grafana

Commit Graph

Author	SHA1	Message	Date
Marcos de Oliveira	91582ba03d	LDAP: Make LDAP attribute mapping case-insensitive (#58992 ) * Make LDAP attribute mapping case-insensitive * Add test case with attribute name different from schema's * Add fix to getArrayAttribute also and add test with mismatched letter case. * Update pkg/services/ldap/helpers.go Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>	3 years ago
Jo	77437f2c89	Add multi-auth devenv (#57609 ) * add authentik devenv * remove direct dependency on spew * use cn * add authentik instructions * add backup instructions	3 years ago
Gabriel MABILLE	5fcec05695	LDAP: log that organization mapping is skipped (#56796 )	3 years ago
Gabriel MABILLE	10c080dad1	LDAP: Add `skip_org_role_sync` configuration option (#56679 ) * LDAP: Add skip_org_role_sync option * Document the new config option * Nit on docs * Update docs/sources/setup-grafana/configure-security/configure-authentication/ldap.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Docs suggestions Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com> * Add test, Fix disabled user when no role Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Jo	062d255124	Handle ioutil deprecations (#53526 ) * replace ioutil.ReadFile -> os.ReadFile * replace ioutil.ReadAll -> io.ReadAll * replace ioutil.TempFile -> os.CreateTemp * replace ioutil.NopCloser -> io.NopCloser * replace ioutil.WriteFile -> os.WriteFile * replace ioutil.TempDir -> os.MkdirTemp * replace ioutil.Discard -> io.Discard	3 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445 ) * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Jo	1f8b1eef75	SAML: Do not SAML SLO if user is not SAML authenticated (#53418 ) * Only SLO user if the user is using SAML * only one source of truth for auth module info * ensure SAML is also enabled and not only SLO * move auth module naming to auth module login package * use constants in other previously unused spots	3 years ago
Jo	09c95bc31f	TeamSync: Fix team syncing out of orgs mapped by auth method (#53257 )	3 years ago
Jo	c9c4fc604e	LDAP: Improve errors and documentation (#52111 )	3 years ago
hannes-256	62b0a8bae6	LDAP: Allow specifying LDAP timeout (#48870 ) * Allow specifying LDAP timeout * Update docs/sources/auth/ldap.md Co-authored-by: brendamuir <100768211+brendamuir@users.noreply.github.com> * LDAP timeout: Add annotations; Make functions "private" * Setting the default timeout if unspecified * fix goimports lint issue Co-authored-by: brendamuir <100768211+brendamuir@users.noreply.github.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: jguer <joao.guerreiro@grafana.com>	3 years ago
Kat Yang	3c3039f5b3	Chore: Remove Wrap (#50048 ) * Chore: Remove Wrap and Wrapf * Fix: Add error check	3 years ago
sh0rez	3d5d8c785b	pkg/web: restrict handler types (#48495 ) Makes `pkg/web` only accept handles from the following set: ```go handlerStd = func(http.ResponseWriter, http.Request) handlerStdCtx = func(http.ResponseWriter, http.Request, web.Context) handlerStdReqCtx = func(http.ResponseWriter, http.Request, models.ReqContext) handlerReqCtx = func(models.ReqContext) handlerReqCtxRes = func(models.ReqContext) Response handlerCtx = func(web.Context) ``` This is a first step to reducing above set to only `http.Handler`. --- Due to a cyclic import situation between `pkg/models` and `pkg/web`, parts of this PR were put into `pkg/api/response`, even though they definitely do not belong there. This however is _temporary_ until we untangle `models.ReqContext`.	3 years ago
Krzysztof Dąbrowski	5be23b40b6	LDAP: allow Grafana Admin mapping without org_role field (#37189 )	3 years ago
Krzysztof Dąbrowski	c41397a6e7	LDAP: validate organization role during parsing (#37188 ) * LDAP: validate organization role during parsing * Trigger a new build * Check if grafana_admin is present	3 years ago
Gabriel MABILLE	94fd03f44f	LDAP: Fix debug view to display the actual computed mapping in ldap.go (#48103 ) * LDAP debug fix with Org role inheritance Co-authored-by: Jguer <joao.guerreiro@grafana.com> * ldap debug coherent with ldap.go Co-authored-by: Jguer <joao.guerreiro@grafana.com> Co-authored-by: Jguer <joao.guerreiro@grafana.com>	3 years ago
Selene	875e0736ec	LDAP: Use an interface instead of a bus to get group teams (#42165 ) * Remove bus for GetTeams for LDAP * Fix lint	3 years ago
Emil Tullstedt	ad971cc9be	LDAP: Search all DNs for users (#38891 )	4 years ago
Arve Knudsen	d27a72f859	IPv6: Support host address configured with enclosing square brackets (#31226 ) Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	4 years ago
Arve Knudsen	116809ed7f	services/provisioning: Various cleanup (#30396 ) Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	4 years ago
