mirror of https://github.com/grafana/grafana
Auth: Do not search for the user twice (#18366)
* Auth: Do not search for the user twice
Previously `initContextWithBasicAuth` did not use `LoginUserQuery`, doing
`GetUserByLoginQuery` only i.e. looking user in DB only, things changed when
this function started to check LDAP provider via `LoginUserQuery` (#6940),
however, this request was placed after `GetUserByLoginQuery`, so we first
looking in DB then in the LDAP - if LDAP user hasn't logged in we will
not find it in DB, so `LoginUserQuery` will never be reached.
`LoginUserQuery` request already performs `GetUserByLoginQuery`
request in correct sequence. So we can just remove redundant request.
* Correct sequence execution during authentification &
introduce tests for it
* Move basic auth tests to separate test file, since main test file already
pretty large
* Introduce `testing.go` for the middleware module
* Remove redundant test helper function
* Make handler names more explicit
Ref 5777f65d05
Fixes #18329
* Auth: address review comment
pull/18374/head
Oleg Gaidarenko
6 years ago
committed by
Torkel Ödegaard
parent
d8f86834d9
commit
d88fdc86fc
@ -0,0 +1,143 @@ |
||||
package middleware |
||||
|
||||
import ( |
||||
"encoding/json" |
||||
"testing" |
||||
|
||||
. "github.com/smartystreets/goconvey/convey" |
||||
|
||||
"github.com/grafana/grafana/pkg/bus" |
||||
authLogin "github.com/grafana/grafana/pkg/login" |
||||
"github.com/grafana/grafana/pkg/models" |
||||
"github.com/grafana/grafana/pkg/setting" |
||||
"github.com/grafana/grafana/pkg/util" |
||||
) |
||||
|
||||
func TestMiddlewareBasicAuth(t *testing.T) { |
||||
Convey("Given the basic auth", t, func() { |
||||
var oldBasicAuthEnabled = setting.BasicAuthEnabled |
||||
var oldDisableBruteForceLoginProtection = setting.DisableBruteForceLoginProtection |
||||
var id int64 = 12 |
||||
|
||||
Convey("Setup", func() { |
||||
setting.BasicAuthEnabled = true |
||||
setting.DisableBruteForceLoginProtection = true |
||||
bus.ClearBusHandlers() |
||||
}) |
||||
|
||||
middlewareScenario(t, "Valid API key", func(sc *scenarioContext) { |
||||
var orgID int64 = 2 |
||||
keyhash := util.EncodePassword("v5nAwpMafFP6znaS4urhdWDLS5511M42", "asd") |
||||
|
||||
bus.AddHandler("test", func(query *models.GetApiKeyByNameQuery) error { |
||||
query.Result = &models.ApiKey{OrgId: orgID, Role: models.ROLE_EDITOR, Key: keyhash} |
||||
return nil |
||||
}) |
||||
|
||||
authHeader := util.GetBasicAuthHeader("api_key", "eyJrIjoidjVuQXdwTWFmRlA2em5hUzR1cmhkV0RMUzU1MTFNNDIiLCJuIjoiYXNkIiwiaWQiOjF9") |
||||
sc.fakeReq("GET", "/").withAuthorizationHeader(authHeader).exec() |
||||
|
||||
Convey("Should return 200", func() { |
||||
So(sc.resp.Code, ShouldEqual, 200) |
||||
}) |
||||
|
||||
Convey("Should init middleware context", func() { |
||||
So(sc.context.IsSignedIn, ShouldEqual, true) |
||||
So(sc.context.OrgId, ShouldEqual, orgID) |
||||
So(sc.context.OrgRole, ShouldEqual, models.ROLE_EDITOR) |
||||
}) |
||||
}) |
||||
|
||||
middlewareScenario(t, "Handle auth", func(sc *scenarioContext) { |
||||
var password = "MyPass" |
||||
