grafana

Commit Graph

Author	SHA1	Message	Date
Will Browne	6bd1865749	Plugins: Fix flaky reverse proxy response tests (#96051 ) tidy	1 year ago
Eric Leijonmarck	3877537dc0	Reverse proxy: Skip flaky test for 5xx status codes (#95839 ) add 5xx status codes	1 year ago
Karl Persson	8bcd9c2594	Identity: Remove typed id (#91801 ) * Refactor identity struct to store type in separate field * Update ResolveIdentity to take string representation of typedID * Add IsIdentityType to requester interface * Use IsIdentityType from interface * Remove usage of TypedID * Remote typedID struct * fix GetInternalID	1 year ago
Ryan McKinley	21d4a4f49e	Auth: use IdentityType from authlib (#91763 )	1 year ago
Karl Persson	bcfb66b416	Identity: remove GetTypedID (#91745 )	1 year ago
Ryan McKinley	728150bdbd	Identity: extend k8s user.Info (#90937 )	1 year ago
Ryan McKinley	9db3bc926e	Identity: Rename "namespace" to "type" in the requester interface (#90567 )	1 year ago
Ryan McKinley	99d8025829	Chore: Move identity and errutil to apimachinery module (#89116 )	2 years ago
Dan Cech	41bee274fd	Chore: Fix error handling in postDashboard, remove UserDisplayDTO, fix live redis client initialization (#87206 ) * clean up error handling in postDashboard and remove UserDisplayDTO * replace GetUserUID with GetUID and GetNamespacedUID, enforce namespace constant type * lint fix * lint fix * more lint fixes	2 years ago
Karl Persson	d8fbbdefea	Identity: Use typed namespace id (#87121 ) * Use typed namespace id	2 years ago
Jo	5340a6e548	Auth: Extended JWT client for OBO and Service Authentication (#83814 ) * reenable ext-jwt-client * fixup settings struct * add user and service auth * lint up * add user auth to grafana ext * fixes * Populate token permissions Co-authored-by: jguer <joao.guerreiro@grafana.com> * fix tests * fix lint * small prealloc * small prealloc * use special namespace for access policies * fix access policy auth * fix tests * fix uncalled settings expander * add feature toggle * small feedback fixes * rename entitlements to permissions * add authlibn * allow viewing the signed in user info for non user namespace * fix invalid namespacedID * use authlib as verifier for tokens * Update pkg/services/authn/clients/ext_jwt.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * Update pkg/services/authn/clients/ext_jwt_test.go Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com> * fix parameter names * change asserts to normal package * add rule for assert * fix ownerships * Local diff * test and lint * Fix test * Fix ac test * Fix pluginproxy test * Revert testdata changes * Force revert on test data --------- Co-authored-by: gamab <gabriel.mabille@grafana.com> Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>	2 years ago
Alexander Zobnin	cad3c43bb1	Team LBAC: Move middleware to enterprise (#76969 ) * Team LBAC: Move middleware to enterprise * Remove ds proxy part * Move utils to enterprise	2 years ago
Alexander Zobnin	5563f2f98f	Team LBAC: Fix multiple header values (#76821 ) * Team LBAC: Fix multiple header values Co-authored-by: Eric Leijonmarck <eleijonmarck@users.noreply.github.com> * Fix linter error --------- Co-authored-by: Eric Leijonmarck <eleijonmarck@users.noreply.github.com>	2 years ago
Eric Leijonmarck	17fe1d3fc7	Team LBAC: Refactor to use only the teamHeader json part (#76756 ) * refactor: to check for feature toggle and for checking for jsonData field * fix tests * whitelisting of X-Prom-Label-Policy Header	2 years ago
