grafana

Commit Graph

Author	SHA1	Message	Date
Serge Zaitsev	8187d8cb66	Chore: capitalise log message for auth packages (#74332 )	2 years ago
Ryan McKinley	025b2f3011	Chore: use any rather than interface{} (#74066 )	2 years ago
Marcus Efraimsson	040b7d2571	Chore: Add errutils helpers (#73577 ) Add helpers for the errutil package in favor of errutil.NewBase.	2 years ago
Karl Persson	43aab615c3	Auth: Remove unused Authenticator service (#73143 ) Auth: remove unused Authenticator service	2 years ago
Eric Leijonmarck	95760cb021	Auth: OAuth sets `skip_org_role_sync = true` for auth.google by default (#72819 ) * sets skip_org_role_sync to true for google * add google skiporgrolesync and sets to true always * add field * Update docs/sources/setup-grafana/configure-security/configure-authentication/google/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * add AKS to words * script back to mina --------- Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>	2 years ago
Eric Leijonmarck	27f57fe112	Auth: Add missing skipOrgRoleSync property to SocialBase for GenericOAuth (#72752 ) * add missing cfg for skiporgrolesync * add google skiporgrolesync * removed google skip * update docs to reflect google * remove docs update for google	2 years ago
Jo	e4649e7099	Auth: Add azure warning for conflicting settings (#72289 ) * add conflicting option debug warning * add warning for Grafana Admin sync in auth config	2 years ago
Jo	348233bddb	Auth: Gitlab Improve group fetching when using read_api (#72277 ) * improve group fetching when using read api * add constant for access level	2 years ago
Jo	1d6b9625b8	AzureAD: Fix missing context (#71717 ) fix missing context	2 years ago
Jo	914e0bf87e	Auth: Surface organization membership error (#71750 ) surface organization membership error	2 years ago
Jo	0ffd359801	Auth: Enforce role sync except if skip org role sync is enabled (#70766 ) * enforce role sync except if skip org role sync is enabled * move errors to errors file and set codes * fix docs and defaults * remove legacy parameter * support fall through token-api in generic oauth * fix error handling for generic_oauth * Update pkg/login/social/generic_oauth.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update pkg/login/social/gitlab_oauth_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update pkg/login/social/gitlab_oauth_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Misi	dcf26564db	OAuth: Introduce user_refresh_token setting and make it default for the selected providers (#71533 ) * First changes * WIP docs * Align current tests * Add test for UseRefreshToken * Update docs * Fix * Remove unnecessary AuthCodeURL from generic_oauth * Change GitHub to disable use_refresh_token by default	2 years ago
Jo	fbfdd6ba32	Auth: Add support for custom signing keys in auth.azure_ad (#71365 ) * fallthrough JWKS validation and caching for Azure * remove unused field	2 years ago
Douglas Adams	3a245e4945	Auth: Fix US gov azure ad oauth URL parsing (#71254 ) Updates regex for tenant ID parsing to support .us domains in addition to .com domains for Azure AD. Fixes #71252	2 years ago
Jo	d6c468c1c2	Auth: Add empty role definition (#64694 ) * Allow setting role as None Co-authored-by: gamab <gabi.mabs@gmail.com> Seeking for places where role.None would be used Co-authored-by: Jguer <joao.guerreiro@grafana.com> Adding None role to the frontend Co-authored-by: Jguer <joao.guerreiro@grafana.com> unify org role declaration and remove from add permission fix backend test fix backend lint * remove role none from frontend * Simplify checks Co-authored-by: Kalle Persson <kalle.persson@grafana.com> * nits --------- Co-authored-by: Kalle Persson <kalle.persson@grafana.com>	2 years ago
Jo	ae5b818c6e	Chore: Remove unused import social.go (#70668 ) remove unused import	2 years ago
Jo	11d196eb6e	Auth: Support google OIDC and group fetching (#70140 ) * Auth: Update Google OAuth default configuration based on /.well-known/openid-configuration #69520 Signed-off-by: junya koyama <arukiidou@yahoo.co.jp> * add id_token parsing add legacy API distinction use google auth oidc connectors add group fetching support and tests * Apply suggestions from code review Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * implement review feedback * indent docs --------- Signed-off-by: junya koyama <arukiidou@yahoo.co.jp> Co-authored-by: junya koyama <arukiidou@yahoo.co.jp> Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	2 years ago
Misi	0e3fbbf636	Auth: Add missing context parameter (#70565 ) Add missing parameter	2 years ago
Jo	4821175d40	Auth: Add auth.azure_ad security improvements (#912 ) * security improvements id_token * add audience validation * add allowOrganizations * add allowOrganizations tests and documentation * add log warn on no configuration * anonymize tenant id * Apply suggestions from code review Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update pkg/login/social/azuread_oauth_test.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update pkg/login/social/azuread_oauth_test.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * optimize key validation and add mising fields * fix missing key_id * lint * Update docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> * lint docs --------- Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	2 years ago
