IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-08-26 13:27:30 -05:00
Code Issues Packages Projects Releases Wiki Activity
54,604 Commits 1,369 Branches 727 Tags
2573cbec083e8f5160888a455efd435b8d03549f
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Karl Persson 6f7528f896 Migration: Remove table aliasing in delete statement to make it work for mariadb (#95226) 
Migration: remove table aliasing in delete statement to make it work in mariadb
 2024-10-23 10:49:20 +02:00
Karl Persson b4366ebed2 Zanzana: bootstrap authz server (#95036) 
Bootstrap authz extended server
 2024-10-21 14:58:57 +02:00
Karl Persson a82d01214d Auth: Update authlib (#94947) 
* Update authlib
 2024-10-18 13:36:21 +02:00
Karl PerssonandAlexander Zobnin 4083b2208e Zanzana: periodic sync of team members (#94752) 
* Rewrite zanzana collector to fetch all available pages

* Register access control as a background service

* If zanzana is enabled we run Syncs and start Reconciliation job

* Update pkg/services/authz/zanzana/client/client.go

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

* Use server lock when doing performing reconciliation
 2024-10-17 15:28:33 +02:00
Karl Persson 7fba9ba522 SA: Fix name validation so we can prevent creating service account with protected prefix (#94762) 
Fix name validation so we can prevent creating service account with protected prefix
 2024-10-16 10:27:06 +02:00
Karl Persson 86fc8da703 RBAC: Add legacy authorization checks to teams (#94524) 
* Setup team authorization for teams

* Add list filter for teams
 2024-10-10 16:47:31 +02:00
Karl Persson 9ece88d585 Zanzana: bump openfga version (#94485) 
* Bump openfga

* Remove internall sqlite implementation for openfga

* Use sqlite implementation from openfga
 2024-10-10 09:07:40 +02:00
Karl Persson ace177f20a AuthN: Set access token name (#94471) 
* Set access token name
 2024-10-09 17:08:11 +02:00
Karl Persson 2d0ea60017 ServiceAccounts: Run migration in batches (#94429) 
* ServiceAccounts: Run migration in batches
 2024-10-08 19:53:23 +02:00
Karl PerssonandIeva c7ca2bfcf5 ServiceAccounts: Remove permissions to service account when it is deleted (#93877) 
* Service account: clean up permissions related to service accounts when deleted

* Add migration for deleting orphaned service account permissions

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
 2024-10-04 09:01:09 +02:00
Karl Persson d75a9b6aeb User: Pass name to list users to filter out the correct one (#94153) 
Pass name to list users to filter out the correct one
 2024-10-02 17:02:32 +02:00
Karl Persson 0160f4f72c RBAC: Add legacy authorization checks to service accounts (#93753) 
* Extract a helper funtion to perform list with authorization checks

* Add k8s verb to utils package

* Construct default mapping when no custom mapping is passed

* Configure authorization checks for service accounts

* Fix helper and add filtering to service accounts
 2024-09-27 15:53:11 +02:00
Karl Persson c28b37a67b RBAC: Add option to skip rbac check for specified verbs (#93654) 
* Add option to skip rbac check for specified verbs
 2024-09-24 15:13:04 +02:00
Karl PerssonandGabriel MABILLE 2e38329026 RBAC: Add required component to perform access control checks for user api when running single tenant (#93104) 
* Unexport store and create new constructor function

* Add ResourceAuthorizer and LegacyAccessClient

* Configure checks for user store

* List with checks if AccessClient is configured

* Allow system user service account to read all users

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
 2024-09-23 11:26:44 +02:00
Karl Persson da60c561a8 Docs: Update to use correct config key for saml token url (#93569) 
Update to use correct config key for saml token url
 2024-09-23 09:19:38 +02:00
Karl PerssonandRyan McKinley bc20592fd4 IAM: Add and use identity ref (#92978) 
* Add and use identity ref

---------

Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
 2024-09-05 16:10:23 +02:00
Karl Persson 2bfa607ad0 ServiceAccount: Update service account api resource and add service account token (#92972) 
* Create own legacy store function to list service accounts and update api model

* Add service account tokens as a sub resource for service accounts
 2024-09-05 13:43:54 +02:00
Karl Persson 294712d7ef User: Add sub resource and api for user teams (#92649) 
* Add sub resource for user teams

* Add test snapshots

* Update to use ref:s
 2024-08-30 15:05:27 +02:00
Karl Persson 56487d37db Authn: No longer hash service account token twice during authentication (#92598) 
* APIKey: Only decode and hash token once during authentication

