grafana

Commit Graph

Author	SHA1	Message	Date
Kat Yang	3c3039f5b3	Chore: Remove Wrap (#50048 ) * Chore: Remove Wrap and Wrapf * Fix: Add error check	3 years ago
sh0rez	3d5d8c785b	pkg/web: restrict handler types (#48495 ) Makes `pkg/web` only accept handles from the following set: ```go handlerStd = func(http.ResponseWriter, http.Request) handlerStdCtx = func(http.ResponseWriter, http.Request, web.Context) handlerStdReqCtx = func(http.ResponseWriter, http.Request, models.ReqContext) handlerReqCtx = func(models.ReqContext) handlerReqCtxRes = func(models.ReqContext) Response handlerCtx = func(web.Context) ``` This is a first step to reducing above set to only `http.Handler`. --- Due to a cyclic import situation between `pkg/models` and `pkg/web`, parts of this PR were put into `pkg/api/response`, even though they definitely do not belong there. This however is _temporary_ until we untangle `models.ReqContext`.	3 years ago
Krzysztof Dąbrowski	5be23b40b6	LDAP: allow Grafana Admin mapping without org_role field (#37189 )	3 years ago
Krzysztof Dąbrowski	c41397a6e7	LDAP: validate organization role during parsing (#37188 ) * LDAP: validate organization role during parsing * Trigger a new build * Check if grafana_admin is present	3 years ago
Gabriel MABILLE	94fd03f44f	LDAP: Fix debug view to display the actual computed mapping in ldap.go (#48103 ) * LDAP debug fix with Org role inheritance Co-authored-by: Jguer <joao.guerreiro@grafana.com> * ldap debug coherent with ldap.go Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Selene	875e0736ec	LDAP: Use an interface instead of a bus to get group teams (#42165 ) * Remove bus for GetTeams for LDAP * Fix lint	3 years ago
Emil Tullstedt	ad971cc9be	LDAP: Search all DNs for users (#38891 )	4 years ago
Arve Knudsen	d27a72f859	IPv6: Support host address configured with enclosing square brackets (#31226 ) Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	4 years ago
Arve Knudsen	116809ed7f	services/provisioning: Various cleanup (#30396 ) Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	4 years ago
Arve Knudsen	c2cad26ca9	Chore: Disable default golangci-lint filter (#29751 ) * Disable default golangci-lint filter Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * Chore: Fix linter warnings Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	12661e8a9d	Move middleware context handler logic to service (#29605 ) * middleware: Move context handler to own service Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> Co-authored-by: Emil Tullsted <sakjur@users.noreply.github.com> Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>	5 years ago
Arve Knudsen	f326b79cc1	Security: Add gosec G304 auditing annotations (#29578 ) * Security: Add gosec G304 auditing annotations Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * Add gosec annotations Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * Add gosec annotations Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * Add gosec annotations Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * space Signed-off-by: bergquist <carl.bergquist@gmail.com> * Add gosec annotations Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> Co-authored-by: bergquist <carl.bergquist@gmail.com>	5 years ago
Arve Knudsen	752a424e1f	Auth proxy: Return standard error type (#29502 ) * Rewrite auth proxy tests to use standard lib Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * Auth proxy: Use standard error type Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	9593d57914	Chore: Enable errorlint linter (#29227 ) * Enable errorlint linter * Handle wrapped errors Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	5 years ago
Arve Knudsen	7897c6b7d5	Chore: Fix staticcheck issues (#28854 ) * Chore: Fix issues reported by staticcheck Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * Undo changes Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	077eab1b24	Chore: Use net.JoinHostPort (#28421 ) Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	a5d9196a53	Chore/fix lint issues (#27704 ) * Chore: Fix linting issues Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Leonard Gram	c266f45858	LDAP: users without org mappings are marked as disabled (#26650 ) * LDAP: users without org mappings are marked as disabled * Update pkg/services/ldap/ldap.go Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com> * LDAP: verifies that unmapped users are tagged as isDisabled Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	16c185c3b9	Chore: Drop xerrors dependency (#26718 ) Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	d4e4cb4c71	Chore: Enable Go linter gocritic (#26224 ) * Chore: Enable gocritic linter Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	41d432b5ae	Chore: Enable whitespace linter (#25903 ) Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
annegies	a2737c0896	Remove break from ldap, get all groups from all the group base searches specified (#25825 ) Signed-off-by: Annegies van 't Zand <ace.vtzand@gmail.com>	5 years ago
Emil Tullstedt	e8b5f2330d	Settings: Expand variables in configuration (#25075 )	5 years ago
