186 Commits (85b0b47efdd811b46af2715aec7a54943d985ea6)

Author	SHA1	Message	Date
Filip "Ret2Me" Poplewski	561156c4da	Auth: Add support for the TlsSkipVerify parameter to JWT Auth (#91514) ... * feat(auth/JWTAuth): add support for the TlsSkipVerify parameter * feat(auth/JWTAuth): add param to default.ini and sample.ini --------- Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com>	3 months ago
Karl Persson	be60ef0500	IDToken: cache invalidation (#100592) ... * Make org role part of id token cache key. This way we will always sign a new token when it changes * Remove calls to remove id token	3 months ago
Misi	ee0a1391df	Auth: Add OrgRole to ID token (#100383) ... * Changes for Users and ServiceAccounts * Align tests	3 months ago
Ryan McKinley	680e6bc1f8	Authlib: Use types package rather than claims (#99243)	4 months ago
Karl Persson	3a17d0c927	IAM: align AuthInfo interface (#97228) ... * Update to use updated interface	6 months ago
Misi	84b8296ffb	OAuth: Use the attached external session data in OAuthToken and OAuthTokenSync (#96655) ... * wip * wip + tests * wip * wip opt2 * Use authn.Identity struct's SessionToken * Merge fixes * Handle disabling the feature flag correctly * Fix test * Cleanup * Remove HasOAuthEntry from the OAuthTokenService interface * Remove unused function	6 months ago
Karl Persson	76f052e8de	Requester: Remove duplicated function (#97038) ... * Remove duplicated function * Remove GetDisplayName from interface * Use GetName	6 months ago
Gabriel MABILLE	bd53fa9580	LocalSigner: Remove unused dependency (#96118) ... ID Token Signer: Remove unecessary deps	7 months ago
Misi	986c024dd7	Auth: Update SAML lib (#94745) ... * Update lib * Add missing TestIntegration prefix * Update go.sum, go.work.sum	7 months ago
Karl Persson	3bcbf231ee	IDToken: fix namespace format (#95341) ... * Bump authlib version * Remove temporary formatter and start signing tokens with `stacks-` prefix * update workspace	7 months ago
linoman	3270a9c959	Session Refactor: Add auth module label to session's list (#94958) ... * Add AuthModule to token API * Add badge to UserSessions * Change idp label rendering * Render IdP label for User Profile page * Add i18n labels	7 months ago
Misi	bd7850853e	Auth: Attach external session info to Grafana session (#93849) ... * initial from poc changes * wip * Remove public external session service * Update swagger * Fix merge * Cleanup * Add backgroud service for cleanup * Add auth_module to user_external_session * Add tests for token revocation functions * Add secret migration capabilities for user_external_session fields * Cleanup, refactor to address feedback * Fix test	8 months ago
Claudiu Dragalina-Paraipan	a8b07b0c81	[authn] use authlib client+interceptors for in-proc mode (#93124) ... * Add authlib gRPC authenticators for in-proc mode * implement `StaticRequester` signing in the unified resource client - [x] when the `claims.AuthInfo` value type is `identity.StaticRequester`, and there's no ID token set, create an internal token and sign it with symmetrical key. This is a workaround for `go-jose` not offering the possibility to create an unsigned token. - [x] update `IDClaimsWrapper` to support the scenario above - [x] Switch to using `claims.From()` in `dashboardSqlAccess.SaveDashboard()` --------- Co-authored-by: gamab <gabriel.mabille@grafana.com>	8 months ago
Ryan McKinley	82417c916f	K8s: Use stacks plural not singular in grafana namespaces (#92550)	9 months ago
Charandas	4f024d94d8	Authn: resolve issues with setting up a nil identity (#92620)	9 months ago
Ryan McKinley	2e60f28044	Auth: remove id token flag (#92209)	9 months ago
Karl Persson	8d36111420	IDForwarding: Set identity type and uid (#91830) ... * Set identity type and uid * Set uid without prefix * Update authlib version * Update to new claim name	10 months ago
Karl Persson	8bcd9c2594	Identity: Remove typed id (#91801) ... * Refactor identity struct to store type in separate field * Update ResolveIdentity to take string representation of typedID * Add IsIdentityType to requester interface * Use IsIdentityType from interface * Remove usage of TypedID * Remote typedID struct * fix GetInternalID	10 months ago