* Only update last used every 5 minutes
 2024-08-29 09:56:23 +02:00
Karl Persson 1eb49e1b0f Chore: restructure legacy store for identity (#92572) 
* Restructure user queries

* restructure display query

* restructure team queries

* restructure team bindings query

* Restructure team members

* Restructure store
 2024-08-28 14:15:26 +02:00
Karl Persson 4addd9637e Team: Add sub resource and api for team members (#92492) 
* Add team members as a sub resource

* Fix and clean up pagination for teams

* Fix and clean up pagination for users

* Fix and clean up pagination for service accounts

* Update snapshots
 2024-08-28 10:30:23 +02:00
Karl Persson 2872e11c13 Teams: Add apis for team membership (#92204) 
* Add TeamBinding resource

* Implement read api:s for TeamBindings
 2024-08-27 08:31:29 +02:00
Karl Persson ddee95cb6d Team: Create permission type for team membership (#92352) 
* Create permission type enum for team and remove usage of dashboard permission type
 2024-08-23 12:34:34 +02:00
Karl Persson b6540e2a18 SSOSettings: Add api:s (#92018) 
* apis: add sso setting resource

* Implement Storage for sso

* Rename packages

* Merge identity and sso package

* Update table format and expose GetNestedBool

* Restructure identity api package
 2024-08-21 09:16:47 +02:00
Karl Persson 5105fb7f3a Identity: remove GetIDClaims (#91901) 
remove GetIDClaims
 2024-08-15 11:39:13 +02:00
Karl Persson e9bb3b4d73 Annotations: only set userID if caller is a user or service account (#91898) 
* Ignore errors when extracting current user id

* Only set userID if caller is user or service account

* Fix patch api
 2024-08-14 16:07:15 +02:00
Karl Persson 8d36111420 IDForwarding: Set identity type and uid (#91830) 
* Set identity type and uid

* Set uid without prefix

* Update authlib version

* Update to new claim name
 2024-08-14 10:51:44 +02:00
Karl Persson 8bcd9c2594 Identity: Remove typed id (#91801) 
* Refactor identity struct to store type in separate field

* Update ResolveIdentity to take string representation of typedID

* Add IsIdentityType to requester interface

* Use IsIdentityType from interface

* Remove usage of TypedID

* Remote typedID struct

* fix GetInternalID
 2024-08-13 10:18:28 +02:00
Karl Persson 7f1ae1cd54 Identity: Update authlib to version that has correct commit to claims (#91784) 
* Update authlib to version that has correct commit to claims
 2024-08-12 09:39:48 +02:00
Karl Persson bcfb66b416 Identity: remove GetTypedID (#91745) 2024-08-09 18:20:24 +03:00
Karl Perssonandjguer d93f5bab83 RemoteCache: remove count method (#91581) 
* remove count method

* remove count from remote cache

---------

Co-authored-by: jguer <me@jguer.space>
 2024-08-06 19:21:00 +02:00
Karl Persson 7a78ad3893 Authn: Remove response writer from auth req (#90110) 
Authn: Remove response writer from request
 2024-07-05 11:42:12 +02:00
Karl Persson c04be62b65 Zanzana: client integration test (#89997) 
* Restructure

* Zanzana: Add integration tests for client

* skip mysql 5.7 integration tests
 2024-07-04 11:23:48 +02:00
Karl PerssonandAlexander Zobnin cbbc12a31b Zanzana: Sync team memberships (#89983) 
* Zanzana: Use uid for users and teams

* Zanzana: Team membership migrator

---------

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
 2024-07-03 13:37:26 +02:00
Karl Persson bfe77ab530 Users: Ensure default admin is created with a valid uid (#89981) 
Users: Ensure default admin has a valid uid
 2024-07-03 12:06:10 +02:00
Karl Persson f18da6f4dc User+team: remove startup migration for uid (#89953) 
* Remove migration that is performed on startup
 2024-07-03 09:11:52 +02:00
Karl Persson e568b86ac0 Zanzana: Initial work to allow partial data migrations (#89919) 
* Zanana: Add Write method to interface

* Zanzana: Add utilities for translating RBAC to openFGA tuple keys

* RBAC: Add zanzana synchronizer

* Run zanzana sync in access controll provider
 2024-07-02 14:45:25 +02:00
Karl Persson 7f4faaa45b ExtJWT: Remove test (#89665) 
Remove test
 2024-06-26 17:25:26 +02:00
Karl Persson eea7319a67 Zanzana: sqlite data store (#89486) 
* Zanzana: Add sqlite3 store

* Zanzana: Initilize sqlite store with migrations
 2024-06-25 09:52:33 +02:00
Karl Persson 3fe29809be Zanzana: database migrations (#89390) 
* Zanana: Use grafana migrations to run openFGA migration files and initilize store.

