mirror of https://github.com/grafana/grafana
Auth: Add skip_org_role_sync setting for GrafanaCom (#60553)
* add frontend settings and setting for grafanacom * removed println * add skip-org-role-sync on login * add deprecation notice for this field * remove println * remove newline * change and renamed variables * fix for reconfiguring the settings for grafanacom * add documentationf or grafanacom setup * WIP tests * added tests * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * updated steps * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * doc: updated the docs to reflect what happens to grafana.com users * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * add blankline * rephrase of doc improvements for explaing of the settings * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * add frontend setting for grafanacom. * WIP tests * refactor docs * frontend to adhere to skipping org role sync for GrafanaCom users * update docs to reflect desired behavior * tests: added test for skip and nonskip * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> Co-authored-by: Jo <joao.guerreiro@grafana.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>pull/61356/head
Eric Leijonmarck
3 years ago
committed by
GitHub
parent
e7b8b82c14
commit
91322bebb5
@ -0,0 +1,46 @@ |
||||
--- |
||||
aliases: |
||||
- ../../../auth/grafana-com/ |
||||
description: Grafana Com Authentication |
||||
title: Configure Grafana Com authentication |
||||
weight: 500 |
||||
--- |
||||
|
||||
# Configure Grafana Com authentication |
||||
|
||||
To enable GrafanaCom as your authentication provider, you configure it to generate a client ID and a secret key. |
||||
|
||||
## Create GrafanaCom OAuth keys |
||||
|
||||
To use GrafanaCom authentication: |
||||
|
||||
1. Log in to [GrafanaCom](https://grafana.com). |
||||
1. To create an OAuth client, locate your organization and click **OAuth Clients**. |
||||
1. Click **Add OAuth Client Application**. |
||||
1. Add the name and URL of your running Grafana instance. |
||||
1. Click **Add OAuth Client**. |
||||
1. Copy the client ID and secret key or the configuration that has been generated. |
||||
|
||||
The following snippet shows an example configuration: |
||||
|
||||
```ini |
||||
[auth.grafana_com] |
||||
enabled = true |
||||
allow_sign_up = true |
||||
client_id = 450bc21c10dc2194879d |
||||
client_secret = eyJ0Ijoib2F1dGgyYyIhlmlkIjoiNzUwYmMzM2MxMGRjMjE6NDh3OWQiLCJ2IjoiZmI1YzVlYmIwYzFmN2ZhYzZmNjIwOGI1NmVkYTRlNWYxMzgwM2NkMiJ9 |
||||
scopes = user:email |
||||
allowed_organizations = sampleorganization |
||||
enabled = true |
||||
``` |
||||
|
||||
## Skip organization role sync |
||||
|
||||
To prevent the sync of org roles from Grafana.com, set `skip_org_role_sync` to `true`. This is useful if you want to manage the organization roles for your users from within Grafana. |
||||
|
||||
```ini |
||||
[auth.grafana_com] |
||||
# .. |
||||
# prevents the sync of org roles from Grafana.com |
||||
skip_org_role_sync = true |
||||
``` |
||||
@ -0,0 +1,94 @@ |
||||
package social |
||||
|
||||
import ( |
||||
"net/http" |
||||
"net/http/httptest" |
||||
"testing" |
||||
|
||||
"github.com/stretchr/testify/require" |
||||
) |
||||
|
||||
const ( |
||||
UserInfoURL = "/api/oauth2/user" |
||||
userResponse = `{ |
||||
"id": 123, |
||||
"name": "grafana name", |
||||
"login": "grafanalogin", |
||||
"username": "grafanalogin", |
||||
"email": "grafana@grafana.com", |
||||
"role": "Admin", |
||||
"orgs": [ { "login": "grafana", "role": "Admin" } ] |
||||
}` |
||||
) |
||||
|
||||
func TestSocialGrafanaCom_UserInfo(t *testing.T) { |
||||
provider := SocialGrafanaCom{ |
||||
SocialBase: &SocialBase{ |
||||
log: newLogger("grafana_com_oauth_test", "debug"), |
||||
}, |
||||
} |
||||
|
||||
type conf struct { |
||||
skipOrgRoleSync bool |
||||
} |
||||
|
||||
tests := []struct { |
||||
Name string |
||||
Cfg conf |
||||
userInfoResp string |
||||
want *BasicUserInfo |
||||
ExpectedError error |
||||
}{ |
||||
{ |
||||
Name: "should return empty role as userInfo when Skip Org Role Sync Enabled", |
||||
userInfoResp: userResponse, |
||||
Cfg: conf{skipOrgRoleSync: true}, |
||||
want: &BasicUserInfo{ |
||||
Id: "1", |
||||
Name: "Eric Leijonmarck", |
||||
Email: "octocat@github.com", |
||||
Login: "octocat", |
||||
Role: "", |
||||
}, |
||||
}, |
||||
{ |
||||
Name: "should return role as userInfo when Skip Org Role Sync Enabled", |
||||
userInfoResp: userResponse, |
||||
Cfg: conf{skipOrgRoleSync: false}, |
||||
want: &BasicUserInfo{ |
||||
Id: "1", |
||||
Name: "Eric Leijonmarck", |
||||
Email: "octocat@github.com", |
||||
Login: "octocat", |
||||
Role: "Admin", |
||||
}, |
||||
}, |
||||
} |
||||
|
||||
for _, test := range tests { |
||||
provider.skipOrgRoleSync = test.Cfg.skipOrgRoleSync |
||||
|
||||
t.Run(test.Name, func(t *testing.T) { |
||||
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { |
||||
w.WriteHeader(http.StatusOK) |
||||
w.Header().Set("Content-Type", "application/json") |
||||
switch r.RequestURI { |
||||
case UserInfoURL: |
||||
_, err := w.Write([]byte(test.userInfoResp)) |
||||
require.NoError(t, err) |
||||
default: |
||||
w.WriteHeader(http.StatusNotFound) |
||||
} |
||||
})) |
||||
provider.url = ts.URL |
||||
actualResult, err := provider.UserInfo(ts.Client(), nil) |
||||
if test.ExpectedError != nil { |
||||
require.Equal(t, err, test.ExpectedError) |
||||
return |
||||
} |
||||
|
||||
require.NoError(t, err) |
||||
require.Equal(t, test.want.Role, actualResult.Role) |
||||
}) |
||||
} |
||||
} |
||||
Loading…
Reference in new issue