Ryan McKinley	21d4a4f49e	Auth: use IdentityType from authlib (#91763)	10 months ago
Karl Persson	bcfb66b416	Identity: remove GetTypedID (#91745)	10 months ago
Claudiu Dragalina-Paraipan	e2435f92f1	[authn]: add GetIDClaims() to Requester (#91387) ... * authn: add GetIDClaims() to Requester Co-Authored-By: Gabriel MABILLE <gamab@users.noreply.github.com> * authn: update StaticRequester Co-Authored-By: Gabriel MABILLE <gamab@users.noreply.github.com> * update auth/idtest/mock Co-Authored-By: Gabriel MABILLE <gamab@users.noreply.github.com> * Fix test Co-authored-by: Claudiu Dragalina-Paraipan <claudiu.dragalina@grafana.com> --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: gamab <gabriel.mabille@grafana.com>	10 months ago
colin-stuart	057c04ed9d	IDToken: Add current user's DisplayName to the ID token (#90992) ... Set claims.Rest.DisplayName from the IDService	10 months ago
Ryan McKinley	728150bdbd	Identity: extend k8s user.Info (#90937)	10 months ago
Ryan McKinley	9db3bc926e	Identity: Rename "namespace" to "type" in the requester interface (#90567)	10 months ago
Misi	69c5fa8361	IDToken: Add current user's Username and UID to the ID token (#90240) ... * Set claims.Rest.Login from the IDService * Add UID to the ID token	11 months ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116)	12 months ago
Misi	ed6b3e9e7c	Auth: Introduce pre-logout hooks + add GCOM LogoutHook (#88475) ... * Introduce preLogoutHooks in authn service * Add gcom_logout_hook * Config the api token from the Grafana config file * Simplify * Add tests for logout hook * Clean up * Update * Address PR comment * Fix	1 year ago
Karl Persson	9977258d04	AuthN: Set uid during authentication (#87797) ... * Identity: Remove GetNamespacedUID and use GetUID instead * Authn: Set uid for users and service accounts	1 year ago
Karl Persson	be5ced4287	Identity: Use typed version of namespace id (#87257) ... * Remove different constructors and only use NewNamespaceID * AdminUser: check typed namespace id * Identity: Add convinient function to parse valid user id when type is either user or service account * Annotations: Use typed namespace id instead	1 year ago
Karl Persson	2d8570e85e	IDToken: Reuse claims from authlib (#87437) ... * bump authlib version * Reuse claims from authlib	1 year ago
Karl Persson	37af1ae58e	IDToken: Set typ header (#87430) ... TokenSigning: Set typ header	1 year ago
Dan Cech	41bee274fd	Chore: Fix error handling in postDashboard, remove UserDisplayDTO, fix live redis client initialization (#87206) ... * clean up error handling in postDashboard and remove UserDisplayDTO * replace GetUserUID with GetUID and GetNamespacedUID, enforce namespace constant type * lint fix * lint fix * more lint fixes	1 year ago
Karl Persson	a22350f8f4	IDToken: add namespace (#87242)	1 year ago
Karl Persson	d8fbbdefea	Identity: Use typed namespace id (#87121) ... * Use typed namespace id	1 year ago
Karl Persson	cd724d74aa	Authn: move namespace id type (#86853) ... * Use RoleType from org package * Move to identity package and re-export from authn * Replace usage of top level functions for identity Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>	1 year ago
Karl Persson	0fa983ad8e	AuthN: Use typed namespace id inside authn package (#86048) ... * authn: Use typed namespace id inside package	1 year ago
Karl Persson	895222725c	Session: set authID and authenticatedBy (#85806) ... * Authn: Resolve authenticate by and auth id when fethcing signed in user * Change logout client interface to only take Requester interface * Session: Fetch external auth info when authenticating sessions * Use authenticated by from identity * Move call to get auth-info into session client and use GetAuthenticatedBy in various places	1 year ago
Karl Persson	fd870702c7	Chore: Remove unused function TryRotateToken (#85836) ... * Chore: Remove unused function * remove unused function	1 year ago