* Add feature toggle

* Zanzana: return noop client if feature toggle is disabled
 2024-06-19 15:59:47 +02:00
Karl PerssonandDan Cech 606a74d0af Zanzana: Initial work to run openFGA as embedded or standalone service (#89211) 
* Zanana: Initial work to run zanana as ebeddedn or standalone

* Add addr settings for when remote client is used.

* sync dependencies

* Lock mysql driver version
---------

Co-authored-by: Dan Cech <dcech@grafana.com>
 2024-06-18 10:04:18 +02:00
Karl PerssonandMisi f3efd95bb4 Auth: Add org to role mappings support to Google integration (#88891) 
* Auth: Implement org role mapping for google oauth provider

* Update docs

* Remove unused function

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
 2024-06-07 14:07:35 +02:00
Karl Persson d3b06f09ae Users: remove unused store function (#88784) 2024-06-06 11:43:51 +02:00
Karl PerssonandChristopher Moyer f28905f8c4 Auth: Add org to role mappings support to Gitlab integration (#88751) 
* Conf: Add org_mapping and org_attribute_path to github and gitlab conf

* Gitlab: Implement org role mapping

* Update docs
---------

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
 2024-06-05 16:15:53 +02:00
Karl Persson 7bc7ae2e8c Docs: Update feature toggle information for generic oauth (#88740) 2024-06-05 09:55:51 +02:00
Karl Persson 68f2585712 Cli: Fix bug where password is hashed twice (#88589) 2024-06-03 09:14:55 +02:00
Karl Persson 78d1b2a250 Authn: Share key retriever between id and access token verifiers (#87978) 2024-05-20 09:13:46 +02:00
Karl Persson 5c27f223af Authn: Support access token wildcard namespace (#87816) 
* Authn+ExtJWT: allow wildcard namespace for access tokens and restructure validation
 2024-05-16 10:47:20 +02:00
Karl Persson 9977258d04 AuthN: Set uid during authentication (#87797) 
* Identity: Remove GetNamespacedUID and use GetUID instead

* Authn: Set uid for users and service accounts
 2024-05-14 14:13:50 +02:00
Karl Persson 7125a2e455 Anon: Add support to resolve anonymous identity (#87486) 2024-05-13 11:06:14 +02:00
Karl Persson 0f3080ecb8 AuthN: Fix signout redirect url (#87631) 
* Add missing return

* Use sign out redirect url from auth config if configured

* remove option from auth.jwt that is not used
 2024-05-12 19:53:19 +02:00
Karl Persson 8c7b8542f1 Chore:: Update authlib version (#87603) 
update authlib version
 2024-05-10 12:55:12 +02:00
Karl Persson be5ced4287 Identity: Use typed version of namespace id (#87257) 
* Remove different constructors and only use NewNamespaceID

* AdminUser: check typed namespace id

* Identity: Add convinient function to parse valid user id when type is either user or service account

* Annotations: Use typed namespace id instead
 2024-05-08 14:03:53 +02:00
Karl Persson 2d8570e85e IDToken: Reuse claims from authlib (#87437) 
* bump authlib version

* Reuse claims from authlib
 2024-05-07 16:46:43 +02:00
Karl Persson 37af1ae58e IDToken: Set typ header (#87430) 
TokenSigning: Set typ header
 2024-05-07 13:59:23 +02:00
Karl Persson a22350f8f4 IDToken: add namespace (#87242) 2024-05-02 18:55:28 -07:00
Karl Persson d8fbbdefea Identity: Use typed namespace id (#87121) 
* Use typed namespace id
 2024-05-02 14:50:56 +02:00
Karl PerssonandGabriel MABILLE a2cba3d0b5 User: Add tracing (#87028) 
* Inject tracer in tests

* Annotate with traces

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
 2024-04-30 13:15:56 +02:00
Karl Persson c4cfee8d96 User: support setting org and help flags though update function (#86535) 
* User: Support setting active org through update function

* User: add support to update help flags through update function
 2024-04-29 08:53:05 +02:00
Karl PerssonandMisi cd724d74aa Authn: move namespace id type (#86853) 
* Use RoleType from org package