var salt = "Salt" |
||||
var orgID int64 = 2 |
||||
|
||||
bus.AddHandler("grafana-auth", func(query *models.LoginUserQuery) error { |
||||
query.User = &models.User{ |
||||
Password: util.EncodePassword(password, salt), |
||||
Salt: salt, |
||||
} |
||||
return nil |
||||
}) |
||||
|
||||
bus.AddHandler("get-sign-user", func(query *models.GetSignedInUserQuery) error { |
||||
query.Result = &models.SignedInUser{OrgId: orgID, UserId: id} |
||||
return nil |
||||
}) |
||||
|
||||
authHeader := util.GetBasicAuthHeader("myUser", password) |
||||
sc.fakeReq("GET", "/").withAuthorizationHeader(authHeader).exec() |
||||
|
||||
Convey("Should init middleware context with users", func() { |
||||
So(sc.context.IsSignedIn, ShouldEqual, true) |
||||
So(sc.context.OrgId, ShouldEqual, orgID) |
||||
So(sc.context.UserId, ShouldEqual, id) |
||||
}) |
||||
|
||||
bus.ClearBusHandlers() |
||||
}) |
||||
|
||||
middlewareScenario(t, "Auth sequence", func(sc *scenarioContext) { |
||||
var password = "MyPass" |
||||
var salt = "Salt" |
||||
|
||||
authLogin.Init() |
||||
|
||||
bus.AddHandler("user-query", func(query *models.GetUserByLoginQuery) error { |
||||
query.Result = &models.User{ |
||||
Password: util.EncodePassword(password, salt), |
||||
Id: id, |
||||
Salt: salt, |
||||
} |
||||
return nil |
||||
}) |
||||
|
||||
bus.AddHandler("get-sign-user", func(query *models.GetSignedInUserQuery) error { |
||||
query.Result = &models.SignedInUser{UserId: query.UserId} |
||||
return nil |
||||
}) |
||||
|
||||
authHeader := util.GetBasicAuthHeader("myUser", password) |
||||
sc.fakeReq("GET", "/").withAuthorizationHeader(authHeader).exec() |
||||
|
||||
Convey("Should init middleware context with user", func() { |
||||
So(sc.context.IsSignedIn, ShouldEqual, true) |
||||
So(sc.context.UserId, ShouldEqual, id) |
||||
}) |
||||
}) |
||||
|
||||
middlewareScenario(t, "Should return error if user is not found", func(sc *scenarioContext) { |
||||
sc.fakeReq("GET", "/") |
||||
sc.req.SetBasicAuth("user", "password") |
||||
sc.exec() |
||||
|
||||
err := json.NewDecoder(sc.resp.Body).Decode(&sc.respJson) |
||||
So(err, ShouldNotBeNil) |
||||
|
||||
So(sc.resp.Code, ShouldEqual, 401) |
||||
So(sc.respJson["message"], ShouldEqual, errStringInvalidUsernamePassword) |
||||
}) |
||||
|
||||
middlewareScenario(t, "Should return error if user & password do not match", func(sc *scenarioContext) { |
||||
bus.AddHandler("user-query", func(loginUserQuery *models.GetUserByLoginQuery) error { |
||||
return nil |
||||
}) |
||||
|
||||
sc.fakeReq("GET", "/") |
||||
sc.req.SetBasicAuth("killa", "gorilla") |
||||
sc.exec() |
||||
|
||||
err := json.NewDecoder(sc.resp.Body).Decode(&sc.respJson) |
||||
So(err, ShouldNotBeNil) |
||||
|
||||
So(sc.resp.Code, ShouldEqual, 401) |
||||
So(sc.respJson["message"], ShouldEqual, errStringInvalidUsernamePassword) |
||||
}) |
||||
|
||||
Convey("Destroy", func() { |
||||
setting.BasicAuthEnabled = oldBasicAuthEnabled |
||||
setting.DisableBruteForceLoginProtection = oldDisableBruteForceLoginProtection |
||||
}) |
||||
}) |
||||
} |
||||
@ -0,0 +1,102 @@ |
||||