Eric Leijonmarck	be5ba68132	Team LBAC: Add `teamHeaders` for datasource proxy requests (#76339 ) * Add teamHeaders for datasource proxy requests * adds validation for the teamHeaders * added tests for applying teamHeaders * remove previous implementation * validation for header values being set to authproxy * removed unnecessary checks * newline * Add middleware for injecting headers on the data source backend * renamed feature toggle * Get user teams from context * Fix feature toggle name * added test for validation of the auth headers and fixed evaluation to cover headers * renaming of teamHeaders to teamHTTPHeaders * use of header set for non-existing header and add for existing headers * moves types into datasources * fixed unchecked errors * Refactor * Add tests for data model * Update pkg/api/datasources.go Co-authored-by: Victor Cinaglia <victor@grafana.com> * Update pkg/api/datasources.go Co-authored-by: Victor Cinaglia <victor@grafana.com> --------- Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com> Co-authored-by: Victor Cinaglia <victor@grafana.com>	2 years ago
Marcus Efraimsson	e4c1a7a141	Tracing: Standardize on otel tracing (#75528 )	2 years ago
Karl Persson	684d68365e	IDforwarding: forward signed id to plugins (#75651 ) * Plugins: Add client middlware that forwards the signed grafana id token if present * DsProxy: Set grafana id header if id token exists * Add util function to apply id token to header * Only add id forwarding middleware if feature toggle is enabled * Add feature toggles to ds proxy and check if id forwarding is enabled * Clean up test setup * Change to use backend.ForwardHTTPHeaders interface * PluginProxy: Forward signed identity when feature toggle is enabled * PluginProxy: forrward signed id header	2 years ago
Marcus Efraimsson	8ee43f3705	Instrumentation: Add status_source label to request metrics/logs (#74114 ) Ref #68480 Co-authored-by: Giuseppe Guerra <giuseppe.guerra@grafana.com>	2 years ago
Jo	dcf06658eb	Chore: Implement requester in util pkg (#74105 ) implement requester changes that do not impact functionality	2 years ago
ismail simsek	81ba27c149	Feat: Match allowed cookies with optional character (#71047 ) * Match allowed cookies with optional character * Use strings package	3 years ago
Emil Tullstedt	cefeef7134	Proxy: Improve header handling for reverse proxy (#67279 )	3 years ago
Karl Persson	ce5e067d28	ContextHandler: add all configured auth header to context (#62775 ) * ContextHandler: Always store list of possible auth headers in context and remove individual calls	3 years ago
Serge Zaitsev	e2d49ea17f	Chore: Fix goimports grouping (#62423 ) * fix goimports * fix goimports order	3 years ago
Marcus Efraimsson	6478d0a5ef	Plugins: Forward user header (X-Grafana-User) in backend plugin requests (#58646 ) Grafana would forward the X-Grafana-User header to backend plugin request when dataproxy.send_user_header is enabled. In addition, X-Grafana-User will be automatically forwarded in outgoing HTTP requests for core/builtin HTTP datasources. Use grafana-plugin-sdk-go v0.147.0. Fixes #47734 Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>	3 years ago
Neil Fordyce	b0874d8059	DataProxy: Populate X-Grafana-Referer header (#60040 ) * ProxyUtil: Populate X-Grafana-Referer header * ProxyUtil: Move Referer/Origin header removal So that the removal and setting X-Grafana-Referer logic applies to all proxied requests and not just datasource proxy. * ProxyUtil: Test to guard against multiline headers * ProxyUtil: Explicitly check injected header isn't parsed	3 years ago
Marcus Efraimsson	6f8fcae01b	[main] Plugin fixes (#57399 ) * Plugins: Remove support for V1 manifests * Plugins: Make proxy endpoints not leak sensitive HTTP headers * Security: Fix do not forward login cookie in outgoing requests (cherry picked from commit `4539c33fce`) Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>	3 years ago
Marcus Efraimsson	862a6a2fa6	Logging: Introduce API for contextual logging (#55198 ) Introduces a FromContext method on the log.Logger interface that allows contextual key/value pairs to be attached, e.g. per request, so that any logger using this API will automatically get the per request context attached. The proposal makes the traceID available for contextual logger , if available, and would allow logs originating from a certain HTTP request to be correlated with traceID. In addition, when tracing not enabled, skip adding traceID=00000000000000000000000000000000 to logs.	3 years ago
