24 Commits (8dfb4cdfc94c7dcecc23e166157db1adf6f84148)

Author	SHA1	Message	Date
Mihai Doarna	8dfb4cdfc9	SSO: Add prompt param to SSO settings (#107969) ... * add prompt param to AzureAD oauth config * yarn i18n-extract * validate auth prompt value * make login_prompt available for all SSO providers * use base authCodeURL for azure and google * add docs for the new field for azure and generic oauth * fix typo * fix frontend unit test * add prompt parameter to docs for the other providers * remove prompt from okta * add unit tests for the other providers * address feedback * add back translations for prompt labels	3 days ago
Jo	1e1fd3db38	OAuth: Add access token as third source for user info extraction (#107636) ... * Add access token as third source for user info extraction - Add extractFromAccessToken method to extract user info from JWT access tokens - Mutualize code by creating parseUserInfoFromJSON helper method - Rename methods for clarity: extractFromToken -> extractFromIDToken, retrieveRawIDToken -> retrieveRawJWTPayload - Update test suite to include comprehensive access token retrieval scenarios - Support three sources in priority order: ID token, API response, access token - Maintain backward compatibility while adding new functionality * Update Generic OAuth documentation to reflect access token support - Add access token as a third source for user information extraction - Update configuration sections to mention access tokens alongside ID tokens and UserInfo endpoint - Document the priority order: ID token → UserInfo endpoint → access token - Update configuration option descriptions to reflect new functionality - Maintain consistency with implementation changes * Refactor access token test cases to use parameter instead of hardcoded logic - Add AccessToken field to test case struct for explicit access token specification - Remove hardcoded string matching logic that determined access token based on test name - Update all access token test cases to include the AccessToken field with appropriate JWT values - Improve test maintainability and clarity by making access tokens explicit parameters - Remove unused strings import that was only needed for the hardcoded logic * fix doc lint * reduce cyclomatic complexity	2 weeks ago
Mykhailo Zahlada	fc988c8771	Auth: Add Azure/Entra workload identity support (#104807) ... * fixes/adds azure workload identity authentication. Issue #78249 * Updates default values. Adds `workload_identity_token_file` defaults * Updates example config. Adds `workload_identity_token_file` * Updates docummentation: adds Federated credentials for Workload Identity * Update docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> * Update docs/sources/setup-grafana/configure-security/configure-authentication/azuread/index.md Co-authored-by: Misi <mgyongyosi@users.noreply.github.com> * Docs: add link to official documentation. Clarifies example. * 1. Add workload_identity_enabled and workload_identity_token_file settings to [auth.azuread] for workload identity support. 2. Extend OAuthInfo struct to include workload identity fields. 3. Update OAuth authentication logic to handle Azure AD workload identity using federated token as client assertion. 4. Update sample configuration and documentation for new settings. * ensure environment variable overrides are respected for OAuth SSO settings - Ensure that settings loaded in pkg/services/ssosettings/strategies/oauth_strategy.go correctly reflect environment variable overrides, matching Grafana's config behavior. - Align config loading logic with main config loader to prevent issues where INI values would override environment variables. * updates documentation * test: add workload identity configuration tests for Azure AD OAuth strategy. Add test coverage for workload_identity_enabled and workload_identity_token_file settings * feat: add workload identity support to Azure AD SSO configuration UI * updates documentation * Simplify OAuth flow by removing unnecessary switch-case structure * Small changes * Lint + i18n gen * refactor: remove redundant workload_identity_enabled setting as auth method gets defined by client_authentication * update documentation * refactor: remove redundant workload_identity_enabled setting as auth method gets defined by client_authentication * updates documentation - configuration options table: adds `client_authentication`, `workload_identity_token_file`, and `federated_credential_audience` * Small changes, lint, i18n --------- Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>	2 months ago
