Commit Graph

26 Commits

Author SHA1 Message Date
Misi 1f3dc0533c Auth: Add tracing to auth clients and AuthToken service (#107878)
* Add tracing to auth clients + authtoken svc

* Fix span names

* Fix ext_jwt.go

* Fix idimpl/service

* Update wire_gen.go

* Add tracing to JWT client

* Lint
2025-07-10 15:41:00 +02:00
Bruno 0f23988132 JWT.Authenticate: remove err != nil check for error that has already been checked (#107727) 2025-07-08 11:19:39 -03:00
Quentin Bisson aeca9a80a4 JWT: Add org role mapping support to the JWT provider (#101584)
* add org role mapping to the jwt provider

* Fix indentation for OrgMapping assignment

* add-test

* fix linting

* add org_attribute_path

* fix test

* update doc

* update doc

* Update pkg/services/authn/clients/jwt.go

* Update docs

---------

Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com>
2025-03-21 14:18:53 +01:00
Misi 50a635bc7e Auth: Introduce authn.SSOClientConfig to get client config from SSOSettings service (#94618)
* wip

* possible solution

* Separate interface for SSO settings clients

* Rename interface

* Fix tests

* Rename

* Change GetClientConfig to comma ok idiom
2024-10-16 16:27:44 +02:00
Ryan McKinley 99d8025829 Chore: Move identity and errutil to apimachinery module (#89116) 2024-06-13 07:11:35 +03:00
Karl Persson 5c27f223af Authn: Support access token wildcard namespace (#87816)
* Authn+ExtJWT: allow wildcard namespace for access tokens and restructure validation
2024-05-16 10:47:20 +02:00
Charandas 0c59baf62d ext_jwt: switch to new authlib (#87157) 2024-05-03 12:59:37 -07:00
linoman 51da96d94e Auth: Add IsClientEnabled and IsEnabled for the authn.Service and authn.Client interfaces (#86034)
* Add `Service. IsClientEnabled` and `Client.IsEnabled` functions

* Implement `IsEnabled` function for authn clients

* Implement `IsClientEnabled` function for authn services
2024-04-15 10:54:50 +02:00
linoman e4250a72db JWT: Find login and email claims with JMESPATH (#85305)
* add function to static function to static service

* find email and login claims with jmespath

* rename configuration files

* Replace JWTClaims struct for map

* check for subclaims error
2024-03-28 17:25:26 +01:00
Jo 6f62d970e3 JWT Authentication: Add support for specifying groups in auth.jwt for teamsync (#82175)
* merge JSON search logic

* document public methods

* improve test coverage

* use separate JWT setting struct

* correct use of cfg.JWTAuth

* add group tests

* fix DynMap typing

* add settings to default ini

* add groups option to devenv path

* fix test

* lint

* revert jwt-proxy change

* remove redundant check

* fix parallel test
2024-02-09 16:35:58 +01:00
Ryan McKinley 025b2f3011 Chore: use any rather than interface{} (#74066) 2023-08-30 18:46:47 +03:00
Marcus Efraimsson 040b7d2571 Chore: Add errutils helpers (#73577)
Add helpers for the errutil package in favor of errutil.NewBase.
2023-08-22 12:52:24 +02:00
Misi 5efc3386d3 AuthZ: Extend /api/search to work with self-contained permissions (#70749)
* Search sql filter draft, unfinished

* Search works for empty roles

* Add current AuthModule to SignedInUser

* clean up, changes to the search

* Use constant prefixes

* Change AuthModule to AuthenticatedBy

* Add tests for using the permissions from the SignedInUser

* Refactor and simplify code

* Fix sql generation for pg and mysql

* Fixes, clean up

* Add test for empty permission list

* Fix

* Fix any vs all in case of edit permission

* Update pkg/services/authn/authn.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Update pkg/services/sqlstore/permissions/dashboard_test.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Fixes, changes based on the review

