IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-07-29 15:59:50 -05:00
Code Issues Packages Projects Releases Wiki Activity
41,346 Commits 1,119 Branches 715 Tags
11bc66a0e8b5a1bb0ce893665f0320088fab113d
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jo 45fde4235b Deps: Replace go-jose v2 with go-jose v3 (#64228) 
replace go-jose v2 with go-jose v3
 2023-03-06 15:12:51 +01:00
Jo 05275cc9a4 SAML: Replace is not necessary anymore (#64222) 
replace is not necessary anymore
 2023-03-06 14:42:51 +01:00
Jo 92f47e72e1 Authn: Add missing jwt auth stat (#64127) 
add missing jwt auth stat
 2023-03-03 13:39:08 +01:00
JoKarl PerssonChristopher Moyer
 		7e97dbde65 LDAP: Allow setting minimum TLS version and accepted ciphers (#63646) 
* update ldap library and use go module path

* add TLS min version and accepted min TLS version

* set default min ver to library default

* set default min ver to library default

* add cipher list to toml

* Update pkg/services/ldap/settings.go

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

* Apply suggestions from code review

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

* lint

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
 2023-02-28 12:13:46 +01:00
Jo 3b22955ebb Orgs: Remove auto assign globals (#63754) 
* remove auto assign globals

* add missing gitignore entries
 2023-02-27 10:23:38 +01:00
Jo c8db771939 Users: Fix org user always getting org id = 1 on auto assign false (#63708) 
* fix org user always getting org id = 1 on auto assign false

* make tests explicit

* use correct cfg in service accounts

* fix api tests

* fix database test of ac

* fix InsertOrgUser returning affected rows as orgID
 2023-02-24 18:08:44 +01:00
JoIevaChristopher Moyer
 		af987ae636 SupportBundles: Add bundle encryption based on age (#62501) 
* add bundle encryption based on age

* undo changes to grafana-data

* sort deps

* test bundle creation and encryption

* use whitespace separator

* add support bundle config documentation

* Update docs/sources/troubleshooting/support-bundles/index.md

* Apply suggestions from code review

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* touch up docs

* extract encrypt

* Update docs/sources/troubleshooting/support-bundles/index.md

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

* Update docs/sources/troubleshooting/support-bundles/index.md

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
 2023-02-24 09:24:44 -06:00
Jo 635a456fa4 Authn: Add separate context for session tagging (#63561) 
add context
 2023-02-22 14:31:08 +01:00
Jo 1e84d5d93c Authn: Add caching for anon service (#63521) 
add local cache to protect multiple writes to DB cache
 2023-02-22 09:59:28 +01:00
Jo ff78103a24 Authn: Anon session service (#63052) 
* add anon sessions package

* add usage stat fn

* implement count for cache

* add anonservice to authn broker

* lint

* add tests for remote cache count

* move anon service to services

* wrap tagging in goroutine

* make func used
 2023-02-21 16:21:18 +01:00
Jo 554dc9b97d Authn: Fix password client fallthrough (#63244) 
* fix password client fallthrough

* fix grafana client String
 2023-02-12 13:42:47 +00:00
Jo d4cfbd9fd3 LDAP: Move LDAP globals to Config (#63255) 
* structure dtos and private methods

* add basic LDAP service

* use LDAP service in ldap debug API

* lower non fatal error

* remove unused globals

* wip

* remove final globals

* fix tests to use cfg enabled

* restructure errors

* remove logger from globals

* use ldap service in authn

* use ldap service in context handler

* fix failed tests

* fix ldap middleware provides

* fix provides in auth_test.go
 2023-02-10 19:01:55 +01:00
Jo c70571c536 SupportBundles: Replace feature toggle with enabled (#63241) 
replace feature toggle with enabled
 2023-02-10 10:12:04 +01:00
Jo 7862ae8abf SupportBundles: Add LDAP bundle collector (#63128) 
* fix non-cfg fields used in ldap

* fix non-cfg fields

* add ldap support bundle

* add note on match

* add censoring and docs
 2023-02-09 16:31:31 +01:00
Jo 6322fce725 LDAP: Move to single package cluster (#63035) 
* move multildap to ldap package