* Move to identity package and re-export from authn

* Replace usage of top level functions for identity

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
 2024-04-25 12:54:36 +02:00
Karl Persson 0fa983ad8e AuthN: Use typed namespace id inside authn package (#86048) 
* authn: Use typed namespace id inside package
 2024-04-24 09:57:34 +02:00
Karl Persson 1a6777cb93 User: use update function for password updates (#86419) 
* Update password through Update function instead

* Remove duplicated to lower

* Refactor password code
 2024-04-17 15:24:36 +02:00
Karl Persson 0f06120b56 User: Clean up update functions (#86341) 
* User: remove unused function

* User: Remove UpdatePermissions and support IsGrafanaAdmin flag in Update function instead

* User: Remove Disable function and use Update instead
 2024-04-16 16:33:50 +02:00
Karl Persson 8520892923 User: Fix GetByID (#86282) 
* Auth: Remove unused lookup param

* Remove case sensitive lookup for GetByID
 2024-04-16 15:24:34 +02:00
Karl PerssonandMisi 73fecc8d80 Authn: Identity resolvers (#85930) 
* AuthN: Add NamespaceID struct. We should replace the usage of encoded namespaceID with this one

* AuthN: Add optional interface that clients can implement to be able to resolve identity for a namespace

* Authn: Implement IdentityResolverClient for api keys

* AuthN: use idenity resolvers

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
 2024-04-12 11:38:20 +02:00
Karl Persson 895222725c Session: set authID and authenticatedBy (#85806) 
* Authn: Resolve authenticate by and auth id when fethcing signed in user

* Change logout client interface to only take Requester interface

* Session: Fetch external auth info when authenticating sessions

* Use authenticated by from identity

* Move call to get auth-info into session client and use GetAuthenticatedBy in various places
 2024-04-11 10:25:29 +02:00
Karl Persson ebb4bb859e Authn: allow ResolveIdentity to authenticate in "global" scope (#85835) 
* Authn: allow ResolveIdentity to authenticate in "global" scope

* Use constant
 2024-04-10 11:53:45 +02:00
Karl Persson fd870702c7 Chore: Remove unused function TryRotateToken (#85836) 
* Chore: Remove unused function

* remove unused function
 2024-04-10 11:15:43 +02:00
Karl Persson 46ee87a0fc Authn: Ignore context.Canceled errors when logging auth errors (#85707) 
Ignore context.Canceled errors when logging auth errors
 2024-04-08 10:25:24 +02:00
Karl PerssonandMisi b1fc0861f1 AuthN: reset email verified on email change (#85643) 
* AuthN: reset email verified on email change

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
 2024-04-05 14:19:12 +02:00
Karl Persson ba41954854 Email: trigger email verification flow (#85587) 
* Add email and email_verified to id token if identity is a user

* Add endpoint to trigger email verification for user

* Add function to clear stored id tokens and use it when email verification is completed
 2024-04-05 12:05:46 +02:00
Karl Persson 504870f10a Auth: Decouple client and hook registration (#85084) 2024-04-04 09:33:00 +02:00
Karl Persson 73e426b081 User: email verification completion (#85259) 
* TempUser: Include InvitedById in TempUserDTO

* Extract email verfication completion flow to service
 2024-03-28 16:05:33 +01:00
Karl PerssonandGabriel MABILLE 5dd98a0fd5 RBAC: handle partially resolved scopes (#85323) 
* RBAC: handle partially resolved scopes

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
 2024-03-28 10:08:07 +01:00
Karl Persson 152cb47692 AuthN: Add IsAuthenticatedBy to identity interface and replace checks (#85262) 
Add IsAuthenticatedBy to identity interface and replace checks
 2024-03-27 15:22:13 +01:00
Karl Persson c39b9b2cbe EmailVerification: Generate emails after rename (#85175) 2024-03-26 15:50:11 +01:00
Karl Persson 2f5e3023c2 IDFowrarding: ignore logging context canceled errors (#85141) 2024-03-26 11:36:44 +01:00
Karl Persson 2f3a01f79f OAuth: Make sub claim required for generic oauth behind feature toggle (#85065) 
* Add feature toggle for sub claims requirement

* OAuth: require valid auth id

* Fix feature toggle description
 2024-03-25 14:22:24 +01:00
Karl Persson c33bc819bc SigningKeys: Add added_at when creating new signing key (#85060) 2024-03-25 09:58:40 +01:00
Karl Persson f5692f06a5 FeatureToggles: Remove unused feature flag (#84988) 
Remove unused flag
 2024-03-22 14:30:58 +01:00
Karl Persson 8714b7cd8c RolePicker: Don't try to fetch roles for new form (#84630) 2024-03-18 11:15:49 +01:00
Karl Persson d4e802dd47 Authn: Add function to resolve identity from org and namespace id (#84555) 
* Add function to get the namespaced id

