grafana

Commit Graph

Author	SHA1	Message	Date
Artur Wierzbicki	d50ccd6741	Chore: AuthN/IdentitySynchronizer interface/impl compatibility wire fix (#74400 ) authn/identitysynchronizer fix	2 years ago
linoman	13f4382214	Auth: Implement requester interface in access control module (#74289 ) * Implement requester interface in the access control module	2 years ago
Serge Zaitsev	8187d8cb66	Chore: capitalise log message for auth packages (#74332 )	2 years ago
Ryan McKinley	025b2f3011	Chore: use any rather than interface{} (#74066 )	2 years ago
Gabriel MABILLE	f900098cc9	[LDAP] Disable removed users on login (#74016 ) * [LDAP] Disable removed users on login * Fix tests * Add test for user disabling * Add tests for disabling user behind auth proxy * Linting. * Rename setup func * Account for reviews comments Co-authored-by: Kalle Persson <kalle.persson@grafana.com> --------- Co-authored-by: Kalle Persson <kalle.persson@grafana.com>	2 years ago
Karl Persson	37ceffb74c	Authn: Standardize errors (#74012 )	2 years ago
Jo	fe1563882a	Chore: Port oauth token service to identity requester (#73988 ) * port oauth token service to identity requester * fix broken test * no need to check for render	2 years ago
Gabriel MABILLE	9e52414a91	LDAP: Fix active sync with large quantities of users (#73834 )	2 years ago
Karl Persson	5d14b6ba19	AuthProxy: Fix user retrieval through cache (#73802 ) * AuthProxy: Change auth proxy sync cache key	2 years ago
Marcus Efraimsson	040b7d2571	Chore: Add errutils helpers (#73577 ) Add helpers for the errutil package in favor of errutil.NewBase.	2 years ago
Karl Persson	618daf0518	Login: remove login.Service (#73542 )	2 years ago
Karl Persson	124e0efe1f	Authn: external identity sync (#73461 ) * Authn: Add interface for external identity sync This interface is implemented by authnimpl.Service and just triggers PostAuthHooks and skipping last seen update by default * Authn: Add SyncIdentity to fake and add a new mock	2 years ago
Karl Persson	e53e22ef2a	Contexthandler: Remove code that is no longer used (#73101 ) * Contexthandler: remove dead code * Contexthandler: Add tests * Update pkg/tests/api/alerting/api_alertmanager_test.go Co-authored-by: Jo <joao.guerreiro@grafana.com> --------- Co-authored-by: Jo <joao.guerreiro@grafana.com>	2 years ago
Jo	bd1a856d33	Auth: Add SignedIn user interface NamespacedID (#72944 ) * wip * scope active user to 1 org * remove TODOs * add render auth namespace * import cycle fix * make condition more readable * convert Evaluate to user Requester * only use active OrgID for SearchUserPermissions * add cache key to interface definition * change final SignedInUsers to interface * fix api key managed roles fetch * fix anon auth id parsing * Update pkg/services/accesscontrol/acimpl/accesscontrol.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	2 years ago
Karl Persson	144e4887ee	Auth: Use authn.Service for all tests (#72921 ) * Dashboards: Fix tests when authn broker is enabled. StarService was not configured for tests, the call was guarded by !c.IsSignedIn * Change default to be anon user to match expectations from tests * OAuth: rewrite tests to work with authn.Service * Setup template renderer by default * Extract cookie options from cfg instead of relying on global variables * Fix test to work with authn service * Middleware: rewrite auth tests * Remvoe session cookie if we cannot refresh access token	2 years ago
Ryan McKinley	7431c0ddb1	UserSync: Avoid UpdateLastSeenAt with invalid user ids (#72776 ) * avoid user zero * more errors * more tests * split	2 years ago
Jo	7d347cd428	Auth: remove org count from signedInUser (#72661 ) * tweaks * remove org count from signedinUser * remove org count from signedinUser store * fix broken tests * restore frontend interface	2 years ago
Aksel Skaar Leirvaag	6d98d06f6e	Auth: Check id token expiry date (#69829 ) * fixed: added id token expiry check to oauth token sync * use go-jose and id token in cache * Update pkg/services/authn/authnimpl/sync/oauth_token_sync.go * refactored getOAuthTokenCacheTTL and added unit tests * Small changes to oauth_token_sync * Remove unnecessary contexthandler changes --------- Co-authored-by: linoman <2051016+linoman@users.noreply.github.com> Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com>	2 years ago