Jo	26b66fda4b	Auth: Support Gitlab OIDC scopes (#69890 ) * draft gitlab openid * mutualize id token extraction * unexport fields * user user info endpoint for retrieving indirect group memberships * add to readme * fix missing doc * fix generic oauth wrong parameter * log token	2 years ago
Jo	914daef0fd	Auth: Add request context to UserInfo calls (#70007 ) * use context for UserInfo requests * set timeouts for oauth http client * Update pkg/login/social/common.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	2 years ago
MichaelKo	e7e70dbac6	Chore: Adding "allowed_groups" Configuration Parameter to Generic OAuth Method (#69025 ) * feat: add allowed_groups for Generic OAuth * docs: add allowed_groups more docs for Generic OAuth	2 years ago
Erik Sundell	4089514432	Auth: Make GitHub auth's allowed_organizations be case insensitive (#66879 ) * Auth: Make GitHub auth's allowed_organizations be case insensitive * Apply code suggestion to use strings.EqualFold	2 years ago
Karl Persson	7cd6018253	GenericOAuth: Set sub as auth id (#65902 ) * GenericOAuth: Set sud as auth id * GenericOAuth: Extract function to reduce complexity	2 years ago
Serge Zaitsev	a38f230d37	Chore: Remove result fields from login (#65136 ) * remove result fields from login * fix tests * fix tests * another shadowing	2 years ago
Eric Leijonmarck	3cd952b8ba	Auth: Fix orgrole picker disabled if isSynced user (#64033 ) * fix: disable orgrolepicker if externaluser is synced * add disable to role picker * just took me 2 hours to center the icon * wip * fix: check externallySyncedUser for API call * remove check from store * add: tests * refactor authproxy and made tests run * add: feature toggle * set feature toggle for tests * add: IsProviderEnabled * refactor: featuretoggle name * IsProviderEnabled tests * add specific tests for isProviderEnabled * fix: org_user tests * add: owner to featuretoggle * add missing authlabels * remove fmt * feature toggle * change config * add test for a different authmodule * test refactor * gen feature toggle again * fix basic auth user able to change the org role * test for basic auth role * make err.base to error * lowered lvl of log and input mesg	2 years ago
Jo	ccbf200c4a	SupportBundles: Add OAuth bundle collectors (#64810 ) * wip * add oauth support bundles * add specific configs for generic oauth and azureAD * add doc entry * optimize struct packing * Update pkg/login/social/azuread_oauth.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * nit update --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	2 years ago
Karl Persson	872d2d1e1c	AuthN: Login error handling (#64239 ) * Social: Fix type so it appears in error responses * AuthN: construct errutil.Error from social.Error * login: Check for errutil.Error and use public message * Login: redirectURLWithErrorCookie for authn errors Co-authored-by: Jo <joao.guerreiro@grafana.com>	2 years ago
Jo	45fde4235b	Deps: Replace go-jose v2 with go-jose v3 (#64228 ) replace go-jose v2 with go-jose v3	2 years ago
Jo	d4cfbd9fd3	LDAP: Move LDAP globals to Config (#63255 ) * structure dtos and private methods * add basic LDAP service * use LDAP service in ldap debug API * lower non fatal error * remove unused globals * wip * remove final globals * fix tests to use cfg enabled * restructure errors * remove logger from globals * use ldap service in authn * use ldap service in context handler * fix failed tests * fix ldap middleware provides * fix provides in auth_test.go	2 years ago
Jo	6322fce725	LDAP: Move to single package cluster (#63035 ) * move multildap to ldap package * move LDAP api and tests to ldap package * register background service * lint	2 years ago
Eric Leijonmarck	7019287f88	Auth: Add deprecation notice for oauth_skip_org_role_update_sync (#62712 ) * add: deprecaation notice for overall setting * add: deprecation notice for configuration files * chore: update docs with deprecation notice * refactor: change to note the new setting instead * Update pkg/setting/setting.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * refactor: based on review comments --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Eric Leijonmarck	161ff6d310	Auth: Add test for oauth okta skip org role sync (#62547 ) * add tests to oauth okta * refactor: tests to make them work with the new structure * add: three tests for okta oauth provider	2 years ago
Jo	14a78b58e9	Authn: Stat registration (#62934 ) * reorganize auth usage stats * usage stat privilege elevators * stat count of modified role * cfg related info * add authn anon client * kv store * ensure anon enabled is collected even if client is not registered * fix usage stats test	2 years ago
Eric Leijonmarck	8ff19bd901	Auth: Add Generic oauth skip org role sync setting (#62418 ) * add: generic oauth skip org role sync * add: docs * add: backend login skip sync * fix: docs typo * add: tests * remove public key * fix markdown for generic oauth * add: generic oauth to the configuration * refactor: change debug to warn	2 years ago
Eric Leijonmarck	a232e7ceca	Auth: Add skip_org_role_sync for Okta (#62106 ) * WIP * Update pkg/services/login/authinfo.go * fix: merge * change order to internal last * adds: docs * add: configuration for defaults and sample * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> --------- Co-authored-by: Jo <joao.guerreiro@grafana.com> Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>	2 years ago
Serge Zaitsev	7dbd2cd139	Chore: Fix goimports grouping (#62426 ) fix goimports ordering	2 years ago