* Add function to resolve an identity through authn.Service from org and namespace id

* Switch to resolve identity for re-authenticate in another org
 2024-03-15 15:08:15 +01:00
Karl Persson ebf455d107 RBAC: Don't refetch permissions when searching for users in authenticated org (#84546) 
Don't refetch permissions when searching for users in authenticated org
 2024-03-15 10:36:16 +01:00
Karl PerssonandIeva 8d9521fb6d Refactor: Email verification (#84393) 
* Update template names

* Add verifier that we can use to start verify process

* Use userVerifier when verifying email on update

* Add tests
---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
 2024-03-14 13:25:28 +01:00
Karl Persson 6ea9f0c447 AuthN: Use fetch user sync hook for render keys connected to a user (#84080) 
* Use fetch user sync hook for render keys connected to a user
 2024-03-12 09:15:14 +01:00
Karl Persson 9c292d2c3f AuthN: Use sync hook to fetch service account (#84078) 
* Use sync hook to fetch service account
 2024-03-11 15:56:53 +01:00
Karl Persson 0b55d72fb5 FeatureToggles: Add feature toggle for sso email verification (#84184) 
* FeatureToggles: Add feature toggle for sso email verification

* Rename toggle

* Fix json
 2024-03-11 15:09:44 +01:00
Karl Persson 4272483c54 Auth: Only call rotate token if we have a session expiry cookie (#84169) 
Only call rotate token if we have a session expiry cookie
 2024-03-11 14:10:03 +01:00
Karl Persson 22074c5026 RBAC: add debug log for permission evaluation (#83880) 
* fix: add debug log when evaluating permissions that includes target permissions
 2024-03-05 08:50:19 +01:00
Karl Persson 9e04fd0fb7 AuthToken: Remove client token rotation feature toggle (#82886) 
* Remove usage of client token rotation flag

* Remove client token rotation feature toggle
 2024-02-16 15:03:37 +01:00
Karl Persson 1315c67c8b Team/User: UID migrations (#82298) 
* Add user uid migration to run on every startup to protect against empty values in a upgrade downgrade scenario

* Add team uid migration to run on every startup to protect against empty values in a upgrade downgrade scenario

* Run team uid migration
 2024-02-12 14:48:29 +01:00
Karl PerssonandVictor Cinaglia 28bb6979f5 IDForwading: cache based on expires in (#81136) 
* IDFowarding: Cache based on expires in

* IDFowarding: Change default expires in

---------

Co-authored-by: Victor Cinaglia <victor@grafana.com>
 2024-01-24 13:56:44 +01:00
Karl Persson 147bf01745 IDForwarding: Always forward id tokens to plugins (#81041) 
* Always forward id tokens to plugins
 2024-01-23 12:12:32 +01:00
Karl PerssonandIeva 7b58f71b33 AuthN: Add auth hook that can sync grafana cloud role to rbac cloud role (#80416) 
* AuthnSync: Rename files and structures

* AuthnSync: register rbac cloud role sync if feature toggle is enabled

* RBAC: Add new sync function to service interface

* RBAC: add common prefix and role names for cloud fixed roles

* AuthnSync+RBAC: implement rbac cloud role sync

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
 2024-01-17 10:55:47 +01:00
Karl Persson 43b6b6b2a4 IDForwarding: add "authenticatedBy" to id token (#80622) 
* IDForwading: Set authenticated by for users
 2024-01-17 09:52:05 +01:00
Karl Persson 5bfb799c0d index: Fetch auth module and provide it to front-end (#80345) 2024-01-11 11:37:52 +01:00
Karl Persson 5b3cd9f55b features: Add feature flag for grafana cloud rbac roles (#80283) 2024-01-10 14:19:01 +01:00
Karl Persson 05d1ce4026 Auth: id response header (#79757) 
* Add utility function to check if namespace is any of

* Refactor code to use identity interface
 2023-12-21 14:06:28 +01:00
Karl PerssonandGabriel MABILLE 8cb351e54a Authn: Handle logout logic in auth broker (#79635) 
* AuthN: Add new client extension interface that allows for custom logout logic

* AuthN: Add tests for oauth client logout

* Call authn.Logout

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
 2023-12-19 10:17:28 +01:00
Karl Persson 0437a74956 RBAC: Render team, service account and user list when a user can see entities but not roles attached to them (#79642) 
* Render list even when user cannot list roles assigned for entities
 2023-12-18 15:55:02 +01:00