Jo	3353b1a8aa	Auth: Add authed device tagging (#72442 ) * add authed device tagging * fix config * implement feedback * implement feedback * add reverse untag behavior * remove duplicate stat * Update pkg/services/anonymous/anonimpl/impl.go	2 years ago
Jo	e04a6fb08e	Auth: Fix static test fake (#72514 ) fix static fake	2 years ago
Jo	a4a87f6228	Auth: Rename Sessions to Devices in counting (#72432 ) * rename session to device * rename session to device	2 years ago
Jo	ed780ce0e9	Auth: Fix Last Seen being updated on every request (#72036 ) * make sure LastSeen hook has information to decide if update is necessary * make user service check if it should update the user's last seen * do not run last seen hook if is a login request * make service return error when last seen is up to date * fix err * Update pkg/services/contexthandler/contexthandler.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix golint --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Misi	dcf26564db	OAuth: Introduce user_refresh_token setting and make it default for the selected providers (#71533 ) * First changes * WIP docs * Align current tests * Add test for UseRefreshToken * Update docs * Fix * Remove unnecessary AuthCodeURL from generic_oauth * Change GitHub to disable use_refresh_token by default	2 years ago
Misi	5efc3386d3	AuthZ: Extend /api/search to work with self-contained permissions (#70749 ) * Search sql filter draft, unfinished * Search works for empty roles * Add current AuthModule to SignedInUser * clean up, changes to the search * Use constant prefixes * Change AuthModule to AuthenticatedBy * Add tests for using the permissions from the SignedInUser * Refactor and simplify code * Fix sql generation for pg and mysql * Fixes, clean up * Add test for empty permission list * Fix * Fix any vs all in case of edit permission * Update pkg/services/authn/authn.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update pkg/services/sqlstore/permissions/dashboard_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Fixes, changes based on the review --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Ieva	a65cb4d808	RBAC: remove simple RBAC disabled checks (#71137 ) * remove simple RBAC disabled checks * fixing tests * remove old AC tests	2 years ago
Jo	b8a336c9d7	Auth: Remove Email Lookup from oauth integrations (#894 ) Remove email lookup from oauth integrations Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>	2 years ago
SatVeer Singh	1bfa3a0f1e	Chore: Replace go-multierror with errors package (#66432 ) * code refactor and type assertions added to tests * no-lint rule added for specific line	2 years ago
Jo	914daef0fd	Auth: Add request context to UserInfo calls (#70007 ) * use context for UserInfo requests * set timeouts for oauth http client * Update pkg/login/social/common.go Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> --------- Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	2 years ago
Misi	28bb960e42	AuthN: Make clientTokenRotation work when Grafana is accessible on a sub url (#69385 ) Fix clientTokenRotation for auth-proxy	2 years ago
Misi	6702f07a87	AuthN: Use EqualFold for skipping introspection endpoint (#69126 ) Add equality check for introspect ep in basic.go	2 years ago
Gabriel MABILLE	edf1775d49	AuthN: Embed an OAuth2 server for external service authentication (#68086 ) * Moving POC files from #64283 to a new branch Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * Adding missing permission definition Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * Force the service instantiation while client isn't merged Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * Merge conf with main Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * Leave go-sqlite3 version unchanged Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * tidy Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * User SearchUserPermissions instead of SearchUsersPermissions * Replace DummyKeyService with signingkeys.Service * Use user🆔<id> as subject * Fix introspection endpoint issue * Add X-Grafana-Org-Id to get_resources.bash script * Regenerate toggles_gen.go * Fix basic.go * Add GetExternalService tests * Add GetPublicKeyScopes tests * Add GetScopesOnUser tests * Add GetScopes tests * Add ParsePublicKeyPem tests * Add database test for GetByName * re-add comments * client tests added * Add GetExternalServicePublicKey tests * Add other test case to GetExternalServicePublicKey * client_credentials grant test * Add test to jwtbearer grant * Test Comments * Add handleKeyOptions tests * Add RSA key generation test * Add ECDSA by default to EmbeddedSigningKeysService * Clean up org id scope and audiences * Add audiences to the DB * Fix check on Audience * Fix double import * Add AC Store mock and align oauthserver tests * Fix test after rebase * Adding missing store function to mock * Fix double import * Add CODEOWNER * Fix some linting errors * errors don't need type assertion * Typo codeowners * use mockery for oauthserver store * Add feature toggle check * Fix db tests to handle the feature flag * Adding call to DeleteExternalServiceRole * Fix flaky test * Re-organize routes comments and plan futur work * Add client_id check to Extended JWT client * Clean up * Fix * Remove background service registry instantiation of the OAuth server * Comment cleanup * Remove unused client function * Update go.mod to use the latest ory/fosite commit * Remove oauth2_server related configs from defaults.ini * Add audiences to DTO * Fix flaky test * Remove registration endpoint and demo scripts. Document code * Rename packages * Remove the OAuthService vs OAuthServer confusion * fix incorrect import ext_jwt_test * Comments and order * Comment basic auth * Remove unecessary todo * Clean api * Moving ParsePublicKeyPem to utils * re ordering functions in service.go * Fix comment * comment on the redirect uri * Add RBAC actions, not only scopes * Fix tests * re-import featuremgmt in migrations * Fix wire * Fix scopes in test * Fix flaky test * Remove todo, the intersection should always return the minimal set * Remove unecessary check from intersection code * Allow env overrides on settings * remove the term app name * Remove app keyword for client instead and use Name instead of ExternalServiceName * LogID remove ExternalService ref * Use Name instead of ExternalServiceName * Imports order * Inline * Using ExternalService and ExternalServiceDTO * Remove xorm tags * comment * Rename client files * client -> external service * comments * Move test to correct package * slimmer test * cachedUser -> cachedExternalService * Fix aggregate store test * PluginAuthSession -> AuthSession * Revert the nil cehcks * Remove unecessary extra * Removing custom session * fix typo in test * Use constants for tests * Simplify HandleToken tests * Refactor the HandleTokenRequest test * test message * Review test * Prevent flacky test on client as well * go imports * Revert changes from `526e48ad45` * AuthN: Change the External Service registration form (#68649) * AuthN: change the External Service registration form * Gen default permissions * Change demo script registration form * Remove unecessary comment * Nit. * Reduce cyclomatic complexity * Remove demo_scripts * Handle case with no service account * Comments * Group key gen * Nit. * Check the SaveExternalService test * Rename cachedUser to cachedClient in test * One more test case to database test * Comments * Remove last org scope Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com> * Update pkg/services/oauthserver/utils/utils_test.go * Update pkg/services/sqlstore/migrations/oauthserver/migrations.go Remove comment * Update pkg/setting/setting.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> --------- Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>	2 years ago
Jo	05e71d4c6b	AnonymousAuth: Fix concurrent read-write crash (#68637 ) clone http req before tagging	2 years ago
Jo	5ec0f82baa	Separate authn flow from analytics (#68327 ) * separate authn flow from analytics * lint fix	2 years ago
Misi	43be4f095a	Auth: Add alpha version of the Extended JWT client (#67999 ) * initial commit * Add tests, add configuration options * Extend signingkeys.Service with GetServerPublicKey method * Add, cleanup tests * Add tests for entitlements claim * Fix linting errors * Suggestion to use a struct to extend the claims (cherry picked from commit 8078b99f1d57c9426a15693d850c1ca5f0432cbe) * Add requested changes Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Add test for orgID check * Cleanup --------- Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