Marcus Efraimsson	0afc542998	Chore: Try to fix flaky reverse proxy test (#47957 )	4 years ago
Marcus Efraimsson	4bc582570e	Instrumentation: Proxy status code correction and various improvements (#47473 ) For a proxied request, e.g. Grafana's datasource or plugin proxy: If the request is cancelled, e.g. from the browser, the HTTP status code is now 499 Client closed request instead of 502 Bad gateway. If the request times out, e.g. takes longer time than allowed, the HTTP status code is now 504 Gateway timeout instead of 502 Bad gateway. This also means that request metrics and logs will get their status codes adjusted according to above. Fixes #46337 Fixes #46338	4 years ago
Dimitris Sotirakis	605d056136	Security: Sync security changes on main (#45083 ) * * Teams: Appropriately apply user id filter in /api/teams/:id and /api/teams/search * Teams: Ensure that users searching for teams are only able see teams they have access to * Teams: Require teamGuardian admin privileges to list team members * Teams: Prevent org viewers from administering teams * Teams: Add org_id condition to team count query * Teams: clarify permission requirements in teams api docs * Teams: expand scenarios for team search tests * Teams: mock teamGuardian in tests Co-authored-by: Dan Cech <dcech@grafana.com> * remove duplicate WHERE statement * Fix for CVE-2022-21702 (cherry picked from commit 202d7c190082c094bc1dc13f7fe9464746c37f9e) * Lint and test fixes (cherry picked from commit 3e6b67d5504abf4a1d7b8d621f04d062c048e981) * check content type properly (cherry picked from commit 70b4458892bf2f776302720c10d24c9ff34edd98) * basic csrf origin check (cherry picked from commit 3adaa5ff39832364f6390881fb5b42ad47df92e1) * compare origin to host (cherry picked from commit 5443892699e8ed42836bb2b9a44744ff3e970f42) * simplify url parsing (cherry picked from commit b2ffbc9513fed75468628370a48b929d30af2b1d) * check csrf for GET requests, only compare origin (cherry picked from commit 8b81dc12d8f8a1f07852809c5b4d44f0f0b1d709) * parse content type properly (cherry picked from commit 16f76f4902e6f2188bea9606c68b551af186bdc0) * mentioned get in the comment (cherry picked from commit a7e61811ef8ae558ce721e2e3fed04ce7a5a5345) * add content-type: application/json to test HTTP requests * fix pluginproxy test * Fix linter when comparing errors Co-authored-by: Kevin Minehart <kmineh0151@gmail.com> Co-authored-by: Dan Cech <dcech@grafana.com> Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com> Co-authored-by: Serge Zaitsev <serge.zaitsev@grafana.com> Co-authored-by: Vardan Torosyan <vardants@gmail.com>	4 years ago
Arve Knudsen	ac09baae7d	Chore: Use Header.Set method instead of Header.Add (#29804 ) Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>	5 years ago
Mario Trangoni	5116420e9a	Fix misspell issues (#23905 ) * Fix misspell issues See, $ golangci-lint run --timeout 10m --disable-all -E misspell ./... Signed-off-by: Mario Trangoni <mjtrangoni@gmail.com> * Fix codespell issues See, $ codespell -S './.git' -L 'uint,thru,pres,unknwon,serie,referer,uptodate,durationm' Signed-off-by: Mario Trangoni <mjtrangoni@gmail.com> ci please? * non-empty commit - ci? * Trigger build Co-authored-by: bergquist <carl.bergquist@gmail.com> Co-authored-by: Kyle Brandt <kyle@grafana.com>	6 years ago
Marcus Efraimsson	e6cec8dbdc	Backend plugins: Prepare and clean request headers before resource calls (#22321 ) Moves common request proxy utilities to proxyutil package with support for removing X-Forwarded-Host, X-Forwarded-Port, X-Forwarded-Proto headers, setting X-Forwarded-For header and cleaning Cookie header. Using the proxyutil package to prepare and clean request headers before resource calls. Closes #21512	6 years ago

33 Commits (c440bd2bdaec8fed13f47fdfe76dda63e7d0008a)