IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

SSO: Fix team_ids validation for Generic OAuth (#100732)

Browse Source 
fix team_ids validation in the API
This commit is contained in:
Mihai Doarna 2025-02-14 17:57:28 +02:00 committed by GitHub
parent cbae35c28b
commit dc5602bad9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 58 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/login/social/connectors/generic_oauth.go
View File

@ -111,7 +111,8 @@ func (s *SocialGenericOAuth) Validate(ctx context.Context, newSettings ssoModels
return err
}
if info.Extra[teamIdsKey] != "" && (info.TeamIdsAttributePath == "" || info.TeamsUrl == "") {
teamIds := util.SplitString(info.Extra[teamIdsKey])
if len(teamIds) > 0 && (info.TeamIdsAttributePath == "" || info.TeamsUrl == "") {
return ssosettings.ErrInvalidOAuthConfig("If Team Ids are configured then Team Ids attribute path and Teams URL must be configured.")
}

56
pkg/login/social/connectors/generic_oauth_test.go
View File

@ -1000,6 +1000,34 @@ func TestSocialGenericOAuth_Validate(t *testing.T) {
},
wantErr: nil,
},
{
name: "passes when team_ids is an empty array and teams_id_attribute_path and teams_url are empty",
settings: ssoModels.SSOSettings{
Settings: map[string]any{
"client_id": "client-id",
"team_ids_attribute_path": "",
"teams_url": "",
"auth_url": "https://example.com/auth",
"token_url": "https://example.com/token",
"team_ids": "[]",
},
},
wantErr: nil,
},
{
name: "passes when team_ids is set and teams_id_attribute_path and teams_url are not empty",
settings: ssoModels.SSOSettings{
Settings: map[string]any{
"client_id": "client-id",
"team_ids_attribute_path": "teams",
"teams_url": "https://example.com/teams",
"auth_url": "https://example.com/auth",
"token_url": "https://example.com/token",
"team_ids": "[\"123\"]",
},
},
wantErr: nil,
},
{
name: "fails if settings map contains an invalid field",
settings: ssoModels.SSOSettings{
@ -1116,6 +1144,34 @@ func TestSocialGenericOAuth_Validate(t *testing.T) {
},
wantErr: ssosettings.ErrBaseInvalidOAuthConfig,
},
{
name: "fails when team_ids is a valid string and teams_id_attribute_path and teams_url are empty",
settings: ssoModels.SSOSettings{
Settings: map[string]any{
"client_id": "client-id",
"team_ids_attribute_path": "",
"teams_url": "",
"auth_url": "https://example.com/auth",
"token_url": "https://example.com/token",
"team_ids": "123",
},
},
wantErr: ssosettings.ErrBaseInvalidOAuthConfig,
},
{
name: "fails when team_ids is a valid array and teams_id_attribute_path and teams_url are empty",
settings: ssoModels.SSOSettings{
Settings: map[string]any{
"client_id": "client-id",
"team_ids_attribute_path": "",
"teams_url": "",
"auth_url": "https://example.com/auth",
"token_url": "https://example.com/token",
"team_ids": "[\"123\",\"456\",\"789\"]",
},
},
wantErr: ssosettings.ErrBaseInvalidOAuthConfig,
},
}
for _, tc := range testCases {