* move LDAP api and tests to ldap package

* register background service

* lint
 2023-02-08 09:32:59 +01:00
JoIevaChristopher MoyerChris Moyer
 		f6d856f082 SupportBundles: Add support bundle documentation (#61855) 
* add support bundle page

* Update docs/sources/troubleshooting/support-bundles/index.md

* Update docs/sources/troubleshooting/support-bundles/index.md

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* copy edit

* Update docs/sources/troubleshooting/support-bundles/index.md

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
Co-authored-by: Chris Moyer <chris.moyer@grafana.com>
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
 2023-02-07 04:39:47 -05:00
Jo f9163351fd Support bundles: Refactor registry into separate service (#62945) 
* add bundle registry service to avoid dependency cycles

* move user support bundle collector to user service

* move usage stat bundle implementation to usage stats

* add info for background service

* fix remaining imports

* whitespace
 2023-02-06 17:50:03 +01:00
Jo 14a78b58e9 Authn: Stat registration (#62934) 
* reorganize auth usage stats

* usage stat privilege elevators

* stat count of modified role

* cfg related info

* add authn anon client

* kv store

* ensure anon enabled is collected even if client is not registered

* fix usage stats test
 2023-02-06 17:23:53 +01:00
Jo 12d192d80e AccessControl: Clear user permission cache for update org user role (#62745) 
* clear user permission cache for update org user role

* check enabled state of ac
 2023-02-03 08:37:41 -05:00
JoandRyan McKinley 99155c75e6 SupportBundles: Add URL in troubleshoot panels to support bundles (#62477) 
* add link

* add link

* update text

* update access

---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
 2023-01-31 16:12:20 +01:00
Jo 284ca4eab4 AuthN: JWT remove unnecessary if (#62233) 
remove unnecessary if
 2023-01-26 17:32:20 +01:00
JoandGabriel MABILLE 4bcd3b41ec Server: Remove unused services (#62015) 
remove unused entries

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
 2023-01-26 16:13:22 +01:00
Jo 46cbf9d24c SAML: Update deps (#61906) 2023-01-23 16:24:59 +00:00
Jo 1037ef28a9 SupportBundles: Access control guards (#61914) 
* rename routes and fix access control for support bundles

* AccessControl: Hide menu if not authorized

* AccessControl: Add AC guards for create and delete

* lint
 2023-01-23 16:23:20 +00:00
Jo 7a9793ec0e SupportBundles: Fix collector typos and change defaults (#61850) 
fix collector typos and change defaults
 2023-01-20 16:33:29 +00:00
JoandIeva caae4fd034 SupportBundles: Add config enablement (#61776) 
* wip

* implement role middleware drop

* remove not implement feature

* change grants based on config

* Update pkg/services/supportbundles/supportbundlesimpl/models.go

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
 2023-01-20 08:59:15 +00:00
Jo e2ec219f6a SecretScan: Remove placeholder image and polish errors (#61785) 
* remove placeholder image

* improve http client options

* add http clients options for webhook notifier

* ensure http is only used in dev mode

* cleanup errors
 2023-01-19 18:33:27 +01:00
Jo ecafb4dd15 Auth forwarding: Pass tokens without refresh (#61634) 
* return only tokens from oauth

* feedback
 2023-01-18 10:50:35 +00:00
Jo 9e097c531d SupportBundles: Build tars in memory (#61581) 
* build tar in memory

* match tag
 2023-01-17 11:39:59 +01:00
Jo 6fec8fda39 AuthN: Clean errors in user/org sync (#61560) 
* clean errors in user/org sync

* lower logging level for non 5xx errors
 2023-01-16 16:37:04 +00:00
Jo be3b81fecd AuthN: Readd user protection service to user sync (#61534) 
* add user protection service to user sync

* fix tests
 2023-01-16 11:15:14 +00:00
Jo dcfeab2c73 AuthN: User Quota (#61540) 
* remove reqContext from quota checks in login

* add guards for nil ScopeParams
 2023-01-16 11:54:15 +01:00
Jo 5f6f1a7d07 Devenv: Update to keycloak 20 (#61174) 
update to keycloak 20
 2023-01-10 16:50:53 +01:00
JoKalle PerssonMihály Gyöngyösi
 		0c8ad80575 Authn: JWT client (#61157) 
* add jwt client

* alias JWT verifier

* debug implementation

* add tests for jwt client

* add constant for JWT module

* Feedback

Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>

Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>
 2023-01-10 15:08:52 +01:00
Jo c2ad447f8c AuthN: Document identity and add missing fields (#61094) 
* add missing fields in identity

* add description of Identity fields
 2023-01-06 15:58:02 +00:00
Jo a460d50781 CodeOwners: Update authnz components (#60985) 
update authnz codeowners
 2023-01-05 17:23:36 +01:00
Jo fc0926f8fb SupportBundles: Recover from Bundler panics gracefully (#60995) 
bundler panics should not crash Grafana
 2023-01-05 14:23:35 +01:00
Jo c74d86ca27 SupportBundles: Move support bundles to services (#60986) 
* move support bundles to services

* update CODEOWNERS
 2023-01-04 17:33:18 +01:00
Jo 9633b5c69c SupportBundles: Improve UX (#60964) 
implement of easy frontend fixes for bundle list
 2023-01-04 16:11:02 +01:00
Jo a226903ec6 AuthN: Add session client (#60894) 
* add basic session client

* populate UserToken in ReqContext

* token rotation as a post auth hook

* fixed in context handler

* add session token rotation

* add session token tests

* use namespacedID constructor
 2023-01-04 16:10:43 +01:00
Jo ba9decfd04 Devenv: Add SAML authentik devenv (#60881) 
* add SAML support to authentik devenv

* update authentik image

* mark SAML as done
 2023-01-03 10:06:24 +00:00
Jo e1ea5490b3 Devenv: Remove abandoned environment (#60882) 
chore: remove abandoned environment
 2023-01-03 09:30:59 +01:00
Jo c6263ccabb SupportBundles: Add runtime information to basic info (#60616) 
add extra basic info
 2022-12-21 10:40:40 +01:00
Jo d3031202b6 SupportBundles: Do not allow multiple collectors with the same UID (#60581) 
* unexport service methods

* fix typos

* make constants

* do not allow double register of support bundle collectors

* fix get collectors response
 2022-12-21 10:15:01 +01:00
Jo a553040441 Authn: Refactor user sync and org sync as post auth hooks (#60504) 
* add user sync

* add org user sync

* add client params

* merge remaining conflicts

* remove change to report.go

* update comments

* add basic tests for user ID population

* add tests for auth ID find

* add tests for user sync create and update

* add tests for orgsync

* satisfy lint

* add userID guards
 2022-12-20 08:59:05 -05:00
JoievaVasiljevaKalle Persson
 		2c7410c87d Admin: Add support bundles (#60536) 
* Add support bundles

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>
Co-authored-by: Kalle Persson <kalle.persson@grafana.com>

* tweak code owners

* rename and lint frontend

* lint

* fix backend lint

* register feature flag

* add feature toggle. fix small backend issues

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>
Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
 2022-12-20 11:13:37 +01:00
Jo 77786f236a RBAC: Fix DeleteUserPermissions not being called on Upsert org sync (#60531) 
* fix DeleteUserPermissions not being called on RemoveOrgUser

* do not error out of auth flow

* fix test missing service
 2022-12-19 11:10:31 -05:00
Jo 9094153b30 Fix feature toggle test main (#60024) 
fix feature toggle test
 2022-12-08 14:26:18 +01:00
Jo d833031726 ServiceAccounts: Do not display warnings about secret scanner when scanner is disabled (#59952) 
ServiceAccounts: Fix warnings about secret scanner when scanner is disabled
 2022-12-07 14:49:28 +01:00
Jo df4f0343e5 Auth: Session cache [main] (#59935) 
* Auth: Session cache [v9.2.x] (#59907)

* add cache wrapper

only cache token if not to rotate

Co-authored-by: Kalle Persson <kalle.persson@grafana.com>

anticipate next rotation

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>
Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
(cherry picked from commit 07a4b2343d)

