IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

authn: grpcutils: Mark ID Tokens optional in cloud mode in gRPC Authenticator (#96824)

Browse Source 
This patch marks ID tokens as not required when initalising a gRPC
Authenticator to be used in `cloud` mode. ID Tokens are still enabled in
`cloud` mode, but the `Required` option is set to `false`.

This is needed for MT services like Cloud API Server to authenticate
against gRPC services like Resource Store with only an Access Token.

Signed-off-by: Prem Kumar <prem.saraswat@grafana.com>
This commit is contained in:
Prem Saraswat 2024-11-21 18:41:49 +05:30 committed by GitHub
parent c2e1a405b9
commit ca2c874161
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/services/authn/grpcutils/grpc_authenticator.go
View File

@ -49,14 +49,20 @@ func NewGrpcAuthenticator(cfg *setting.Cfg, tracer tracing.Tracer) (*authnlib.Gr
keyRetriever := authnlib.NewKeyRetriever(grpcAuthCfg.KeyRetrieverConfig, authnlib.WithHTTPClientKeyRetrieverOpt(client)) keyRetriever := authnlib.NewKeyRetriever(grpcAuthCfg.KeyRetrieverConfig, authnlib.WithHTTPClientKeyRetrieverOpt(client))
grpcOpts := []authnlib.GrpcAuthenticatorOption{ grpcOpts := []authnlib.GrpcAuthenticatorOption{
authnlib.WithIDTokenAuthOption(true),
authnlib.WithKeyRetrieverOption(keyRetriever), authnlib.WithKeyRetrieverOption(keyRetriever),
authnlib.WithTracerAuthOption(tracer), authnlib.WithTracerAuthOption(tracer),
} }
if authCfg.Mode == ModeOnPrem { switch authCfg.Mode {
case ModeOnPrem:
grpcOpts = append(grpcOpts, grpcOpts = append(grpcOpts,
// Access token are not yet available on-prem // Access token are not yet available on-prem
authnlib.WithDisableAccessTokenAuthOption(), authnlib.WithDisableAccessTokenAuthOption(),
authnlib.WithIDTokenAuthOption(true),
)
case ModeCloud:
grpcOpts = append(grpcOpts,
// ID tokens are enabled but not required in cloud
authnlib.WithIDTokenAuthOption(false),
) )
} }