IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

AuthN: Fix signout redirect url (#87631)

Browse Source 
* Add missing return

* Use sign out redirect url from auth config if configured

* remove option from auth.jwt that is not used
This commit is contained in:
Karl Persson 2024-05-12 19:53:19 +02:00 committed by GitHub
parent 3dab7e44ec
commit 0f3080ecb8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 22 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
conf/defaults.ini
View File

@ -875,7 +875,6 @@ auto_sign_up = false
url_login = false url_login = false
allow_assign_grafana_admin = false allow_assign_grafana_admin = false
skip_org_role_sync = false skip_org_role_sync = false
signout_redirect_url =
#################################### Auth LDAP ########################### #################################### Auth LDAP ###########################
[auth.ldap] [auth.ldap]

1
pkg/api/login.go
View File

@ -254,6 +254,7 @@ func (hs *HTTPServer) Logout(c *contextmodel.ReqContext) {
if err != nil { if err != nil {
hs.log.Error("Failed perform proper logout", "error", err) hs.log.Error("Failed perform proper logout", "error", err)
c.Redirect(hs.Cfg.AppSubURL + "/login") c.Redirect(hs.Cfg.AppSubURL + "/login")
return
} }
_, id := c.SignedInUser.GetNamespacedID() _, id := c.SignedInUser.GetNamespacedID()

13
pkg/services/authn/authnimpl/service.go
View File

@ -17,7 +17,6 @@ import (
"github.com/grafana/grafana/pkg/infra/tracing" "github.com/grafana/grafana/pkg/infra/tracing"
"github.com/grafana/grafana/pkg/infra/usagestats" "github.com/grafana/grafana/pkg/infra/usagestats"
"github.com/grafana/grafana/pkg/services/auth" "github.com/grafana/grafana/pkg/services/auth"
"github.com/grafana/grafana/pkg/services/auth/identity"
"github.com/grafana/grafana/pkg/services/authn" "github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/authn/clients" "github.com/grafana/grafana/pkg/services/authn/clients"
"github.com/grafana/grafana/pkg/services/user" "github.com/grafana/grafana/pkg/services/user"
@ -265,15 +264,17 @@ func (s *Service) Logout(ctx context.Context, user authn.Requester, sessionToken
defer span.End() defer span.End()
redirect := &authn.Redirect{URL: s.cfg.AppSubURL + "/login"} redirect := &authn.Redirect{URL: s.cfg.AppSubURL + "/login"}
if s.cfg.SignoutRedirectUrl != "" {
redirect.URL = s.cfg.SignoutRedirectUrl
}
namespace, id := user.GetNamespacedID() if !user.GetID().IsNamespace(authn.NamespaceUser) {
if namespace != authn.NamespaceUser {
return redirect, nil return redirect, nil
} }
userID, err := identity.IntIdentifier(namespace, id) id, err := user.GetID().ParseInt()
if err != nil { if err != nil {
s.log.FromContext(ctx).Debug("Invalid user id", "id", userID, "err", err) s.log.FromContext(ctx).Debug("Invalid user id", "id", id, "err", err)
return redirect, nil return redirect, nil
} }
@ -301,7 +302,7 @@ func (s *Service) Logout(ctx context.Context, user authn.Requester, sessionToken
} }
Default: Default:
if err = s.sessionService.RevokeToken(ctx, sessionToken, false); err != nil { if err = s.sessionService.RevokeToken(ctx, sessionToken, false); err != nil && !errors.Is(err, auth.ErrUserTokenNotFound) {
return nil, err return nil, err
} }

13
pkg/services/authn/authnimpl/service_test.go
View File

@ -410,6 +410,7 @@ func TestService_Logout(t *testing.T) {
sessionToken *usertoken.UserToken sessionToken *usertoken.UserToken
client authn.Client client authn.Client
signoutRedirectURL string
expectedErr error expectedErr error
expectedTokenRevoked bool expectedTokenRevoked bool
@ -441,6 +442,14 @@ func TestService_Logout(t *testing.T) {
client: &authntest.FakeClient{ExpectedName: "auth.client.azuread"}, client: &authntest.FakeClient{ExpectedName: "auth.client.azuread"},
expectedTokenRevoked: true, expectedTokenRevoked: true,
}, },
{
desc: "should use signout redirect url if configured",
identity: &authn.Identity{ID: authn.NewNamespaceID(authn.NamespaceUser, 1), AuthenticatedBy: "azuread"},
expectedRedirect: &authn.Redirect{URL: "some-url"},
client: &authntest.FakeClient{ExpectedName: "auth.client.azuread"},
signoutRedirectURL: "some-url",
expectedTokenRevoked: true,
},
{ {
desc: "should redirect to client specific url", desc: "should redirect to client specific url",
identity: &authn.Identity{ID: authn.NewNamespaceID(authn.NamespaceUser, 1), AuthenticatedBy: "azuread"}, identity: &authn.Identity{ID: authn.NewNamespaceID(authn.NamespaceUser, 1), AuthenticatedBy: "azuread"},
@ -473,6 +482,10 @@ func TestService_Logout(t *testing.T) {
return nil return nil
}, },
} }
if tt.signoutRedirectURL != "" {
svc.cfg.SignoutRedirectUrl = tt.signoutRedirectURL
}
}) })
redirect, err := s.Logout(context.Background(), tt.identity, tt.sessionToken) redirect, err := s.Logout(context.Background(), tt.identity, tt.sessionToken)