Mariell Hoversholm	757be6365a	CI: Bump golangci-lint to 2.0.2 (#103572)	3 months ago
John Naizer	79d565f285	OAuth: Support client_secret_jwt for oauth providers when doing token exchange (#95455) ... * added backend support for client_secret_jwt * added backend support for client_secret_jwt * added all logic to the exchange function (overloaded social exchange in azuread_oauth to handle managed identity client id) * ran yarn install to update lock file * added support for client_secret_jwt when managed_identity_client_id is null * added audience flag and changed exchange to directly access oauth config using .info * added logic in setting oauth.Config for supported client authentication values * added client_authentication, managed_identity_client_id, and audience to sample.ini file * using provided ctx in ManagedIdentityCallback function * added frontend support for federated identity credential auth * added client authentication field * added Azure AD documentation for Grafana * added bold font to "Add" keyword in documentation * minor wording change relating to previous commit * addressed changing audience to federated_credential_audience, moving validation, and changing managedIdentityCallback to private function * correction to audience name changing * fixed orgMappingClientAuthentication function name, and added in logic into validateFederatedCredentialAudience function * Change docs * Add iam team as owner of azcore pkg * added backend support for client_secret_jwt * added all logic to the exchange function (overloaded social exchange in azuread_oauth to handle managed identity client id) * ran yarn install to update lock file * added support for client_secret_jwt when managed_identity_client_id is null * added audience flag and changed exchange to directly access oauth config using .info * added logic in setting oauth.Config for supported client authentication values * added client_authentication, managed_identity_client_id, and audience to sample.ini file * using provided ctx in ManagedIdentityCallback function * added frontend support for federated identity credential auth * added client authentication field * added Azure AD documentation for Grafana * added bold font to "Add" keyword in documentation * minor wording change relating to previous commit * addressed changing audience to federated_credential_audience, moving validation, and changing managedIdentityCallback to private function * correction to audience name changing * fixed orgMappingClientAuthentication function name, and added in logic into validateFederatedCredentialAudience function * Change docs * Add iam team as owner of azcore pkg * updated yarn lock file * updated doc for correction * removed wrong changes in pkg directory * removed newline in dashboard-generate.yaml and unified.ts * updated yarn.lock to match upstream * Lint Signed-off-by: Jack Baldry <jack.baldry@grafana.com> * removing unwanted changes * added back removed newline * fixed failing test in azuread_oauth_test.go * Update azuread_oauth.go removed unnecessary newline, fixed lint --------- Signed-off-by: Jack Baldry <jack.baldry@grafana.com> Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com> Co-authored-by: Jack Baldry <jack.baldry@grafana.com>	6 months ago
Misi	f82eea7840	Chore: Extend OrgRoleMapper (#97336) ... * Extend OrgRoleMapper * Cover mappingCfg eq nil * Use struct instead of a pointer in MapOrgRoles	8 months ago
Misi	b174c1310a	Auth: Add organization mapping configuration to the UI (#90003) ... * Add org_mapping and org_attribute_path to the UI * Add validators, allow setting org mapping to only Grafana Admins * comment * Address feedback, improve validation, fix FE test, lint	1 year ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116)	1 year ago
Misi	9a44296bc2	Auth: Add org to role mappings support to AzureAD/Entra integration (#88861) ... * Added implementation and tests * Add docs, simplify implementation * Remove unused func * Update docs	1 year ago
Karl Persson	f3efd95bb4	Auth: Add org to role mappings support to Google integration (#88891) ... * Auth: Implement org role mapping for google oauth provider * Update docs * Remove unused function Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>	1 year ago