Arve Knudsen	c2cad26ca9	Chore: Disable default golangci-lint filter (#29751 ) * Disable default golangci-lint filter Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * Chore: Fix linter warnings Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	12661e8a9d	Move middleware context handler logic to service (#29605 ) * middleware: Move context handler to own service Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> Co-authored-by: Emil Tullsted <sakjur@users.noreply.github.com> Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>	5 years ago
Arve Knudsen	f326b79cc1	Security: Add gosec G304 auditing annotations (#29578 ) * Security: Add gosec G304 auditing annotations Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * Add gosec annotations Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * Add gosec annotations Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * add G304 auditing comment Signed-off-by: bergquist <carl.bergquist@gmail.com> * Add gosec annotations Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * space Signed-off-by: bergquist <carl.bergquist@gmail.com> * Add gosec annotations Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> Co-authored-by: bergquist <carl.bergquist@gmail.com>	5 years ago
Arve Knudsen	752a424e1f	Auth proxy: Return standard error type (#29502 ) * Rewrite auth proxy tests to use standard lib Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * Auth proxy: Use standard error type Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	9593d57914	Chore: Enable errorlint linter (#29227 ) * Enable errorlint linter * Handle wrapped errors Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>	5 years ago
Arve Knudsen	7897c6b7d5	Chore: Fix staticcheck issues (#28854 ) * Chore: Fix issues reported by staticcheck Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> * Undo changes Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	077eab1b24	Chore: Use net.JoinHostPort (#28421 ) Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	a5d9196a53	Chore/fix lint issues (#27704 ) * Chore: Fix linting issues Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Leonard Gram	c266f45858	LDAP: users without org mappings are marked as disabled (#26650 ) * LDAP: users without org mappings are marked as disabled * Update pkg/services/ldap/ldap.go Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com> * LDAP: verifies that unmapped users are tagged as isDisabled Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	16c185c3b9	Chore: Drop xerrors dependency (#26718 ) Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	d4e4cb4c71	Chore: Enable Go linter gocritic (#26224 ) * Chore: Enable gocritic linter Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	41d432b5ae	Chore: Enable whitespace linter (#25903 ) Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
annegies	a2737c0896	Remove break from ldap, get all groups from all the group base searches specified (#25825 ) Signed-off-by: Annegies van 't Zand <ace.vtzand@gmail.com>	5 years ago
Emil Tullstedt	e8b5f2330d	Settings: Expand variables in configuration (#25075 )	5 years ago
Arve Knudsen	07582a8e85	Chore: Fix various spelling errors in back-end code (#25241 ) * Chore: Fix various spelling errors in back-end code Co-authored-by: Sofia Papagiannaki <papagian@users.noreply.github.com> Co-authored-by: Josh Soref <jsoref@users.noreply.github.com>>	5 years ago
Mario Trangoni	5116420e9a	Fix misspell issues (#23905 ) * Fix misspell issues See, $ golangci-lint run --timeout 10m --disable-all -E misspell ./... Signed-off-by: Mario Trangoni <mjtrangoni@gmail.com> * Fix codespell issues See, $ codespell -S './.git' -L 'uint,thru,pres,unknwon,serie,referer,uptodate,durationm' Signed-off-by: Mario Trangoni <mjtrangoni@gmail.com> ci please? * non-empty commit - ci? * Trigger build Co-authored-by: bergquist <carl.bergquist@gmail.com> Co-authored-by: Kyle Brandt <kyle@grafana.com>	5 years ago
Omar Nahhas Sanchez	cf23f15a08	Adding debug line to search ldap. (#23824 )	5 years ago
Ricardo	c3884abf62	Add fallback to search_base_dns if group_search_base_dns is undefined. (#21263 ) * Add fallback to search_base_dns if group_search_base_dns is undefined. refs: #20862 * removed newline to make lint-go happy * Added requested changes on ldap.md for last commit Refs: #21263	5 years ago
Carl Bergquist	f9962eabff	chore: avoid aliasing imports in services (#22499 )	5 years ago
Torkel Ödegaard	4ffff1a312	LDAP: Interpolate env variable expressions in ldap.toml file (#20173 ) * LDAP: Interpolate env variable expressions in ldap.toml file * Removed comment	6 years ago
gotjosh	b20a258b72	LDAP: Show non-matched groups returned from LDAP (#19208 ) * LDAP: Show all LDAP groups * Use the returned LDAP groups as the reference when debugging LDAP We need to use the LDAP groups returned as the main reference for assuming what we were able to match and what wasn't. Before, we were using the configured groups in LDAP TOML configuration file. * s/User name/Username * Add a title to for the LDAP mapping results * LDAP: UI Updates to debug view * LDAP: Make it explicit when we weren't able to match teams	6 years ago
