SAML: Do not SAML SLO if user is not SAML authenticated (#53418)

* Only SLO user if the user is using SAML

* only one source of truth for auth module info

* ensure SAML is also enabled and not only SLO

* move auth module naming to auth module login package

* use constants in other previously unused spots

pkg/services/contexthandler/authproxy/authproxy.go

@@ -258,7 +258,7 @@ func (auth *AuthProxy) LoginViaLDAP(reqCtx *models.ReqContext) (int64, error) {
 func (auth *AuthProxy) loginViaHeader(reqCtx *models.ReqContext) (int64, error) {
 	header := auth.getDecodedHeader(reqCtx, auth.cfg.AuthProxyHeaderName)
 	extUser := &models.ExternalUserInfo{
-		AuthModule: "authproxy",
+		AuthModule: login.AuthProxyAuthModule,
 		AuthId:     header,
 	}
 

pkg/services/ldap/ldap.go

@@ -17,6 +17,7 @@ import (
 
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/models"
+	"github.com/grafana/grafana/pkg/services/login"
 )
 
 // IConnection is interface for LDAP connection manipulation
@@ -429,7 +430,7 @@ func (server *Server) buildGrafanaUser(user *ldap.Entry) (*models.ExternalUserIn
 
 	attrs := server.Config.Attr
 	extUser := &models.ExternalUserInfo{
-		AuthModule: models.AuthModuleLDAP,
+		AuthModule: login.LDAPAuthModule,
 		AuthId:     user.DN,
 		Name: strings.TrimSpace(
 			fmt.Sprintf(

pkg/services/login/authinfo.go

@@ -14,3 +14,34 @@ type AuthInfoService interface {
 	SetAuthInfo(ctx context.Context, cmd *models.SetAuthInfoCommand) error
 	UpdateAuthInfo(ctx context.Context, cmd *models.UpdateAuthInfoCommand) error
 }
+
+const (
+	SAMLAuthModule      = "auth.saml"
+	LDAPAuthModule      = "ldap"
+	AuthProxyAuthModule = "authproxy"
+)
+
+func GetAuthProviderLabel(authModule string) string {
+	switch authModule {
+	case "oauth_github":
+		return "GitHub"
+	case "oauth_google":
+		return "Google"
+	case "oauth_azuread":
+		return "AzureAD"
+	case "oauth_gitlab":
+		return "GitLab"
+	case "oauth_grafana_com", "oauth_grafananet":
+		return "grafana.com"
+	case SAMLAuthModule:
+		return "SAML"
+	case LDAPAuthModule, "": // FIXME: verify this situation doesn't exist anymore
+		return "LDAP"
+	case "jwt":
+		return "JWT"
+	case AuthProxyAuthModule:
+		return "Auth Proxy"
+	default:
+		return "OAuth" // FIXME: replace with "Unknown" and handle generic oauth as a case
+	}
+}

pkg/services/login/loginservice/loginservice.go

@@ -124,7 +124,7 @@ func (ls *Implementation) UpsertUser(ctx context.Context, cmd *models.UpsertUser
 			}
 		}
 
-		if extUser.AuthModule == models.AuthModuleLDAP && usr.IsDisabled {
+		if extUser.AuthModule == login.LDAPAuthModule && usr.IsDisabled {
 			// Re-enable user when it found in LDAP
 			if errDisableUser := ls.SQLStore.DisableUser(ctx,
 				&models.DisableUserCommand{

pkg/services/login/loginservice/loginservice_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/go-kit/log"
 	"github.com/go-kit/log/level"
 	"github.com/grafana/grafana/pkg/models"
+	"github.com/grafana/grafana/pkg/services/login"
 	"github.com/grafana/grafana/pkg/services/login/logintest"
 	"github.com/grafana/grafana/pkg/services/quota/quotaimpl"
 	"github.com/grafana/grafana/pkg/services/sqlstore/mockstore"
@@ -144,7 +145,7 @@ func createUserOrgDTO() []*models.UserOrgDTO {
 
 func createSimpleExternalUser() models.ExternalUserInfo {
 	externalUser := models.ExternalUserInfo{
-		AuthModule: "ldap",
+		AuthModule: login.LDAPAuthModule,
 		OrgRoles: map[int64]models.RoleType{
 			1: models.ROLE_VIEWER,
 		},

pkg/services/searchusers/searchusers.go

@@ -6,6 +6,7 @@ import (
 	"github.com/grafana/grafana/pkg/api/dtos"
 	"github.com/grafana/grafana/pkg/api/response"
 	"github.com/grafana/grafana/pkg/models"
+	"github.com/grafana/grafana/pkg/services/login"
 	"github.com/grafana/grafana/pkg/services/sqlstore"
 )
 
@@ -99,7 +100,7 @@ func (s *OSSService) SearchUser(c *models.ReqContext) (*models.SearchUsersQuery,
 		user.AuthLabels = make([]string, 0)
 		if user.AuthModule != nil && len(user.AuthModule) > 0 {
 			for _, authModule := range user.AuthModule {
-				user.AuthLabels = append(user.AuthLabels, GetAuthProviderLabel(authModule))
+				user.AuthLabels = append(user.AuthLabels, login.GetAuthProviderLabel(authModule))
 			}
 		}
 	}
@@ -109,26 +110,3 @@ func (s *OSSService) SearchUser(c *models.ReqContext) (*models.SearchUsersQuery,
 
 	return query, nil
 }
-
-func GetAuthProviderLabel(authModule string) string {
-	switch authModule {
-	case "oauth_github":
-		return "GitHub"
-	case "oauth_google":
-		return "Google"
-	case "oauth_azuread":
-		return "AzureAD"
-	case "oauth_gitlab":
-		return "GitLab"
-	case "oauth_grafana_com", "oauth_grafananet":
-		return "grafana.com"
-	case "auth.saml":
-		return "SAML"
-	case "ldap", "":
-		return "LDAP"
-	case "jwt":
-		return "JWT"
-	default:
-		return "OAuth"
-	}
-}