Karl Persson	ba41954854	Email: trigger email verification flow (#85587) ... * Add email and email_verified to id token if identity is a user * Add endpoint to trigger email verification for user * Add function to clear stored id tokens and use it when email verification is completed	1 year ago
Jo	5340a6e548	Auth: Extended JWT client for OBO and Service Authentication (#83814) ... * reenable ext-jwt-client * fixup settings struct * add user and service auth * lint up * add user auth to grafana ext * fixes * Populate token permissions Co-authored-by: jguer <joao.guerreiro@grafana.com> * fix tests * fix lint * small prealloc * small prealloc * use special namespace for access policies * fix access policy auth * fix tests * fix uncalled settings expander * add feature toggle * small feedback fixes * rename entitlements to permissions * add authlibn * allow viewing the signed in user info for non user namespace * fix invalid namespacedID * use authlib as verifier for tokens * Update pkg/services/authn/clients/ext_jwt.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update pkg/services/authn/clients/ext_jwt_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix parameter names * change asserts to normal package * add rule for assert * fix ownerships * Local diff * test and lint * Fix test * Fix ac test * Fix pluginproxy test * Revert testdata changes * Force revert on test data --------- Co-authored-by: gamab <gabriel.mabille@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	1 year ago
linoman	e4250a72db	JWT: Find login and email claims with JMESPATH (#85305) ... * add function to static function to static service * find email and login claims with jmespath * rename configuration files * Replace JWTClaims struct for map * check for subclaims error	1 year ago
Karl Persson	152cb47692	AuthN: Add IsAuthenticatedBy to identity interface and replace checks (#85262) ... Add IsAuthenticatedBy to identity interface and replace checks	1 year ago
Karl Persson	2f5e3023c2	IDFowrarding: ignore logging context canceled errors (#85141)	1 year ago
ismail simsek	6137c4e0a6	Chore: Bump golangci-lint v1.57.1 (#84998) ... * bump golangci-lint v1.57.1 * update setting * remove goconst * fix linting issues * prettier * fix G601 * go mod tidy go work sync	1 year ago
Karl Persson	d4e802dd47	Authn: Add function to resolve identity from org and namespace id (#84555) ... * Add function to get the namespaced id * Add function to resolve an identity through authn.Service from org and namespace id * Switch to resolve identity for re-authenticate in another org	1 year ago
Jo	6f62d970e3	JWT Authentication: Add support for specifying groups in auth.jwt for teamsync (#82175) ... * merge JSON search logic * document public methods * improve test coverage * use separate JWT setting struct * correct use of cfg.JWTAuth * add group tests * fix DynMap typing * add settings to default ini * add groups option to devenv path * fix test * lint * revert jwt-proxy change * remove redundant check * fix parallel test	1 year ago
Dan Cech	790e1feb93	Chore: Update test database initialization (#81673) ... * streamline initialization of test databases, support on-disk sqlite test db * clean up test databases * introduce testsuite helper * use testsuite everywhere we use a test db * update documentation * improve error handling * disable entity integration test until we can figure out locking error	1 year ago
Gabriel MABILLE	3df0611f81	RBAC: Fix authorize in org (#81552) ... * RBAC: Fix authorize in org * Implement option 2 * Fix typo * Fix alerting test * Add test to cover the not member case	1 year ago
Karl Persson	28bb6979f5	IDForwading: cache based on expires in (#81136) ... * IDFowarding: Cache based on expires in * IDFowarding: Change default expires in --------- Co-authored-by: Victor Cinaglia <victor@grafana.com>	1 year ago
Marcus Efraimsson	6768c6c059	Chore: Remove public vars in setting package (#81018) ... Removes the public variable setting.SecretKey plus some other ones. Introduces some new functions for creating setting.Cfg.	1 year ago