gotjosh	99c799e9b7	Close the connection only if we establish it. (#18897 )	6 years ago
gotjosh	0cbbb43222	LDAP: Add API endpoint to debug user mapping from LDAP (#18833 ) * Move the ReloadLDAPCfg function to the debug file Appears to be a better suite place for this. * LDAP: Return the server information when we find a specific user We allow you to specify multiple LDAP servers as part of LDAP authentication integration. As part of searching for specific users, we need to understand from which server they come from. Returning the server configuration as part of the search will help us do two things: - Understand in which server we found the user - Have access the groups specified as part of the server configuration * LDAP: Adds the /api/admin/ldap/:username endpoint This endpoint returns a user found within the configured LDAP server(s). Moreso, it provides the mapping information for the user to help administrators understand how the users would be created within Grafana based on the current configuration. No changes are executed or saved to the database, this is all an in-memory representation of how the final result would look like.	6 years ago
Oleg Gaidarenko	fb273cb874	LDAP: nitpicks (#18309 ) * LDAP: nitpicks * Add more tests * Correct and clarify comment for Login() method * Rename methods (hail consistency!) * Uppercases first letter of the logs everywhere * Moves method definitions around to more appropriate places Fixes #18295	6 years ago
Oleg Gaidarenko	1e5fc76601	LDAP: improve POSIX support (#18235 ) * LDAP: improve POSIX support * Correctly abtain DN attributes result * Allow more flexibility with comparison mapping between POSIX group & user * Add devenv for POSIX LDAP server * Correct the docs Fixes #18140	6 years ago
Leonard Gram	5d3a60d46e	LDAP: Adds bind before searching LDAP for non-login cases. (#18023 )	6 years ago
Leonard Gram	25506829be	LDAP: Adds back support for single bind. (#17999 )	6 years ago
Oleg Gaidarenko	e2cf7c9698	LDAP: finishing touches (#17945 ) * LDAP:Docs: `active_sync_enabled` setting Mention `active_sync_enabled` setting and enable it by default * LDAP: move "disableExternalUser" method Idea behind new design of the LDAP module is to minimise conflation between other parts of the system, so it would decoupled as much as possible from stuff like database, HTTP transport and etc. Following "Do One Thing and Do It Well" Unix philosophy principal, other things could be better fitted on the consumer side of things. Which what this commit trying to archive * LDAP: correct user/admin binding The second binding was not happening, so if the admin login/password in LDAP configuration was correct, anyone could had login as anyone using incorrect password	6 years ago
Oleg Gaidarenko	444c4d5999	LDAP: Divide the requests (#17885 ) * LDAP: Divide the requests Active Directory does indeed have a limitation with 1000 results per search (default of course). However, that limitation can be workaround with the pagination search feature, meaning `pagination` number is how many times LDAP compatible server will be requested by the client with specified amount of users (like 1000). That feature already embeded with LDAP compatible client (including our `go-ldap`). But slapd server has by default stricter settings. First, limitation is not 1000 but 500, second, pagination workaround presumably (information about it a bit scarce and I still not sure on some of the details from my own testing) cannot be workaround with pagination feature. See https://www.openldap.org/doc/admin24/limits.html https://serverfault.com/questions/328671/paging-using-ldapsearch hashicorp/vault#4162 - not sure why they were hitting the limit in the first place, since `go-ldap` doesn't have one by default. But, given all that, for me `ldapsearch` command with same request as with `go-ldap` still returns more then 500 results, it can even return as much as 10500 items (probably more). So either there is some differences with implementation of the LDAP search between `go-ldap` module and `ldapsearch` or I am missing a step :/. In the wild (see serverfault link), apparently, people still hitting that limitation even with `ldapsearch`, so it still seems to be an issue. But, nevertheless, I'm still confused by this incoherence. To workaround it, I divide the request by no more then 500 items per search	6 years ago
Oleg Gaidarenko	ca136c7c22	Devenv:LDAP: couple simplifications for LDAP (#17807 ) * Add LDAP config instead sed use * Add container name * Add SizeLimit option to client and to server. Probably useless at this point, but it's better to have it then otherwise	6 years ago
Leonard Gram	37e9988e95	ldap: makes mocks available for testing. (#17576 ) * ldap: makes mocks available for testing.	6 years ago

1 2

61 Commits (7339dbc09013608b7819ec16dee801bee6781aa2)