Mathieu Parent	b8c9ae0eb7	OIDC: Support Generic OAuth org to role mappings (#87394) ... * Social: link to OrgRoleMapper * OIDC: support Generic Oauth org to role mappings Fixes: #73448 Signed-off-by: Mathieu Parent <math.parent@gmail.com> * Handle when getAllOrgs fails in the org_role_mapper * Add more tests * OIDC: ensure orgs are evaluated from API when not from token Signed-off-by: Mathieu Parent <math.parent@gmail.com> * OIDC: ensure AutoAssignOrg is applied with OrgMapping without RoleAttributeStrict Signed-off-by: Mathieu Parent <math.parent@gmail.com> * Extend docs * Fix test, lint --------- Signed-off-by: Mathieu Parent <math.parent@gmail.com> Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com>	1 year ago
Mihai Doarna	e3314f04e4	Auth: perform read locking on every exported func from social providers (#83960) ... perform read locking on every exported func from social providers	1 year ago
Mihai Doarna	7b2fa28e0b	SSO: update info field from SocialBase struct (#83407) ... update info field from SocialBase struct	1 year ago
Misi	12b1170631	Auth: Validation fixes for SSO Settings (#82252) ... * Validation fixes * Add URL validations + tests * Add ApiUrl validation * Refactor validators * lint * Clean up * Improvements	1 year ago
Jo	6f62d970e3	JWT Authentication: Add support for specifying groups in auth.jwt for teamsync (#82175) ... * merge JSON search logic * document public methods * improve test coverage * use separate JWT setting struct * correct use of cfg.JWTAuth * add group tests * fix DynMap typing * add settings to default ini * add groups option to devenv path * fix test * lint * revert jwt-proxy change * remove redundant check * fix parallel test	1 year ago
Misi	b1dc505a2b	Auth: Validate admin assignment in SSO Settings (#82233) ... * Add validation for allowAssignGrafanaAdmin * Update default values * Do not render hidden fields * Change error message * Improve tests --------- Co-authored-by: Clarity-89 <homes89@ukr.net>	1 year ago
Misi	bcc2409564	Auth: Add validation to Generic OAuth API and UI (#81345) ... * wip * Update validation * Chore: Remove InputControl usage * Fixes, validation * Remove empty option * Validation changes * Add tests, rename * lint --------- Co-authored-by: Clarity-89 <homes89@ukr.net>	1 year ago
Misi	20bb0a3ab1	AuthN: Support reloading SSO config after the sso settings have changed (#80734) ... * Add AuthNSvc reload handling * Working, need to add test * Remove commented out code * Add Reload implementation to connectors * Align and add tests, refactor * Add more tests, linting * Add extra checks + tests to oauth client * Clean up based on reviews * Move config instantiation into newSocialBase * Use specific error	2 years ago
Mihai Doarna	1807435d9e	Auth: Implement the reload functionality from OAuth social connectors (#79795) ... * implement Reload() func for azuread provider * add unit test for failure * use mutex when updating the info field * implement the Reload() func for the other providers * use mutex when reading info * retrieve info using GetOAuthInfo() in common file * move Reload() to SocialBase	2 years ago
Ryan McKinley	1caaa56de0	FeatureFlags: Use interface rather than manager (#80000)	2 years ago
Mihai Doarna	6465d87afd	Auth: Add basic validation for SSO settings (#79696) ... * add basic validation for sso settings * remove validation for the client secret	2 years ago
Misi	db81216240	Chore: Cleanup SocialBase + connectors and use the OAuthInfo (#79453) ... * Clean up SocialBase * Cleanup other connectors	2 years ago
Misi	ce1450d4d3	Chore: Configure SkipOrgRoleSync from OAuthInfo for OAuth connectors (#79443) ... * Configure SkipOrgRoleSync from OAuthInfo * Remove skipOrgRoleSync from socialbase and connectors * Add test to socialimpl.ProvideService * Deprecate AuthSettings' fields * clean up misleading init of frontendsettings.Auth	2 years ago
Misi	50f4e78a39	Auth: Use SSO settings service to load social connectors + refactor (#79005) ... * Refactor to prevent cyclic dependencies * Move list authorization to the API layer * Init connectors using the SSO settings service in case the ssoSettingsApi feature toggle is enabled * wip, need to handle the cyclic dep * Remove cyclic dependency * Align tests + refactor * Move back OAuthInfo to social * Delete pkg/login/social/constants * Move reloadable registration to the social providers * Rename connectors.Error to connectors.SocialError	2 years ago