* FeatureToggle: for storing sessions in a Remote Cache

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>
(cherry picked from commit b8a8c15148)

* use feature flag for session cache

* ensure ttl is minimum 1 second

Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>
Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* ensure 2 ttl window to prevent caching of tokens near rotation

Co-authored-by: Kalle Persson <kalle.persson@grafana.com>

* fix description of toggle

Co-authored-by: gamab <gabi.mabs@gmail.com>
Co-authored-by: ievaVasiljeva <ieva.vasiljeva@grafana.com>
Co-authored-by: Kalle Persson <kalle.persson@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
(cherry picked from commit 2919588a82)

* fix broken quota test
 2022-12-07 10:55:48 +01:00
Jo 6762aaba56 SAML: Add teamsync details and example (#59624) 
doc: saml fixes
 2022-12-02 17:04:59 +01:00
Jo fee50be1bb Sessions: Remove invalid session cookie if it's invalid/expired/missing (#59556) 
only remove invalid session cookie if it's invalid/expired/missing
 2022-11-30 15:33:19 +01:00
Jo d7a652ff7f User: Optimize signed in user cache management (#59090) 
* only access the cache if a user ID is set

* ignore all negative values
 2022-11-23 12:04:38 +01:00
Jo 7e9d94cfda Chore: Extract server lock error so it can be used with errors.As (#58899) 
chore: extract server lock Error so it can be used with error.As
 2022-11-17 15:02:17 +01:00
JoandMihaly Gyongyosi 121631daae Fix: Email and username trimming and invitation validation (#58442) 
* fix: email and username trimming and invitation validation

* Trim leading and trailing whitespaces from email and username on signup

* Check whether the provided email address is the same as where the invitation sent

* Align tests

Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com>
 2022-11-14 13:11:26 +01:00
JoandVictor Cinaglia 2ce5dcfb91 ServiceAccounts: Add background service to check for token leaks (#53658) 
* add secret scan service

* add token batching

* Apply suggestions from code review

Co-authored-by: Victor Cinaglia <victor@grafana.com>

* fix: finish constant renaming

Co-authored-by: Victor Cinaglia <victor@grafana.com>
 2022-11-07 05:46:19 -05:00
Jo e3ea7ee145 Doc: Add groups mapping config to readme (#58208) 2022-11-04 10:43:38 +01:00
Jo eb84358aa7 Auth: Validate Azure ID token version on login is not v1 (#58088) 2022-11-03 09:47:44 +01:00
Jo 07991c76fe Doc: Fix wrong default callback URL (#57908) 
* doc: fix wrong default callback URL

* doc: fix gitlab typos
 2022-10-31 16:13:27 +01:00
JoMisiIeva
 		61774ae7f1 Docs: Add keycloak oauth setup guide (#57685) 
* use scopes for generic_oauth devenv. Support refresh_tokens

* add keycloak section

* add teamsync support to oauth devenv

* Add keycloak guide

* Upgrade keycloak to version 19

* Update devenv/docker/blocks/auth/oauth/readme.md

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

* feedback

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
 2022-10-28 17:57:56 -04:00
Jo cae900c6f9 fix GF_AUTH_JWT_URL_LOGIN not working (#57689) 2022-10-27 15:57:01 +02:00
Jo 77437f2c89 Add multi-auth devenv (#57609) 
* add authentik devenv

* remove direct dependency on spew

* use cn

* add authentik instructions

* add backup instructions
 2022-10-26 13:46:50 +02:00
Jo 7f3536a6d2 OAuth: Fix misleading warn log related to oauth and increase logged content (#57336) 
* only emit warn log when sync is not skipped. Fix warn log that had wrong recommendation

* log presence of refresh token
 2022-10-20 05:50:12 -04:00
Jo 006944a360 Auth: Add development manual override (#55496) 
* Auth: Add development manual override

* rename to disable_sync_lock
 2022-09-20 11:48:40 -04:00
JoandMisi 0be644031d Auth: Add SAML common resolutions to cookie issues (#55395) 
* Auth: Add SAML cookie specifics

