IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

LDAP: FIX Enable users on successfull login (#75073)

Browse Source 
* LDAP: Enable users on successfull login

* Force enable ldap users on successful login

* Fix tests

* Fix tests
This commit is contained in:
Gabriel MABILLE 2023-09-20 17:26:50 +02:00 committed by GitHub
parent 0884f78110
commit c8149d50f9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/services/authn/clients/ldap.go
View File

@ -107,7 +107,7 @@ func (c *LDAP) disableUser(ctx context.Context, username string) (*authn.Identit
} }
func (c *LDAP) identityFromLDAPInfo(orgID int64, info *login.ExternalUserInfo) *authn.Identity { func (c *LDAP) identityFromLDAPInfo(orgID int64, info *login.ExternalUserInfo) *authn.Identity {
return &authn.Identity{ id := &authn.Identity{
OrgID: orgID, OrgID: orgID,
OrgRoles: info.OrgRoles, OrgRoles: info.OrgRoles,
Login: info.Login, Login: info.Login,
@ -131,4 +131,12 @@ func (c *LDAP) identityFromLDAPInfo(orgID int64, info *login.ExternalUserInfo) *
}, },
}, },
} }
// The ldap service is not aware of the internal state of the user. Fetching the user
// from the store to know if that user is disabled or not, is almost as costly as
// running an update systematically. We are setting IsDisabled to true so that the
// EnableDisabledUserHook force-enable that user.
id.IsDisabled = true
return id
} }

2
pkg/services/authn/clients/ldap_test.go
View File

@ -60,6 +60,7 @@ func TestLDAP_AuthenticateProxy(t *testing.T) {
AuthenticatedBy: login.LDAPAuthModule, AuthenticatedBy: login.LDAPAuthModule,
AuthID: "123", AuthID: "123",
Groups: []string{"1", "2"}, Groups: []string{"1", "2"},
IsDisabled: true, // Users are marked as disabled to force enablement on successful login
ClientParams: authn.ClientParams{ ClientParams: authn.ClientParams{
SyncUser: true, SyncUser: true,
SyncTeams: true, SyncTeams: true,
@ -129,6 +130,7 @@ func TestLDAP_AuthenticatePassword(t *testing.T) {
AuthenticatedBy: login.LDAPAuthModule, AuthenticatedBy: login.LDAPAuthModule,
AuthID: "123", AuthID: "123",
Groups: []string{"1", "2"}, Groups: []string{"1", "2"},
IsDisabled: true, // Users are marked as disabled to force enablement on successful login
ClientParams: authn.ClientParams{ ClientParams: authn.ClientParams{
SyncUser: true, SyncUser: true,
SyncTeams: true, SyncTeams: true,