IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Auth: Add sub claim check to JWT Auth pre-checks (#61417)

Browse Source 
* Auth: Add sub claim check to JWT Auth pre-checks

* Add #nosec annotation to the test tokens
This commit is contained in:
Misi
2023-01-16 10:50:34 +01:00
committed by GitHub
parent e481673b77
commit b8b08ea292
6 changed files with 97 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/services/authn/clients/jwt.go
View File

@@ -11,6 +11,7 @@ import (
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/auth"
authJWT "github.com/grafana/grafana/pkg/services/auth/jwt"
"github.com/grafana/grafana/pkg/services/authn"
"github.com/grafana/grafana/pkg/services/login"
"github.com/grafana/grafana/pkg/services/org"
@@ -143,21 +144,14 @@ func (s *JWT) Test(ctx context.Context, r *authn.Request) bool {
return false
}
// The header is Authorization and the token does not look like a JWT,
// this is likely an API key. Pass it on.
if s.cfg.JWTAuthHeaderName == "Authorization" && !looksLikeJWT(jwtToken) {
// If the "sub" claim is missing or empty then pass the control to the next handler
if !authJWT.HasSubClaim(jwtToken) {
return false
}
return true
}
func looksLikeJWT(token string) bool {
// A JWT must have 3 parts separated by `.`.
parts := strings.Split(token, ".")
return len(parts) == 3
}
const roleGrafanaAdmin = "GrafanaAdmin"
func (s *JWT) extractRoleAndAdmin(claims map[string]interface{}) (org.RoleType, bool) {