* Auth: remove legacy message

* HTTPS

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
 2022-09-20 16:21:50 +02:00
Jo 13146cc812 Auth: reduce allocs (#55410) 2022-09-20 12:03:08 +02:00
Jo e1af4e72bc Auth: Add documentation on group overage claims in AzureAD (#55389) 
* Auth: Add documentation on group overage claims in AzureAD

* add info on versioning
 2022-09-19 15:45:05 +02:00
JoGabriel MABILLEAlex KhomenkoJosh Huntgamab
 		3e2e9f93b9 Auth: Allow admins to manually change oauth user role if oauth_skip_org_role_update_sync is enabled (#55182) 
* Auth: Allow admins to change oauth user info it it's not synced.

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Update public/app/features/admin/UserAdminPage.tsx

Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>

* Add missing import

* Simplify init

Co-authored-by: Josh Hunt <joshhunt@users.noreply.github.com>
Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>

* SAML: Add option to skip org role sync (#55230)

* SAML: Add option to skip org role sync

* Modify frontend accordingly

* Remove update from config option name

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Remove update from config option name

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Fix typo

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>
Co-authored-by: gamab <gabi.mabs@gmail.com>
Co-authored-by: Josh Hunt <joshhunt@users.noreply.github.com>
 2022-09-15 12:06:09 -04:00
JoGabriel MABILLEgamab
 		00e7324bf6 Auth: Restore legacy behavior and add deprecation notice for empty org role in oauth (#55118) 
* Auth: Add deprecation notice for empty org role

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* fix recasts

* fix azure tests missing logger

* Adding test to gitlab oauth

* Covering more cases

* Cover more options

* Add role attributestrict check fail

* Adding one more edge case test

* Using legacy for gitlab

* Yet another edge case YAEC

* Reverting github oauth to legacy

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Not using token

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Nit.

* Adding warning in docs

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* add warning to generic oauth

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Be more precise

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Adding warning to github oauth

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Adding warning to gitlab oauth

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Adding warning to okta oauth

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Add docs about mapping to AzureAD

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Clarify oauth_skip_org_role_update_sync

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Nit.

* Nit on Azure AD

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Reorder docs index

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

* Fix typo

Co-authored-by: Jguer <joao.guerreiro@grafana.com>

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: gamab <gabi.mabs@gmail.com>
 2022-09-15 17:35:59 +02:00
Jo ef245874da OAuth: Allow assigning Server Admin (#54780) 
* extract errors to errors file

* implement oauth server admin assignment

* add server admin tests

* deduplicate autoAssignOrgRole

* deduplicate strict setting

* deduplicate strict setting

* add support for generic oauth

* add role attribute strict support for generic oauth

* add support for github/gitlab

* assignGrafanaAdmin option is here to stay

* unify similar errors

* add config option

* add okta server admin mapping

* remove never used Company attribute

* unify generic oauth role extract with other methods

* case insensitive role match as in azure

* add ini settings

* add server admin to devenv

* remove duplicate fields

* add documentation to oauth

* fix titlecase test

* implement doc feedback
 2022-09-08 06:11:00 -04:00
Jo 4952b7f22d Add JWT url auth documentation (#54040) 
* add jwt auth docs

* add appropriate warnings to docs

* remove unimplemented login_token assumptions

* Update conf/sample.ini
 2022-09-05 03:46:50 -04:00
Jo 5c1f614d3c Service Accounts: Separate metrics logic from store (#54085) 
* separate stats logic from store

* remove in_teams unused stat

* use init instead
 2022-08-23 08:24:55 -04:00
Jo 4a9137ac40 API Keys: Add revocation for SATs (#53896) 
* add apikey is_revoked field

* add token store tests

* Apply suggestions from code review

* remove unused fields
 2022-08-18 16:54:39 +02:00
Jo 10e6eac632 Auth: Reduce lookup cookie error to warning and invalidate cookie (#53881) 
* Reduce lookup cookie error to warning. Delete invalid cookie to avoid continuous refresh

* debug log branch
 2022-08-18 09:24:31 -04:00
Jo ca72cd570e Remove ioutil.ReadDir from usage (#53550) 
* add depguard rule for ioutil