Arve Knudsen	07582a8e85	Chore: Fix various spelling errors in back-end code (#25241 ) * Chore: Fix various spelling errors in back-end code Co-authored-by: Sofia Papagiannaki <papagian@users.noreply.github.com> Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>>	5 years ago
Mario Trangoni	5116420e9a	Fix misspell issues (#23905 ) * Fix misspell issues See, $ golangci-lint run --timeout 10m --disable-all -E misspell ./... Signed-off-by: Mario Trangoni <mjtrangoni@gmail.com> * Fix codespell issues See, $ codespell -S './.git' -L 'uint,thru,pres,unknwon,serie,referer,uptodate,durationm' Signed-off-by: Mario Trangoni <mjtrangoni@gmail.com> ci please? * non-empty commit - ci? * Trigger build Co-authored-by: bergquist <carl.bergquist@gmail.com> Co-authored-by: Kyle Brandt <kyle@grafana.com>	5 years ago
Omar Nahhas Sanchez	cf23f15a08	Adding debug line to search ldap. (#23824 )	5 years ago
Ricardo	c3884abf62	Add fallback to search_base_dns if group_search_base_dns is undefined. (#21263 ) * Add fallback to search_base_dns if group_search_base_dns is undefined. refs: #20862 * removed newline to make lint-go happy * Added requested changes on ldap.md for last commit Refs: #21263	5 years ago
Carl Bergquist	f9962eabff	chore: avoid aliasing imports in services (#22499 )	5 years ago
Torkel Ödegaard	4ffff1a312	LDAP: Interpolate env variable expressions in ldap.toml file (#20173 ) * LDAP: Interpolate env variable expressions in ldap.toml file * Removed comment	6 years ago
gotjosh	b20a258b72	LDAP: Show non-matched groups returned from LDAP (#19208 ) * LDAP: Show all LDAP groups * Use the returned LDAP groups as the reference when debugging LDAP We need to use the LDAP groups returned as the main reference for assuming what we were able to match and what wasn't. Before, we were using the configured groups in LDAP TOML configuration file. * s/User name/Username * Add a title to for the LDAP mapping results * LDAP: UI Updates to debug view * LDAP: Make it explicit when we weren't able to match teams	6 years ago
gotjosh	99c799e9b7	Close the connection only if we establish it. (#18897 )	6 years ago
gotjosh	0cbbb43222	LDAP: Add API endpoint to debug user mapping from LDAP (#18833 ) * Move the ReloadLDAPCfg function to the debug file Appears to be a better suite place for this. * LDAP: Return the server information when we find a specific user We allow you to specify multiple LDAP servers as part of LDAP authentication integration. As part of searching for specific users, we need to understand from which server they come from. Returning the server configuration as part of the search will help us do two things: - Understand in which server we found the user - Have access the groups specified as part of the server configuration * LDAP: Adds the /api/admin/ldap/:username endpoint This endpoint returns a user found within the configured LDAP server(s). Moreso, it provides the mapping information for the user to help administrators understand how the users would be created within Grafana based on the current configuration. No changes are executed or saved to the database, this is all an in-memory representation of how the final result would look like.	6 years ago
Oleg Gaidarenko	fb273cb874	LDAP: nitpicks (#18309 ) * LDAP: nitpicks * Add more tests * Correct and clarify comment for Login() method * Rename methods (hail consistency!) * Uppercases first letter of the logs everywhere * Moves method definitions around to more appropriate places Fixes #18295	6 years ago
Oleg Gaidarenko	1e5fc76601	LDAP: improve POSIX support (#18235 ) * LDAP: improve POSIX support * Correctly abtain DN attributes result * Allow more flexibility with comparison mapping between POSIX group & user * Add devenv for POSIX LDAP server * Correct the docs Fixes #18140	6 years ago
Leonard Gram	5d3a60d46e	LDAP: Adds bind before searching LDAP for non-login cases. (#18023 )	6 years ago
Leonard Gram	25506829be	LDAP: Adds back support for single bind. (#17999 )	6 years ago
Oleg Gaidarenko	e2cf7c9698	LDAP: finishing touches (#17945 ) * LDAP:Docs: `active_sync_enabled` setting Mention `active_sync_enabled` setting and enable it by default * LDAP: move "disableExternalUser" method Idea behind new design of the LDAP module is to minimise conflation between other parts of the system, so it would decoupled as much as possible from stuff like database, HTTP transport and etc. Following "Do One Thing and Do It Well" Unix philosophy principal, other things could be better fitted on the consumer side of things. Which what this commit trying to archive * LDAP: correct user/admin binding The second binding was not happening, so if the admin login/password in LDAP configuration was correct, anyone could had login as anyone using incorrect password	6 years ago