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2023-07-12 12:31:36 +02:00
Jo 96fdbbee90 AuthJWT: Fix JWT query param leak (CVE-2023-1387) (#825)
fix JWT query param leak

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
2023-04-27 14:40:44 +03:00
Karl Persson 355f47628f AuthN: Tune logs in client (#65714)
* AuthN: Remove log

* AuthN: Check for user not found error in hook
2023-03-31 16:43:24 +02:00
Misi 6543259a7d Auth: Add SyncPermissions post auth hook (#64205)
* Add SyncPermissionsFromDB post auth hook

* Delete FromDB prefix

* Align tests

* Fixes

* Change SyncPermissionsHook prio
2023-03-08 13:35:54 +01:00
Karl Persson 2a7fc3983b AuthN: cleanup logs (#63652)
* AuthN: clean up logs
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2023-02-24 11:26:55 +01:00
Karl Persson 207a55be66 AuthN: add flag for org roles sync (#63507)
* AuthN: Add flag to control org role syncs

* JWT: Only sync org roles if the skip flag for jwt is false

* LDAP: Only sync org role if skip flag for ldap is false

* OAuth: Skip org roles sync if no roles were provided by upstream service

* Grafana: Set SyncOrgRoles to true for authentication through proxy with grafana as backend
2023-02-22 10:27:48 +01:00
Karl Persson 180a587f70 AuthN: fetch final state of signed in user (#62854)
* AuthN: add a hook we can use to fetch final state of user
2023-02-03 14:14:38 +01:00
Eric Leijonmarck 5531e22f46 Auth: Add disable of team sync for JWT Authentication (#62191)
* fix: disable team sync for JWT Authentication

* add: comment to test

* change test to conform to new expected behavior

* fix: spelling

* formatting
2023-01-27 16:05:25 +01:00
Jo 284ca4eab4 AuthN: JWT remove unnecessary if (#62233)
remove unnecessary if
2023-01-26 17:32:20 +01:00
Karl Persson 95ea4bad6f AuthN: Rebuild Authenticate so we only have to call it once in context handler (#61705)
* API: Add reqSignedIn to router groups

* AuthN: Add fall through in context handler

* AuthN: Add IsAnonymous field

* AuthN: add priority to context aware clients

* ContextHandler: Add comment

* AuthN: Add a simple priority queue

* AuthN: Add Name to client interface

* AuthN: register clients with function

* AuthN: update mock and fake to implement interface

* AuthN: rewrite test without reflection

* AuthN: add comment

* AuthN: fix queue insert

* AuthN: rewrite tests

* AuthN: make the queue generic so we can reuse it for hooks

* ContextHandler: Add fixme for auth headers

* AuthN: remove unused variable

* AuthN: use multierror

* AuthN: write proper tests for queue

* AuthN: Add queue item that can store the value and priority

Co-authored-by: Jo <joao.guerreiro@grafana.com>
2023-01-26 10:50:44 +01:00
linoman 56c2755b3b Fix JWT claims request (#61650)
* Fix JWT claims request

* Add test scenarios for missing config options
2023-01-19 16:03:09 +01:00
linoman 4d095547f8 Auth: Implement skip org role sync for jwt (#61647)
* Add new config option

* Add frontend control

* Condition new auth broker with config option

* Condition old auth broker with config option

Co-authored-by: Jo <joao.guerreiro@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2023-01-18 13:59:50 +01:00
Misi b8b08ea292 Auth: Add sub claim check to JWT Auth pre-checks (#61417)
* Auth: Add sub claim check to JWT Auth pre-checks

* Add #nosec annotation to the test tokens
2023-01-16 10:50:34 +01:00
Jo 0c8ad80575 Authn: JWT client (#61157)
* add jwt client

* alias JWT verifier

* debug implementation

* add tests for jwt client

* add constant for JWT module

* Feedback

Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>

Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>
2023-01-10 15:08:52 +01:00