* replace ioutil.ReadDir with os.ReadDir

* use legacy option in depguard supported in golangci-lint v1.40

* replace ioutil.ReadDir with os.ReadDir

* return error for file info
 2022-08-11 07:21:12 -04:00
Jo 062d255124 Handle ioutil deprecations (#53526) 
* replace ioutil.ReadFile -> os.ReadFile

* replace ioutil.ReadAll -> io.ReadAll

* replace ioutil.TempFile -> os.CreateTemp

* replace ioutil.NopCloser -> io.NopCloser

* replace ioutil.WriteFile -> os.WriteFile

* replace ioutil.TempDir -> os.MkdirTemp

* replace ioutil.Discard -> io.Discard
 2022-08-10 15:37:51 +02:00
Jo 1f8b1eef75 SAML: Do not SAML SLO if user is not SAML authenticated (#53418) 
* Only SLO user if the user is using SAML

* only one source of truth for auth module info

* ensure SAML is also enabled and not only SLO

* move auth module naming to auth module login package

* use constants in other previously unused spots
 2022-08-10 10:21:33 +02:00
Jo 09c95bc31f TeamSync: Fix team syncing out of orgs mapped by auth method (#53257) 2022-08-10 10:20:23 +02:00
Jo beb3cb9abe Oauth: Reduce error scope on upsert (#53242) 2022-08-08 10:58:10 +02:00
Jo ff1c294963 AzureAD: Don't copy claims around (#52950) 2022-07-29 10:17:07 +02:00
Jo 51e2a1c0a4 Deps: Update SAML libraries (#52893) 
Deps: ensure goxmldsig is pinned

update go.mod
 2022-07-28 08:43:30 +02:00
JoIevaKarl Persson
 		c2d3c90bc8 Auth: Implement Token URL JWT Auth (#52662) 
* Auth: check of auth_token in url and resolve user if present

* check if auth_token is passed in url

* Auth: Pass auth_token for request if present in path

* no need to decode token in index

* temp

* use loadURLToken and set authorization header

* cache token in memory and strip it from url

* Use loadURLToken

* Keep token in url

* strip sensitive query strings from url used by context logger

* adapt login by url to jwt token

* add jwt iframe devenv

* add jwt iframe devenv instructions

* add access note

* add test for cleaning request

* ensure jwt token is not carried into handlers

* do not reshuffle queries, might be important

* add correct db dump location

* prefer set token instead of cached token

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
 2022-07-27 16:10:47 +02:00
JoandIeva 4a12d0f236 Auditing: Add new options to docs (#52050) 
* Auditing: Add new option docs

* add log all status codes

* change option to verbose

* denote status_codes

* Apply suggestions from code review

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* add setup-grafana docs

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
 2022-07-25 11:15:04 -04:00
JoGabriel MABILLEVardan Torosyan
 		5c4aa4a7ac OAuth: Allow role mapping from GitHub and GitLab groups (#52407) 
* OAuth: Add extract role support to github

OAuth: correct github errors

Oauth: add github tests

Oauth: Allow mapping via group memberships

Oauth: Add markdown instructions to the new mappers

fix lint

* Apply suggestions from code review

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: Vardan Torosyan <vardants@gmail.com>

* Apply suggestions from code review

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: Vardan Torosyan <vardants@gmail.com>
 2022-07-20 10:32:04 -04:00
JoandKarl Persson f3ee57abef Fix: Choose Lookup params per auth module (#395) (#52312) 
Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Fix: Prefer pointer to struct in lookup

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Fix: user email for ldap

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Fix: Use only login for lookup in LDAP

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

Fix: use user email for ldap

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

fix remaining test

fix nit picks
 2022-07-15 10:21:09 +01:00
Jo 13b23fd512 Auth: Lockdown non-editables in frontend when external auth is configured (#52160) 
* Auth: Lockdown user profile edit if external synced

* Auth: use builtin isExternal

* Auth: When user is synced, orgs will be overriden on next login
 2022-07-15 09:10:20 +02:00
Jo c9c4fc604e LDAP: Improve errors and documentation (#52111) 2022-07-12 11:11:09 -04:00
JguerandEmil Tullstedt b79b53cbdb JWT: Add JWT proxy setup devenv (#51731) 
* JWT: Add JWT Auth devenv

