IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Authn: Fix password client fallthrough (#63244)

Browse Source 
* fix password client fallthrough

* fix grafana client String
This commit is contained in:
Jo 2023-02-12 14:42:47 +01:00 committed by GitHub
parent 6ca9e5b440
commit 554dc9b97d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 24 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/services/authn/clients/basic.go
View File

@ -21,6 +21,10 @@ type Basic struct {
client authn.PasswordClient
}
func (c *Basic) String() string {
return c.Name()
}
func (c *Basic) Name() string {
return authn.ClientBasic
}

4
pkg/services/authn/clients/grafana.go
View File

@ -26,6 +26,10 @@ type Grafana struct {
userService user.Service
}
func (c *Grafana) String() string {
return "grafana"
}
func (c *Grafana) AuthenticateProxy(ctx context.Context, r *authn.Request, username string, additional map[string]string) (*authn.Identity, error) {
identity := &authn.Identity{
AuthModule: login.AuthProxyAuthModule,

4
pkg/services/authn/clients/ldap.go
View File

@ -27,6 +27,10 @@ type LDAP struct {
service ldapService
}
func (c *LDAP) String() string {
return "ldap"
}
func (c *LDAP) AuthenticateProxy(ctx context.Context, r *authn.Request, username string, _ map[string]string) (*authn.Identity, error) {
info, err := c.service.User(username)
if errors.Is(err, multildap.ErrDidNotFindUser) {

23
pkg/services/authn/clients/password.go
View File

@ -4,6 +4,9 @@ import (
"context"
"errors"
"github.com/hashicorp/go-multierror"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/loginattempt"
"github.com/grafana/grafana/pkg/util/errutil"
@ -20,12 +23,13 @@ var (
var _ authn.PasswordClient = new(Password)
func ProvidePassword(loginAttempts loginattempt.Service, clients ...authn.PasswordClient) *Password {
return &Password{loginAttempts, clients}
return &Password{loginAttempts, clients, log.New("authn.password")}
}
type Password struct {
loginAttempts loginattempt.Service
clients []authn.PasswordClient
log log.Logger
}
func (c *Password) AuthenticatePassword(ctx context.Context, r *authn.Request, username, password string) (*authn.Identity, error) {
@ -43,25 +47,22 @@ func (c *Password) AuthenticatePassword(ctx context.Context, r *authn.Request, u
return nil, errEmptyPassword.Errorf("no password provided")
}
var clientErr error
var clientErrs error
for _, pwClient := range c.clients {
var identity *authn.Identity
identity, clientErr = pwClient.AuthenticatePassword(ctx, r, username, password)
identity, clientErr := pwClient.AuthenticatePassword(ctx, r, username, password)
clientErrs = multierror.Append(clientErrs, clientErr)
// for invalid password or if the identity is not found by a client continue to next one
if errors.Is(clientErr, errInvalidPassword) || errors.Is(clientErr, errIdentityNotFound) {
continue
}
if clientErr != nil {
return nil, errPasswordAuthFailed.Errorf("failed to authenticate identity: %w", clientErr)
c.log.Warn("failed to authenticate password identity", "client", pwClient, "error", clientErr)
continue
}
return identity, nil
}
if errors.Is(clientErr, errInvalidPassword) {
if errors.Is(clientErrs, errInvalidPassword) {
_ = c.loginAttempts.Add(ctx, username, web.RemoteAddr(r.HTTPRequest))
}
return nil, errPasswordAuthFailed.Errorf("failed to authenticate identity: %w", clientErr)
return nil, errPasswordAuthFailed.Errorf("failed to authenticate identity: %w", clientErrs)
}