grafana

Commit Graph

Author	SHA1	Message	Date
Jo	7e97dbde65	LDAP: Allow setting minimum TLS version and accepted ciphers (#63646 ) * update ldap library and use go module path * add TLS min version and accepted min TLS version * set default min ver to library default * set default min ver to library default * add cipher list to toml * Update pkg/services/ldap/settings.go Co-authored-by: Karl Persson <kalle.persson@grafana.com> * Apply suggestions from code review Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com> * lint --------- Co-authored-by: Karl Persson <kalle.persson@grafana.com> Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>	2 years ago
Jo	d4cfbd9fd3	LDAP: Move LDAP globals to Config (#63255 ) * structure dtos and private methods * add basic LDAP service * use LDAP service in ldap debug API * lower non fatal error * remove unused globals * wip * remove final globals * fix tests to use cfg enabled * restructure errors * remove logger from globals * use ldap service in authn * use ldap service in context handler * fix failed tests * fix ldap middleware provides * fix provides in auth_test.go	2 years ago
Serge Zaitsev	7dbd2cd139	Chore: Fix goimports grouping (#62426 ) fix goimports ordering	2 years ago
Kristin Laemmert	9256a520a4	chore: move user_auth models to (mostly) login service (#62269 ) * chore: move user_auth models to (mostly) login service	2 years ago
idafurjes	6afad51761	Move SignedInUser to user service and RoleType and Roles to org (#53445 ) * Move SignedInUser to user service and RoleType and Roles to org * Use go naming convention for roles * Fix some imports and leftovers * Fix ldap debug test * Fix lint * Fix lint 2 * Fix lint 3 * Fix type and not needed conversion * Clean up messages in api tests * Clean up api tests 2	3 years ago
Emil Tullstedt	ad971cc9be	LDAP: Search all DNs for users (#38891 )	4 years ago
Leonard Gram	c266f45858	LDAP: users without org mappings are marked as disabled (#26650 ) * LDAP: users without org mappings are marked as disabled * Update pkg/services/ldap/ldap.go Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com> * LDAP: verifies that unmapped users are tagged as isDisabled Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Arve Knudsen	41d432b5ae	Chore: Enable whitespace linter (#25903 ) Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
gotjosh	b20a258b72	LDAP: Show non-matched groups returned from LDAP (#19208 ) * LDAP: Show all LDAP groups * Use the returned LDAP groups as the reference when debugging LDAP We need to use the LDAP groups returned as the main reference for assuming what we were able to match and what wasn't. Before, we were using the configured groups in LDAP TOML configuration file. * s/User name/Username * Add a title to for the LDAP mapping results * LDAP: UI Updates to debug view * LDAP: Make it explicit when we weren't able to match teams	6 years ago
Oleg Gaidarenko	fb273cb874	LDAP: nitpicks (#18309 ) * LDAP: nitpicks * Add more tests * Correct and clarify comment for Login() method * Rename methods (hail consistency!) * Uppercases first letter of the logs everywhere * Moves method definitions around to more appropriate places Fixes #18295	6 years ago
Oleg Gaidarenko	1e5fc76601	LDAP: improve POSIX support (#18235 ) * LDAP: improve POSIX support * Correctly abtain DN attributes result * Allow more flexibility with comparison mapping between POSIX group & user * Add devenv for POSIX LDAP server * Correct the docs Fixes #18140	6 years ago
Leonard Gram	5d3a60d46e	LDAP: Adds bind before searching LDAP for non-login cases. (#18023 )	6 years ago
Oleg Gaidarenko	e2cf7c9698	LDAP: finishing touches (#17945 ) * LDAP:Docs: `active_sync_enabled` setting Mention `active_sync_enabled` setting and enable it by default * LDAP: move "disableExternalUser" method Idea behind new design of the LDAP module is to minimise conflation between other parts of the system, so it would decoupled as much as possible from stuff like database, HTTP transport and etc. Following "Do One Thing and Do It Well" Unix philosophy principal, other things could be better fitted on the consumer side of things. Which what this commit trying to archive * LDAP: correct user/admin binding The second binding was not happening, so if the admin login/password in LDAP configuration was correct, anyone could had login as anyone using incorrect password	6 years ago
Oleg Gaidarenko	444c4d5999	LDAP: Divide the requests (#17885 ) * LDAP: Divide the requests Active Directory does indeed have a limitation with 1000 results per search (default of course). However, that limitation can be workaround with the pagination search feature, meaning `pagination` number is how many times LDAP compatible server will be requested by the client with specified amount of users (like 1000). That feature already embeded with LDAP compatible client (including our `go-ldap`). But slapd server has by default stricter settings. First, limitation is not 1000 but 500, second, pagination workaround presumably (information about it a bit scarce and I still not sure on some of the details from my own testing) cannot be workaround with pagination feature. See https://www.openldap.org/doc/admin24/limits.html https://serverfault.com/questions/328671/paging-using-ldapsearch hashicorp/vault#4162 - not sure why they were hitting the limit in the first place, since `go-ldap` doesn't have one by default. But, given all that, for me `ldapsearch` command with same request as with `go-ldap` still returns more then 500 results, it can even return as much as 10500 items (probably more). So either there is some differences with implementation of the LDAP search between `go-ldap` module and `ldapsearch` or I am missing a step :/. In the wild (see serverfault link), apparently, people still hitting that limitation even with `ldapsearch`, so it still seems to be an issue. But, nevertheless, I'm still confused by this incoherence. To workaround it, I divide the request by no more then 500 items per search	6 years ago
Oleg Gaidarenko	1b1d951495	LDAP: refactoring (#17479 ) * LDAP: use only one struct * Use only models.ExternalUserInfo * Add additional helper method :/ * Move all the helpers to one module * LDAP: refactoring * Rename some of the public methods and change their behaviour * Remove outdated methods * Simplify logic * More tests There is no and never were tests for settings.go, added tests for helper methods (cover is now about 100% for them). Added tests for the main LDAP logic, but there is some stuff to add. Dial() is not tested and not decoupled. It might be a challenge to do it properly * Restructure tests: * they wouldn't depend on external modules * more consistent naming * logical division * More guards for erroneous paths * Login: make login service an explicit dependency * LDAP: remove no longer needed test helper fns * LDAP: remove useless import * LDAP: Use new interface in multildap module * LDAP: corrections for the groups of multiple users * In case there is several users their groups weren't detected correctly * Simplify helpers module	6 years ago
Oleg Gaidarenko	de92c360a1	LDAP: reduce API and allow its extension (#17209 ) * Removes Add/Remove methods * Publicise necessary fields and methods so we could extend it * Publicise mock API * More comments and additional simplifications * Sync with master Still having low coverage :/ - should be addressed in #17208	6 years ago
Oleg Gaidarenko	a0f5923b95	LDAP: add tests for initialBind (#17132 ) * LDAP: add tests for initialBind * LDAP: clarify comment for Login()	6 years ago
Oleg Gaidarenko	35f227de11	Feature: LDAP refactoring (#16950 ) * incapsulates multipleldap logic under one module * abstracts users upsert and get logic * changes some of the text error messages and import sort sequence * heavily refactors the LDAP module – LDAP module now only deals with LDAP related behaviour * integrates affected auth_proxy module and their tests * refactoring of the auth_proxy logic	6 years ago

15 Commits (8aae7be4e594fc87a9fa5f0288489aafb2ac8e12)