Oleg Gaidarenko	444c4d5999	LDAP: Divide the requests (#17885 ) * LDAP: Divide the requests Active Directory does indeed have a limitation with 1000 results per search (default of course). However, that limitation can be workaround with the pagination search feature, meaning `pagination` number is how many times LDAP compatible server will be requested by the client with specified amount of users (like 1000). That feature already embeded with LDAP compatible client (including our `go-ldap`). But slapd server has by default stricter settings. First, limitation is not 1000 but 500, second, pagination workaround presumably (information about it a bit scarce and I still not sure on some of the details from my own testing) cannot be workaround with pagination feature. See https://www.openldap.org/doc/admin24/limits.html https://serverfault.com/questions/328671/paging-using-ldapsearch hashicorp/vault#4162 - not sure why they were hitting the limit in the first place, since `go-ldap` doesn't have one by default. But, given all that, for me `ldapsearch` command with same request as with `go-ldap` still returns more then 500 results, it can even return as much as 10500 items (probably more). So either there is some differences with implementation of the LDAP search between `go-ldap` module and `ldapsearch` or I am missing a step :/. In the wild (see serverfault link), apparently, people still hitting that limitation even with `ldapsearch`, so it still seems to be an issue. But, nevertheless, I'm still confused by this incoherence. To workaround it, I divide the request by no more then 500 items per search	6 years ago
Oleg Gaidarenko	ca136c7c22	Devenv:LDAP: couple simplifications for LDAP (#17807 ) * Add LDAP config instead sed use * Add container name * Add SizeLimit option to client and to server. Probably useless at this point, but it's better to have it then otherwise	6 years ago
Leonard Gram	37e9988e95	ldap: makes mocks available for testing. (#17576 ) * ldap: makes mocks available for testing.	6 years ago
Oleg Gaidarenko	1b1d951495	LDAP: refactoring (#17479 ) * LDAP: use only one struct * Use only models.ExternalUserInfo * Add additional helper method :/ * Move all the helpers to one module * LDAP: refactoring * Rename some of the public methods and change their behaviour * Remove outdated methods * Simplify logic * More tests There is no and never were tests for settings.go, added tests for helper methods (cover is now about 100% for them). Added tests for the main LDAP logic, but there is some stuff to add. Dial() is not tested and not decoupled. It might be a challenge to do it properly * Restructure tests: * they wouldn't depend on external modules * more consistent naming * logical division * More guards for erroneous paths * Login: make login service an explicit dependency * LDAP: remove no longer needed test helper fns * LDAP: remove useless import * LDAP: Use new interface in multildap module * LDAP: corrections for the groups of multiple users * In case there is several users their groups weren't detected correctly * Simplify helpers module	6 years ago
Oleg Gaidarenko	a3092dc57b	LDAP: remove unused function (#17351 )	6 years ago
Oleg Gaidarenko	de92c360a1	LDAP: reduce API and allow its extension (#17209 ) * Removes Add/Remove methods * Publicise necessary fields and methods so we could extend it * Publicise mock API * More comments and additional simplifications * Sync with master Still having low coverage :/ - should be addressed in #17208	6 years ago
Oleg Gaidarenko	9b7f9dd9be	LDAP: consistently name the LDAP entities (#17203 )	6 years ago
Alexander Zobnin	2d03815770	Users: Disable users removed from LDAP (#16820 ) * Users: add is_disabled column * Users: disable users removed from LDAP * Auth: return ErrInvalidCredentials for failed LDAP auth * User: return isDisabled flag in user search api * User: mark disabled users at the server admin page * Chore: refactor according to review * Auth: prevent disabled user from login * Auth: re-enable user when it found in ldap * User: add api endpoint for disabling user * User: use separate endpoints to disable/enable user * User: disallow disabling external users * User: able do disable users from admin UI * Chore: refactor based on review * Chore: use more clear error check when disabling user * Fix login tests * Tests for disabling user during the LDAP login * Tests for disable user API * Tests for login with disabled user * Remove disable user UI stub * Sync with latest LDAP refactoring	6 years ago
Oleg Gaidarenko	a0f5923b95	LDAP: add tests for initialBind (#17132 ) * LDAP: add tests for initialBind * LDAP: clarify comment for Login()	6 years ago
Oleg Gaidarenko	35f227de11	Feature: LDAP refactoring (#16950 ) * incapsulates multipleldap logic under one module * abstracts users upsert and get logic * changes some of the text error messages and import sort sequence * heavily refactors the LDAP module – LDAP module now only deals with LDAP related behaviour * integrates affected auth_proxy module and their tests * refactoring of the auth_proxy logic	6 years ago
Oleg Gaidarenko	79ac3fd699	Chore: remove use of `== false` (#17036 ) Interestingly enough, golint or revive doesn't not prohibit the use that construction :) Ref #17035	6 years ago
zhulongcheng	2fff8f77dc	move log package to /infra (#17023 ) ref #14679 Signed-off-by: zhulongcheng <zhulongcheng.me@gmail.com>	6 years ago
Samuel	846b9327a5	LDAP: Added reload endpoint for LDAP config (#15470 ) * 4843 - Added reload endpoint for LDAP config closes #4843 * Refactor to make the reload work after master drifted	6 years ago

1 2

51 Commits (502c6e4e6b0e160a9d5bb49d5f432d4bc940f60c)