mirror of https://github.com/grafana/grafana
Younjin Song
7 months ago
committed by
GitHub
parent
663167a16c
commit
85392de2e7
@ -1,21 +0,0 @@ |
||||
import { SelectableValue } from '@grafana/data'; |
||||
|
||||
import { AzureCredentialsType, AzureAuthType } from '../types'; |
||||
|
||||
export enum AzureCloud { |
||||
Public = 'AzureCloud', |
||||
None = '', |
||||
} |
||||
|
||||
export const KnownAzureClouds: Array<SelectableValue<AzureCloud>> = [{ value: AzureCloud.Public, label: 'Azure' }]; |
||||
|
||||
export function isCredentialsComplete(credentials: AzureCredentialsType): boolean { |
||||
switch (credentials.authType) { |
||||
case AzureAuthType.MSI: |
||||
return true; |
||||
case AzureAuthType.CLIENT_SECRET: |
||||
return !!(credentials.azureCloud && credentials.tenantId && credentials.clientId && credentials.clientSecret); |
||||
case AzureAuthType.AD_PASSWORD: |
||||
return !!(credentials.clientId && credentials.password && credentials.userId); |
||||
} |
||||
} |
||||
@ -1,167 +1,26 @@ |
||||
import { DataSourceSettings } from '@grafana/data'; |
||||
import { GrafanaBootConfig } from '@grafana/runtime'; |
||||
|
||||
import { |
||||
AzureCloud, |
||||
AzureCredentialsType, |
||||
ConcealedSecretType, |
||||
AzureAuthSecureJSONDataType, |
||||
AzureAuthJSONDataType, |
||||
AzureAuthType, |
||||
} from '../types'; |
||||
|
||||
export const getDefaultCredentials = (managedIdentityEnabled: boolean, cloud: string): AzureCredentialsType => { |
||||
if (managedIdentityEnabled) { |
||||
return { authType: AzureAuthType.MSI }; |
||||
AzureCredentials, |
||||
AzureDataSourceSettings, |
||||
getDatasourceCredentials, |
||||
getDefaultAzureCloud, |
||||
} from '@grafana/azure-sdk'; |
||||
import { config } from '@grafana/runtime'; |
||||
|
||||
export const getDefaultCredentials = (): AzureCredentials => { |
||||
if (config.azure.managedIdentityEnabled) { |
||||
return { authType: 'msi' }; |
||||
} else { |
||||
return { authType: AzureAuthType.CLIENT_SECRET, azureCloud: cloud }; |
||||
return { authType: 'clientsecret', azureCloud: getDefaultAzureCloud() }; |
||||
} |
||||
}; |
||||
|
||||
export const getSecret = ( |
||||
storedServerSide: boolean, |
||||
secret: string | symbol | undefined |
||||
): undefined | string | ConcealedSecretType => { |
||||
const concealedSecret: ConcealedSecretType = Symbol('Concealed client secret'); |
||||
if (storedServerSide) { |
||||
// The secret is concealed server side, so return the symbol
|
||||
return concealedSecret; |
||||
} else { |
||||
return typeof secret === 'string' && secret.length > 0 ? secret : undefined; |
||||
export const getCredentials = (dsSettings: AzureDataSourceSettings): AzureCredentials => { |
||||
const credentials = getDatasourceCredentials(dsSettings); |
||||
if (credentials) { |
||||
return credentials; |
||||
} |
||||
}; |
||||
|
||||
export const getCredentials = ( |
||||
dsSettings: DataSourceSettings<AzureAuthJSONDataType, AzureAuthSecureJSONDataType>, |
||||
bootConfig: GrafanaBootConfig |
||||
): AzureCredentialsType => { |
||||
// JSON data
|
||||
const credentials = dsSettings.jsonData?.azureCredentials; |
||||
|
||||
// Secure JSON data/fields
|
||||
const clientSecretStoredServerSide = dsSettings.secureJsonFields?.azureClientSecret; |
||||
const clientSecret = dsSettings.secureJsonData?.azureClientSecret; |
||||
const passwordStoredServerSide = dsSettings.secureJsonFields?.password; |
||||
const password = dsSettings.secureJsonData?.password; |
||||
|
||||
// BootConfig data
|
||||
const managedIdentityEnabled = !!bootConfig.azure?.managedIdentityEnabled; |
||||
const cloud = bootConfig.azure?.cloud || AzureCloud.Public; |
||||
|
||||
// If no credentials saved, then return empty credentials
