diff --git a/conf/defaults.ini b/conf/defaults.ini index 680aca98bce..07ad63bddd8 100644 --- a/conf/defaults.ini +++ b/conf/defaults.ini @@ -376,6 +376,8 @@ client_secret = some_client_secret scopes = openid email profile auth_url = https://login.microsoftonline.com//oauth2/v2.0/authorize token_url = https://login.microsoftonline.com//oauth2/v2.0/token +allowed_domains = +allowed_groups = #################################### Generic OAuth ####################### [auth.generic_oauth] diff --git a/conf/sample.ini b/conf/sample.ini index 123a39513e7..8dc8e4c0fac 100644 --- a/conf/sample.ini +++ b/conf/sample.ini @@ -366,6 +366,8 @@ ;scopes = openid email profile ;auth_url = https://login.microsoftonline.com//oauth2/v2.0/authorize ;token_url = https://login.microsoftonline.com//oauth2/v2.0/token +;allowed_domains = +;allowed_groups = #################################### Generic OAuth ########################## [auth.generic_oauth] diff --git a/docs/sources/auth/azuread.md b/docs/sources/auth/azuread.md index 5c5d62902ab..4d409f27a9f 100644 --- a/docs/sources/auth/azuread.md +++ b/docs/sources/auth/azuread.md @@ -1,6 +1,6 @@ +++ -title = "Azure AD OAuth2 Authentication" -description = "Grafana OAuthentication Guide " +title = "Azure AD OAuth2 authentication" +description = "Grafana Azure AD OAuth Guide " keywords = ["grafana", "configuration", "documentation", "oauth"] type = "docs" [menu.docs] @@ -10,16 +10,14 @@ parent = "authentication" weight = 3 +++ -# Azure AD OAuth2 Authentication +# Azure AD OAuth2 authentication -The Azure AD authentication provides the possibility to use an Azure Active Directory tenant as an identity provider for Grafana. +The Azure AD authentication provides the possibility to use an Azure Active Directory tenant as an identity provider for Grafana. By using Azure AD Application Roles it is also possible to assign Users and Groups to Grafana roles from the Azure Portal. -By using Azure AD Application Roles it is also possible to assign Users and Groups to Grafana roles from the Azure Portal. +## Create the Azure AD application To enable the Azure AD OAuth2 you must register your application with Azure AD. -# Create Azure AD application - 1. Log in to [Azure Portal](https://portal.azure.com) and click **Azure Active Directory** in the side menu. 1. Click **App Registrations** and add a new application registration: @@ -92,6 +90,8 @@ To enable the Azure AD OAuth2 you must register your application with Azure AD. 1. Click on **Users and groups** and add Users/Groups to the Grafana roles by using **Add User**. +## Enable Azure AD Oauth in Grafana + 1. Add the following to the [Grafana configuration file]({{< relref "../installation/configuration.md#config-file-locations" >}}): ```ini @@ -104,6 +104,35 @@ client_secret = CLIENT_SECRET scopes = openid email profile auth_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize token_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token +allowed_domains = +allowed_groups = ``` > Note: Ensure that the [root_url]({{< relref "../installation/configuration/#root-url" >}}) in Grafana is set in your Azure Application Reply URLs (App -> Settings -> Reply URLs) + +### Configure allowed groups and domains + +To limit access to authenticated users that are members of one or more groups, set `allowed_groups` +to a comma- or space-separated list of group Object Ids. Object Id for a specific group can be found on the Azure portal: go to Azure Active Directory -> Groups. For instance, if you want to +only give access to members of the group `example` which has Id `8bab1c86-8fba-33e5-2089-1d1c80ec267d`, set + +```ini +allowed_groups = 8bab1c86-8fba-33e5-2089-1d1c80ec267d +``` + +The `allowed_domains` option limits access to the users belonging to the specific domains. Domains should be separated by space or comma. + +```ini +allowed_domains = mycompany.com mycompany.org +``` + +### Team Sync (Enterprise only) + +> Only available in Grafana Enterprise v6.7+ + +With Team Sync you can map your Azure AD groups to teams in Grafana so that your users will automatically be added to +the correct teams. + +Azure AD groups can be referenced by group Object Id, like `8bab1c86-8fba-33e5-2089-1d1c80ec267d`. + +[Learn more about Team Sync]({{< relref "team-sync.md" >}}) diff --git a/pkg/login/social/azuread_oauth.go b/pkg/login/social/azuread_oauth.go index 327ec80d0e8..620a232109c 100644 --- a/pkg/login/social/azuread_oauth.go +++ b/pkg/login/social/azuread_oauth.go @@ -15,6 +15,7 @@ import ( type SocialAzureAD struct { *SocialBase allowedDomains []string + allowedGroups []string allowSignup bool } @@ -22,6 +23,7 @@ type azureClaims struct { Email string `json:"email"` PreferredUsername string `json:"preferred_username"` Roles []string `json:"roles"` + Groups []string `json:"groups"` Name string `json:"name"` ID string `json:"oid"` } @@ -62,15 +64,37 @@ func (s *SocialAzureAD) UserInfo(_ *http.Client, token *oauth2.Token) (*BasicUse role := extractRole(claims) + groups := extractGroups(claims) + if !s.IsGroupMember(groups) { + return nil, ErrMissingGroupMembership + } + return &BasicUserInfo{ - Id: claims.ID, - Name: claims.Name, - Email: email, - Login: email, - Role: string(role), + Id: claims.ID, + Name: claims.Name, + Email: email, + Login: email, + Role: string(role), + Groups: groups, }, nil } +func (s *SocialAzureAD) IsGroupMember(groups []string) bool { + if len(s.allowedGroups) == 0 { + return true + } + + for _, allowedGroup := range s.allowedGroups { + for _, group := range groups { + if group == allowedGroup { + return true + } + } + } + + return false +} + func extractEmail(claims azureClaims) string { if claims.Email == "" { if claims.PreferredUsername != "" { @@ -109,3 +133,9 @@ func hasRole(roles []string, role models.RoleType) bool { } return false } + +func extractGroups(claims azureClaims) []string { + groups := make([]string, 0) + groups = append(groups, claims.Groups...) + return groups +} diff --git a/pkg/login/social/azuread_oauth_test.go b/pkg/login/social/azuread_oauth_test.go index 6c7badf54bc..e7e2ee97033 100644 --- a/pkg/login/social/azuread_oauth_test.go +++ b/pkg/login/social/azuread_oauth_test.go @@ -1,19 +1,21 @@ package social import ( - "golang.org/x/oauth2" - "gopkg.in/square/go-jose.v2" - "gopkg.in/square/go-jose.v2/jwt" "net/http" "reflect" "testing" "time" + + "golang.org/x/oauth2" + "gopkg.in/square/go-jose.v2" + "gopkg.in/square/go-jose.v2/jwt" ) func TestSocialAzureAD_UserInfo(t *testing.T) { type fields struct { SocialBase *SocialBase allowedDomains []string + allowedGroups []string allowSignup bool } type args struct { @@ -44,7 +46,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { Login: "me@example.com", Company: "", Role: "Viewer", - Groups: nil, + Groups: []string{}, }, }, { @@ -81,7 +83,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { Login: "me@example.com", Company: "", Role: "Viewer", - Groups: nil, + Groups: []string{}, }, }, { @@ -100,7 +102,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { Login: "me@example.com", Company: "", Role: "Admin", - Groups: nil, + Groups: []string{}, }, }, { @@ -119,7 +121,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { Login: "me@example.com", Company: "", Role: "Admin", - Groups: nil, + Groups: []string{}, }, }, { @@ -138,7 +140,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { Login: "me@example.com", Company: "", Role: "Viewer", - Groups: nil, + Groups: []string{}, }, }, @@ -158,7 +160,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { Login: "me@example.com", Company: "", Role: "Editor", - Groups: nil, + Groups: []string{}, }, }, { @@ -177,7 +179,46 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { Login: "me@example.com", Company: "", Role: "Admin", - Groups: nil, + Groups: []string{}, + }, + }, + { + name: "Error if user is not a member of allowed_groups", + fields: fields{ + allowedGroups: []string{"dead-beef"}, + }, + claims: &azureClaims{ + Email: "me@example.com", + PreferredUsername: "", + Roles: []string{}, + Groups: []string{"foo", "bar"}, + Name: "My Name", + ID: "1234", + }, + want: nil, + wantErr: true, + }, + { + name: "Error if user is a member of allowed_groups", + fields: fields{ + allowedGroups: []string{"foo", "bar"}, + }, + claims: &azureClaims{ + Email: "me@example.com", + PreferredUsername: "", + Roles: []string{}, + Groups: []string{"foo"}, + Name: "My Name", + ID: "1234", + }, + want: &BasicUserInfo{ + Id: "1234", + Name: "My Name", + Email: "me@example.com", + Login: "me@example.com", + Company: "", + Role: "Viewer", + Groups: []string{"foo"}, }, }, } @@ -186,6 +227,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { s := &SocialAzureAD{ SocialBase: tt.fields.SocialBase, allowedDomains: tt.fields.allowedDomains, + allowedGroups: tt.fields.allowedGroups, allowSignup: tt.fields.allowSignup, } diff --git a/pkg/login/social/common.go b/pkg/login/social/common.go index b813e07ab79..053379f39bd 100644 --- a/pkg/login/social/common.go +++ b/pkg/login/social/common.go @@ -9,6 +9,10 @@ import ( "github.com/grafana/grafana/pkg/infra/log" ) +var ( + ErrMissingGroupMembership = &Error{"User not a member of one of the required groups"} +) + type HttpGetResponse struct { Body []byte Headers http.Header diff --git a/pkg/login/social/gitlab_oauth.go b/pkg/login/social/gitlab_oauth.go index 5c1ee4801c9..93dbb07fd2c 100644 --- a/pkg/login/social/gitlab_oauth.go +++ b/pkg/login/social/gitlab_oauth.go @@ -19,10 +19,6 @@ type SocialGitlab struct { allowSignup bool } -var ( - ErrMissingGroupMembership = &Error{"User not a member of one of the required groups"} -) - func (s *SocialGitlab) Type() int { return int(models.GITLAB) } diff --git a/pkg/login/social/social.go b/pkg/login/social/social.go index 2093e457701..53be4ed6291 100644 --- a/pkg/login/social/social.go +++ b/pkg/login/social/social.go @@ -160,6 +160,7 @@ func NewOAuthService() { log: logger, }, allowedDomains: info.AllowedDomains, + allowedGroups: util.SplitString(sec.Key("allowed_groups").String()), allowSignup: info.AllowSignup, } }