* Auth: JWT allow retrieving login token

Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>

* JWT: Add JWT Auth Proxy devenv

* JWT: Add instructions to readme

* JWT: Add JWT users

* JWT: Remove oauth users

* revert session changes, unnecessary

Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
 2022-07-07 10:28:04 -04:00
Jguer db9f80a7a3 ServiceAccounts: Add Prometheus metrics service (#51831) 
* ServiceAccounts: Add Prometheus metrics service

* add missing init in tests
 2022-07-07 10:03:16 -04:00
Jguer 9ab210a7d7 ServiceAccounts: Don't create new orgs for service accounts (#51819) 
* Org: use constants for status codes

* ServiceAccounts: Avoid creating new orgs for service accounts

* Document createUserBehavior

* Update pkg/services/sqlstore/org_users_test.go

* add doc string to flag
 2022-07-07 08:50:38 -04:00
Jguer 6d0261263c ServiceAccounts: Add Service Account Token last used at date (#51446) 
* ServiceAccounts Add api key last used at

* ServiceAccounts: LastUpdateAt tests
 2022-06-28 16:42:40 +02:00
JguergamabGabriel MABILLE
 		0689c5839a Auth: Add option for case insensitive login (#49262) 
* add case insensitive option

* treat id as case insensitive

* Users: Add integration tests for case insensitive querying

* Prefer config struct to global variable

* change key to case_insensitive_login

* impede conflicting users from logging in

* add tests for impeding user retrieval if conflicting

* nits and picks

Co-authored-by: gamab <gabi.mabs@gmail.com>

* Add check in transaction for conflicting user

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* add update tests

* skip on mysql

* add custom messages for user admin view

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* nit: extra else

* linting mistake

Co-authored-by: gamab <gabi.mabs@gmail.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
 2022-06-24 16:59:45 +02:00
JguerandGabriel MABILLE 9a82ed7105 Remove LDAP specific example from team sync (#51368) 
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
 2022-06-24 15:29:50 +02:00
Jguer 4d2c293575 Docs: Add team sync specifics (#51254) 2022-06-22 14:57:06 +00:00
Jguer d2ab3556fa OAuth: Restore debug log behavior (#51244) 2022-06-22 15:27:46 +02:00
Jguer 32103fcd9f Fix double change password calls (#50948) 2022-06-16 16:30:33 +02:00
JguerEric LeijonmarckAlexander Zobnin
 		f3e3828279 ServiceAccounts: Fix errors returning API key and simplify conditions (#50885) 
* ServiceAccounts: Fix naming API key->Service account token

* simplify redundant elses

* Apply suggestions from code review

Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
 2022-06-16 12:11:22 +02:00
Jguer ab85029969 Remove migrations from behind configs (#49415) 2022-05-26 13:21:02 +02:00
JguerKarl PerssonGabriel MABILLE
 		3250bf6b2b AccessControl: Add migration for seeding managed inherited permissions (#49337) 
* AccessControl: Add migration for seeding managed inherited permissions

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

* AccessControl: move to single file

* AccessControl: Add tests for managed permission migration

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* AccessControl: Ensure no duplicate insertion

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Remove commented code

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Add code migration constant

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Ensure DB is clean between tests

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Update pkg/services/sqlstore/migrations/accesscontrol/managed_permission_migrator.go

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
 2022-05-23 16:50:10 +02:00
JguerandVictor Cinaglia 6891bbf03c ServiceAccounts: Add identifiable token prefix to service account tokens (#49011) 
* Add prefixed API key gen.

* Retrieve API Key by hash

* Handle prefixed API keys for login

* Add placeholder key generator

* fix spelling

* add get by hash sqlstore test

* reformat query

* quote usage of reserved keyword key

* use constant

* improve error handling and pre-select key type

Co-authored-by: Victor Cinaglia <victor@grafana.com>

* nits

Co-authored-by: Victor Cinaglia <victor@grafana.com>
 2022-05-23 13:14:38 +02:00