|
||||
// of type based on whether the managed identity enabled
|
||||
if (!credentials) { |
||||
return getDefaultCredentials(managedIdentityEnabled, cloud); |
||||
} |
||||
|
||||
switch (credentials.authType) { |
||||
case AzureAuthType.MSI: |
||||
if (managedIdentityEnabled) { |
||||
return { |
||||
authType: AzureAuthType.MSI, |
||||
}; |
||||
} else { |
||||
// If authentication type is managed identity but managed identities were disabled in Grafana config,
|
||||
// then we should fallback to an empty app registration (client secret) configuration
|
||||
return { |
||||
authType: AzureAuthType.CLIENT_SECRET, |
||||
azureCloud: cloud, |
||||
}; |
||||
} |
||||
case AzureAuthType.CLIENT_SECRET: |
||||
return { |
||||
authType: AzureAuthType.CLIENT_SECRET, |
||||
azureCloud: credentials.azureCloud || cloud, |
||||
tenantId: credentials.tenantId, |
||||
clientId: credentials.clientId, |
||||
clientSecret: getSecret(clientSecretStoredServerSide, clientSecret), |
||||
}; |
||||
case AzureAuthType.AD_PASSWORD: |
||||
return { |
||||
authType: AzureAuthType.AD_PASSWORD, |
||||
userId: credentials.userId, |
||||
clientId: credentials.clientId, |
||||
password: getSecret(passwordStoredServerSide, password), |
||||
}; |
||||
} |
||||
}; |
||||
|
||||
export const updateCredentials = ( |
||||
dsSettings: DataSourceSettings<AzureAuthJSONDataType>, |
||||
bootConfig: GrafanaBootConfig, |
||||
credentials: AzureCredentialsType |
||||
): DataSourceSettings<AzureAuthJSONDataType> => { |
||||
// BootConfig data
|
||||
const managedIdentityEnabled = !!bootConfig.azure?.managedIdentityEnabled; |
||||
const cloud = bootConfig.azure?.cloud || AzureCloud.Public; |
||||
|
||||
switch (credentials.authType) { |
||||
case AzureAuthType.MSI: |
||||
if (!managedIdentityEnabled) { |
||||
throw new Error('Managed Identity authentication is not enabled in Grafana config.'); |
||||
} |
||||
|
||||
dsSettings = { |
||||
...dsSettings, |
||||
jsonData: { |
||||
...dsSettings.jsonData, |
||||
azureCredentials: { |
||||
authType: AzureAuthType.MSI, |
||||
}, |
||||
}, |
||||
}; |
||||
|
||||
return dsSettings; |
||||
|
||||
case AzureAuthType.CLIENT_SECRET: |
||||
dsSettings = { |
||||
...dsSettings, |
||||
jsonData: { |
||||
...dsSettings.jsonData, |
||||
azureCredentials: { |
||||
authType: AzureAuthType.CLIENT_SECRET, |
||||
azureCloud: credentials.azureCloud || cloud, |
||||
tenantId: credentials.tenantId, |
||||
clientId: credentials.clientId, |
||||
}, |
||||
}, |
||||
secureJsonData: { |
||||
...dsSettings.secureJsonData, |
||||
azureClientSecret: |
||||
typeof credentials.clientSecret === 'string' && credentials.clientSecret.length > 0 |
||||
? credentials.clientSecret |
||||
: undefined, |
||||
}, |
||||
secureJsonFields: { |
||||
...dsSettings.secureJsonFields, |
||||
azureClientSecret: typeof credentials.clientSecret === 'symbol', |
||||
}, |
||||
}; |
||||
|
||||
return dsSettings; |
||||
|
||||
case AzureAuthType.AD_PASSWORD: |
||||
return { |
||||
...dsSettings, |
||||
jsonData: { |
||||
...dsSettings.jsonData, |
||||
azureCredentials: { |
||||
authType: AzureAuthType.AD_PASSWORD, |
||||
userId: credentials.userId, |
||||
clientId: credentials.clientId, |
||||
}, |
||||
}, |
||||
secureJsonData: { |
||||
...dsSettings.secureJsonData, |
||||
password: |
||||
typeof credentials.password === 'string' && credentials.password.length > 0 |
||||
? credentials.password |
||||
: undefined, |
||||
}, |
||||
secureJsonFields: { |
||||
...dsSettings.secureJsonFields, |
||||
password: typeof credentials.password === 'symbol', |
||||
}, |
||||
}; |
||||
} |
||||
return getDefaultCredentials(); |
||||
}; |
||||
|
||||
Loading…
Reference in new issue