopes (#69890)
* draft gitlab openid

* mutualize id token extraction

* unexport fields

* user user info endpoint for retrieving indirect group memberships

* add to readme

* fix missing doc

* fix generic oauth wrong parameter

* log token
2023-06-14 15:38:16 +02:00
Serge Zaitsev a38f230d37 Chore: Remove result fields from login (#65136)
* remove result fields from login

* fix tests

* fix tests

* another shadowing
2023-03-28 20:32:21 +02:00
Eric Leijonmarck 3cd952b8ba Auth: Fix orgrole picker disabled if isSynced user (#64033)
* fix: disable orgrolepicker if externaluser is synced

* add disable to role picker

* just took me 2 hours to center the icon

* wip

* fix: check externallySyncedUser for API call

* remove check from store

* add: tests

* refactor authproxy and made tests run

* add: feature toggle

* set feature toggle for tests

* add: IsProviderEnabled

* refactor: featuretoggle name

* IsProviderEnabled tests

* add specific tests for isProviderEnabled

* fix: org_user tests

* add: owner to featuretoggle

* add missing authlabels

* remove fmt

* feature toggle

* change config

* add test for a different authmodule

* test refactor

* gen feature toggle again

* fix basic auth user able to change the org role

* test for basic auth role

* make err.base to error

* lowered lvl of log and input mesg
2023-03-22 17:41:59 +00:00
Karl Persson 4ede9fc7a4 AuthN: User sync info clean up (#64217)
* AuthN: handle case where auth_info exists but not the user
2023-03-06 14:17:48 +01:00
Eric LeijonmarckandIeva 91b5337600 Auth: Refactoring of frontend skipOrgRoleSync logic to backend (#62921)
* WIP

* refactor: add function in login for externSynced

* refactor: make function to make ExternalSyncedInfo

- adds tests
- refactors strings into consts

* remove: console.log

* remove: unnessecary comment

* added exhaustive tests

* refactor: labelname

* removed unused code

* missspelling

* refactor: based on review comments

* add: comment to functions about authinfo behavior

* Update pkg/services/login/authinfo.go

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Update pkg/services/login/authinfo.go

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* fix: tests

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2023-02-08 20:11:46 +00:00
Jo f9163351fd Support bundles: Refactor registry into separate service (#62945)
* add bundle registry service to avoid dependency cycles

* move user support bundle collector to user service

* move usage stat bundle implementation to usage stats

* add info for background service

* fix remaining imports

* whitespace
2023-02-06 17:50:03 +01:00
Eric Leijonmarck 8ff19bd901 Auth: Add Generic oauth skip org role sync setting (#62418)
* add: generic oauth skip org role sync

* add: docs

* add: backend login skip sync

* fix: docs typo

* add: tests

* remove public key

* fix markdown for generic oauth

* add: generic oauth to the configuration

* refactor: change debug to warn
2023-02-01 16:27:53 +00:00
Emil Tullstedt b1151dd118 Login: Fix panic when UpsertUser is called without ReqContext (#62539) 2023-01-31 11:16:23 +01:00
a232e7ceca Auth: Add skip_org_role_sync for Okta (#62106)
* WIP

* Update pkg/services/login/authinfo.go

* fix: merge

* change order to internal last

* adds: docs

* add: configuration for defaults and sample

* Update docs/sources/setup-grafana/configure-grafana/_index.md

Co-authored-by: Jo <joao.guerreiro@grafana.com>

* Update docs/sources/setup-grafana/configure-grafana/_index.md

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

---------

Co-authored-by: Jo <joao.guerreiro@grafana.com>
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
2023-01-30 10:54:14 +00:00
Kristin Laemmert 9256a520a4 chore: move user_auth models to (mostly) login service (#62269)
* chore: move user_auth models to (mostly) login service
2023-01-27 13:36:54 -05:00
Eric Leijonmarck 5531e22f46 Auth: Add disable of team sync for JWT Authentication (#62191)
* fix: disable team sync for JWT Authentication

* add: comment to test

* change test to conform to new expected behavior

* fix: spelling

* formatting
2023-01-27 16:05:25 +01:00
Karl PerssonandJo 95ea4bad6f AuthN: Rebuild Authenticate so we only have to call it once in context handler (#61705)
* API: Add reqSignedIn to router groups