linoman	15e34505e2	Render analytics identifiers (#67860 ) * Append analytics identifier upon authenticate session * Add id and module upon syncing user to identity * Add authModule & id to `IdentityFromSignedInUser` * Allow req calls in test to use basic auth * Add `intercom_secret` to grafana config in tests * Add test for analytics render in html view	2 years ago
Jo	96fdbbee90	AuthJWT: Fix JWT query param leak (CVE-2023-1387) (#825 ) fix JWT query param leak Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> Co-authored-by: Kalle Persson <kalle.persson@grafana.com>	2 years ago
Karl Persson	355f47628f	AuthN: Tune logs in client (#65714 ) * AuthN: Remove log * AuthN: Check for user not found error in hook	2 years ago
Karl Persson	e4d998dc1a	ApiKeyGenPrefix: rename package (#65623 ) * Rename package to satokengen to make it clearer that it is for service account tokens	2 years ago
Karl Persson	d4397fae25	AuthN: Add functions for fake (#65522 )	2 years ago
Serge Zaitsev	a38f230d37	Chore: Remove result fields from login (#65136 ) * remove result fields from login * fix tests * fix tests * another shadowing	2 years ago
Karl Persson	382b24742a	Auth: Add feature flag to move token rotation to client (#65060 ) * FeatureToggle: Add toggle to use a new way of rotating tokens * API: Add endpoints to perform token rotation, one endpoint for api request and one endpoint for redirectsd * Auth: Aling not authorized handling between auth middleware and access control middleware * API: add utility function to get redirect for login * API: Handle token rotation redirect for login page * Frontend: Add job scheduling for token rotation and make call to token rotation as fallback in retry request * ContextHandler: Prevent in-request rotation if feature flag is enabled and check if token needs to be rotated * AuthN: Prevent in-request rotation if feature flag is enabled and check if token needs to be rotated * Cookies: Add option NotHttpOnly * AuthToken: Add helper function to get next rotation time and another function to check if token need to be rotated * AuthN: Add function to delete session cookie and set expiry cookie Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>	2 years ago
Eric Leijonmarck	3cd952b8ba	Auth: Fix orgrole picker disabled if isSynced user (#64033 ) * fix: disable orgrolepicker if externaluser is synced * add disable to role picker * just took me 2 hours to center the icon * wip * fix: check externallySyncedUser for API call * remove check from store * add: tests * refactor authproxy and made tests run * add: feature toggle * set feature toggle for tests * add: IsProviderEnabled * refactor: featuretoggle name * IsProviderEnabled tests * add specific tests for isProviderEnabled * fix: org_user tests * add: owner to featuretoggle * add missing authlabels * remove fmt * feature toggle * change config * add test for a different authmodule * test refactor * gen feature toggle again * fix basic auth user able to change the org role * test for basic auth role * make err.base to error * lowered lvl of log and input mesg	2 years ago
Karl Persson	d2b19c167b	AuthN: Change error returned when sign up is disabled for provider (#65110 )	2 years ago
Serge Zaitsev	743d66396a	Chore: Remove result field from API keys commands and queries (#65055 ) * Chore: remove result field from api keys * fix shadowing * actually shadowing was all right	2 years ago
Jo	7784782512	AuthN: Add password and login form stats (#64868 ) * add password and login form stats * fix method handler * fix viewers can edit test	2 years ago
Jo	6b6cf5f4b7	Cfg: Move ViewersCanEdit into cfg (#64876 ) move ViewersCanEdit into cfg	2 years ago
Artur Wierzbicki	b6f77bdfdb	Chore: provide `authn.Service` rather than `authnimpl.Service` (#64792 ) chore: provide `authn.Service` rather than `authnimpl.Service` (#64792)	2 years ago
Carl Bergquist	eb507dca89	Remotecache: rename setbytearray/getbytearray to set/get and remove codec (#64470 ) Signed-off-by: bergquist <carl.bergquist@gmail.com>	2 years ago
Carl Bergquist	7c55dbf37d	Remotecache: Migrates get/set calls to use bytearrays and remove get/set functions (#63525 ) Signed-off-by: bergquist <carl.bergquist@gmail.com>	2 years ago
Misi	6543259a7d	Auth: Add SyncPermissions post auth hook (#64205 ) * Add SyncPermissionsFromDB post auth hook * Delete FromDB prefix * Align tests * Fixes * Change SyncPermissionsHook prio	2 years ago

1 2 3

114 Commits (96facbdfa25cdbcac51add910c7ba0d94d6b15a7)