Kristin Laemmert	9256a520a4	chore: move user_auth models to (mostly) login service (#62269 ) * chore: move user_auth models to (mostly) login service	2 years ago
Jo	4bcd3b41ec	Server: Remove unused services (#62015 ) remove unused entries Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Eric Leijonmarck	6bd11e0ebf	Auth: Add skip_org_role_sync setting for github (#61673 ) * add: skip_org_role_sync setting for github * fix: frontend * rearranged tests * refactor: assignGrafanaAdmin skip also * Add: tests for allowGrafanaAdmin - both for the case when both settings are set and the setting for only allowGrafanaAdmin * Apply suggestions from code review Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update pkg/login/social/github_oauth.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * added vairable inside scope * Update docs/sources/setup-grafana/configure-security/configure-authentication/github/index.md * Update docs/sources/setup-grafana/configure-security/configure-authentication/github/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	2 years ago
Eric Leijonmarck	143ee0c49f	Auth: Add skip_org_role_sync to GitLab OAuth (#62055 ) * Auth: Add skip_org_role_sync to GitLab OAuth - add: tests - docs added * Update pkg/login/social/gitlab_oauth.go Co-authored-by: Karl Persson <kalle.persson@grafana.com> * fix: for import Co-authored-by: Karl Persson <kalle.persson@grafana.com>	2 years ago
Alexander Zobnin	60ef88c918	SAML: Support auto login (#61685 ) * SAML: Support auto login * Add individual auto_login option for each OAuth provider * Docs: Describe new auto_login option * Minor refactor	2 years ago
Eric Leijonmarck	c5e74ee607	Auth: Add skip_org_role_sync for AzureAD OAuth (#60322 ) * [WIP] Auth: add backend skipOrgRoleSync to AzureAD OAuth - add: skipOrgRoleSync - rename: skipOrgRoleSync to skipOrgRoleSyncBase (to make it clear that it is the base version of SocialBase) - add: tests for skipOrgRoleSync in AzureAD TODO: - [ ] frontend changes * add: docs * refactor: remove role from basicinfo * add: settings for grafanacom * add: settigns for frontend * add: logic for azureAD user skip org role * add: docs for skip_org_role_sync * refactor: docs a bit * add: tests for userinfo * refactor: to only extract if skiporgrolesync false * refactor: based on review comments * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>	2 years ago
Eric Leijonmarck	91322bebb5	Auth: Add skip_org_role_sync setting for GrafanaCom (#60553 ) * add frontend settings and setting for grafanacom * removed println * add skip-org-role-sync on login * add deprecation notice for this field * remove println * remove newline * change and renamed variables * fix for reconfiguring the settings for grafanacom * add documentationf or grafanacom setup * WIP tests * added tests * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * updated steps * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * doc: updated the docs to reflect what happens to grafana.com users * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/grafana-com/index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * add blankline * rephrase of doc improvements for explaing of the settings * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Jo <joao.guerreiro@grafana.com> * add frontend setting for grafanacom. * WIP tests * refactor docs * frontend to adhere to skipping org role sync for GrafanaCom users * update docs to reflect desired behavior * tests: added test for skip and nonskip * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> * Update docs/sources/setup-grafana/configure-grafana/_index.md Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> Co-authored-by: Jo <joao.guerreiro@grafana.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	2 years ago
Sean Dague	4de0149bd9	OAuth: Support pagination for GitHub orgs (#58648 ) * Support pagination for github orgs * fix unused variable * Increase initial page to 100 per the way teams work	2 years ago
Misi	6d8bf5ac01	LDAP: Disable user in case it has been removed from LDAP directory (#60231 ) * Fix login flow * Align test * Fix comments * Improve test	2 years ago
Karl Persson	189bf102cf	LoginAttempt: Move logic around login attempts into the service (#58962 ) * LoginAttemps: Remove from sqlstore mock * LoginAttemps: Move from models package to service package * LoginAttemps: Implement functionallity from brute force login in service * LoginAttemps: Call service * LoginAttempts: Update name and remove internal functions * LoginAttempts: Add tests * LoginAttempt: Add service fake * LoginAttempt: Register service as a background_services and remove job from cleanup service * LoginAttemps: Remove result from command struct * LoginAttempt: No longer pass pointers	3 years ago
Misi	9c98314e9f	OAuth: Refactor OAuth parameters handling to support obtaining refresh tokens for Google OAuth (#58782 ) * Add ApprovalForce to AuthCodeOptions * Extract access token validity check to a function * Refactor * Oauth: set options internally instead of exposing new function * Align tests * Remove unused function Co-authored-by: Karl Persson <kalle.persson@grafana.com>	3 years ago
Karl Persson	6e3cb2e3ed	Oauth: Remove unused function for oauth implementations (#58887 ) * Oauth: remove unused function * Oauth: remove unused Oauth types	3 years ago
Jo	eb84358aa7	Auth: Validate Azure ID token version on login is not v1 (#58088 )	3 years ago

1 2 3 4 5 ...

261 Commits (8187d8cb660b83629b9dc5c270754fadf43fe242)