* AuthN: Add fall through in context handler

* AuthN: Add IsAnonymous field

* AuthN: add priority to context aware clients

* ContextHandler: Add comment

* AuthN: Add a simple priority queue

* AuthN: Add Name to client interface

* AuthN: register clients with function

* AuthN: update mock and fake to implement interface

* AuthN: rewrite test without reflection

* AuthN: add comment

* AuthN: fix queue insert

* AuthN: rewrite tests

* AuthN: make the queue generic so we can reuse it for hooks

* ContextHandler: Add fixme for auth headers

* AuthN: remove unused variable

* AuthN: use multierror

* AuthN: write proper tests for queue

* AuthN: Add queue item that can store the value and priority

Co-authored-by: Jo <joao.guerreiro@grafana.com>
2023-01-26 10:50:44 +01:00
Eric Leijonmarck bedd2304d1 Auth: Fix disable/remove duplicate user entries metrics for performance reasons (#61675)
* fix: remove metrics from duplicate user entries

* fix: disable metrics collection for authinfo

* fix: initifine goroutine loop that happened

* removed: metrics
2023-01-18 16:01:47 +01:00
Jo dcfeab2c73 AuthN: User Quota (#61540)
* remove reqContext from quota checks in login

* add guards for nil ScopeParams
2023-01-16 11:54:15 +01:00
0c8ad80575 Authn: JWT client (#61157)
* add jwt client

* alias JWT verifier

* debug implementation

* add tests for jwt client

* add constant for JWT module

* Feedback

Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>

Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>
2023-01-10 15:08:52 +01:00
idafurjes 7dcb502b33 Chore: Remove org model duplicates (#61025)
Remove org model duplicates
2023-01-09 14:39:53 +01:00
idafurjes bb35f37b66 Chore: Delete org model duplicates (#60940)
* Delete org model duplicates

* Fix lint

* Move OrgDetailsDTO to org pkg
2023-01-04 16:20:26 +01:00
Jo a553040441 Authn: Refactor user sync and org sync as post auth hooks (#60504)
* add user sync

* add org user sync

* add client params

* merge remaining conflicts

* remove change to report.go

* update comments

* add basic tests for user ID population

* add tests for auth ID find

* add tests for user sync create and update

* add tests for orgsync

* satisfy lint

* add userID guards
2022-12-20 08:59:05 -05:00
Jo 77786f236a RBAC: Fix DeleteUserPermissions not being called on Upsert org sync (#60531)
* fix DeleteUserPermissions not being called on RemoveOrgUser

* do not error out of auth flow

* fix test missing service
2022-12-19 11:10:31 -05:00
Kristin Laemmert 70fbf47022 chore: remove CreateUser from sqlstore & replace with userService.CreateUserForTests (#59910) 2022-12-07 11:03:22 -05:00
6cc56311d9 Auth: Display id Provider label in orgs/users view (#58033)
* Add frontend test

* Add frontend label component

* Adjust backend tests

* Retrieve auth IDP labels for users at org/users.

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
Co-authored-by: Kalle <kalleep@users.noreply.github.com>
Co-authored-by: Jo <Jguer@users.noreply.github.com>
2022-11-29 15:20:28 +01:00
Karl Persson a4a5307722 Login: Remove CreateUser from LoginService (#59464)
* LoginService: remove create user and use user.Service instead

* Fix tests
2022-11-29 10:20:44 +01:00
Selene 9dc82606db LoginService: Remove unused sqlstore (#58595)
Remove unused sqlstore
2022-11-23 17:58:52 +01:00
Karl Persson b3406a8273 Auth: Remove userauth service (#58941)
* Auth: remove userauth service

* Use Revoke user tokens from UserAuthTokenService
* Add function to delete user auth info to UserAuthInfo service
2022-11-18 14:40:26 +01:00
Sofia Papagiannaki 9855e74b92 Chore: Refactor quota service (#58643)
Chore: Refactor quota service (#57586)

* Chore: refactore quota service

* Apply suggestions from code review
2022-11-14 21:08:10 +02:00