IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Auth: Improve /admin/authentication permission checks and include new SSO pages (#81183)

Browse Source 
* Move evalAuthSettings to ssoutils

* Improve permission check for auth page
This commit is contained in:
Misi
2024-01-25 11:13:24 +01:00
committed by GitHub
parent 7e5544ab21
commit 4577e61ee7
4 changed files with 38 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
pkg/api/api.go
View File

@@ -35,6 +35,7 @@ import (
"github.com/grafana/grafana/pkg/middleware"
"github.com/grafana/grafana/pkg/middleware/requestmeta"
ac "github.com/grafana/grafana/pkg/services/accesscontrol"
"github.com/grafana/grafana/pkg/services/accesscontrol/ssoutils"
"github.com/grafana/grafana/pkg/services/apikey"
"github.com/grafana/grafana/pkg/services/auth"
"github.com/grafana/grafana/pkg/services/correlations"
@@ -220,7 +221,15 @@ func (hs *HTTPServer) registerRoutes() {
r.Get("/user/auth-tokens/rotate", routing.Wrap(hs.RotateUserAuthTokenRedirect))
}
r.Get("/admin/authentication/", authorize(evalAuthenticationSettings()), hs.Index)
adminAuthPageEvaluator := func() ac.Evaluator {
authnSettingsEval := ssoutils.EvalAuthenticationSettings(hs.Cfg)
if hs.Features.IsEnabledGlobally(featuremgmt.FlagSsoSettingsApi) {
return ac.EvalAny(authnSettingsEval, ssoutils.OauthSettingsEvaluator(hs.Cfg))
}
return authnSettingsEval
}
r.Get("/admin/authentication/", authorize(adminAuthPageEvaluator()), hs.Index)
r.Get("/admin/authentication/ldap", authorize(ac.EvalPermission(ac.ActionLDAPStatusRead)), hs.Index)
if hs.Features.IsEnabledGlobally(featuremgmt.FlagSsoSettingsApi) {
providerParam := ac.Parameter("provider")
@@ -633,10 +642,3 @@ func (hs *HTTPServer) registerRoutes() {
r.Get("/api/snapshots-delete/:deleteKey", reqSnapshotPublicModeOrSignedIn, routing.Wrap(hs.DeleteDashboardSnapshotByDeleteKey))
r.Delete("/api/snapshots/:key", reqSignedIn, routing.Wrap(hs.DeleteDashboardSnapshot))
}
func evalAuthenticationSettings() ac.Evaluator {
return ac.EvalAny(ac.EvalAll(
ac.EvalPermission(ac.ActionSettingsWrite, ac.ScopeSettingsSAML),
ac.EvalPermission(ac.ActionSettingsRead, ac.ScopeSettingsSAML),
), ac.EvalPermission(ac.ActionLDAPStatusRead))
}