package middleware |
||||
|
||||
import ( |
||||
"encoding/json" |
||||
"net/http" |
||||
"net/http/httptest" |
||||
|
||||
. "github.com/smartystreets/goconvey/convey" |
||||
"gopkg.in/macaron.v1" |
||||
|
||||
"github.com/grafana/grafana/pkg/infra/remotecache" |
||||
"github.com/grafana/grafana/pkg/models" |
||||
"github.com/grafana/grafana/pkg/services/auth" |
||||
"github.com/grafana/grafana/pkg/setting" |
||||
) |
||||
|
||||
type scenarioContext struct { |
||||
m *macaron.Macaron |
||||
context *models.ReqContext |
||||
resp *httptest.ResponseRecorder |
||||
apiKey string |
||||
authHeader string |
||||
tokenSessionCookie string |
||||
respJson map[string]interface{} |
||||
handlerFunc handlerFunc |
||||
defaultHandler macaron.Handler |
||||
url string |
||||
userAuthTokenService *auth.FakeUserAuthTokenService |
||||
remoteCacheService *remotecache.RemoteCache |
||||
|
||||
req *http.Request |
||||
} |
||||
|
||||
func (sc *scenarioContext) withValidApiKey() *scenarioContext { |
||||
sc.apiKey = "eyJrIjoidjVuQXdwTWFmRlA2em5hUzR1cmhkV0RMUzU1MTFNNDIiLCJuIjoiYXNkIiwiaWQiOjF9" |
||||
return sc |
||||
} |
||||
|
||||
func (sc *scenarioContext) withTokenSessionCookie(unhashedToken string) *scenarioContext { |
||||
sc.tokenSessionCookie = unhashedToken |
||||
return sc |
||||
} |
||||
|
||||
func (sc *scenarioContext) withAuthorizationHeader(authHeader string) *scenarioContext { |
||||
sc.authHeader = authHeader |
||||
return sc |
||||
} |
||||
|
||||
func (sc *scenarioContext) fakeReq(method, url string) *scenarioContext { |
||||
sc.resp = httptest.NewRecorder() |
||||
req, err := http.NewRequest(method, url, nil) |
||||
So(err, ShouldBeNil) |
||||
sc.req = req |
||||
|
||||
return sc |
||||
} |
||||
|
||||
func (sc *scenarioContext) fakeReqWithParams(method, url string, queryParams map[string]string) *scenarioContext { |
||||
sc.resp = httptest.NewRecorder() |
||||
req, err := http.NewRequest(method, url, nil) |
||||
q := req.URL.Query() |
||||
for k, v := range queryParams { |
||||
q.Add(k, v) |
||||
} |
||||
req.URL.RawQuery = q.Encode() |
||||
So(err, ShouldBeNil) |
||||
sc.req = req |
||||
|
||||
return sc |
||||
} |
||||
|
||||
func (sc *scenarioContext) handler(fn handlerFunc) *scenarioContext { |
||||
sc.handlerFunc = fn |
||||
return sc |
||||
} |
||||
|
||||
func (sc *scenarioContext) exec() { |
||||
if sc.apiKey != "" { |
||||
sc.req.Header.Add("Authorization", "Bearer "+sc.apiKey) |
||||
} |
||||
|
||||
if sc.authHeader != "" { |
||||
sc.req.Header.Add("Authorization", sc.authHeader) |
||||
} |
||||
|
||||
if sc.tokenSessionCookie != "" { |
||||
sc.req.AddCookie(&http.Cookie{ |
||||
Name: setting.LoginCookieName, |
||||
Value: sc.tokenSessionCookie, |
||||
}) |
||||
} |
||||
|
||||
sc.m.ServeHTTP(sc.resp, sc.req) |
||||
|
||||
if sc.resp.Header().Get("Content-Type") == "application/json; charset=UTF-8" { |
||||
err := json.NewDecoder(sc.resp.Body).Decode(&sc.respJson) |
||||
So(err, ShouldBeNil) |
||||
} |
||||
} |
||||
|
||||
type scenarioFunc func(c *scenarioContext) |
||||
type handlerFunc func(c *models.ReqContext) |
||||
Loading…
Reference in new issue