IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2024-11-23 01:16:31 -06:00
Code Issues Packages Projects Releases Wiki Activity

AzureAd Oauth: Fix strictMode to reject users without an assigned role (#48474)

Browse Source 
* AzureAd Oauth: Fix strictMode to reject users without an assigned role

Signed-off-by: kyschouv <kyschouv@microsoft.com>

* AzureAd OAuth: Add test for strictMode auth when no role claims are returned

Signed-off-by: kyschouv <kyschouv@microsoft.com>
This commit is contained in:
Kyle Schouviller 2022-04-28 23:13:19 -07:00 committed by GitHub
parent ce8becdfe2
commit 7b224adf9f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/login/social/azuread_oauth.go
View File

@ -124,6 +124,10 @@ func extractEmail(claims azureClaims) string {
func extractRole(claims azureClaims, autoAssignRole string, strictMode bool) models.RoleType {
if len(claims.Roles) == 0 {
if strictMode {
return models.RoleType("")
}
return models.RoleType(autoAssignRole)
}

16
pkg/login/social/azuread_oauth_test.go
View File

@ -296,6 +296,22 @@ func TestSocialAzureAD_UserInfo(t *testing.T) {
want: nil,
wantErr: true,
},
{
name: "Fetch empty role when strict attribute role is true and no role claims returned",
fields: fields{
roleAttributeStrict: true,
},
claims: &azureClaims{
Email: "me@example.com",
PreferredUsername: "",
Roles: []string{},
Groups: []string{},
Name: "My Name",
ID: "1234",
},
want: nil,
wantErr: true,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {