IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-07-29 15:59:50 -05:00
Code Issues Packages Projects Releases Wiki Activity
46,571 Commits 1,119 Branches 715 Tags
26bcfe300fb1f7cc0102d15ca8c5cb7361d8033c
Commit Graph
50 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
MisiandKarl Persson 5285e9503b Auth: SSO settings foundations (#77724) 
* inital changes, db migration

* changes

* Implement basic GetAll, Delete

* Add first batch of tests

* Add more tests

* Add service tests for GetForProvider, List

* Update http_server.go + wire.go

* Lint + update fixed role

* Update CODEOWNERS

* Change API init

* Change roles, rename

* Review with @kalleep

* Revert a mistakenly changed part

* Updates based on @dmihai 's feedback

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
 2023-11-08 10:50:01 +01:00
Misi 75768cea19 Chore: Replace crewjam/saml with the latest grafana/saml lib (#77153) 
Replace crewjam/saml with the latest grafana/saml
 2023-10-26 09:44:15 +02:00
Misi 1e81ffccac Auth: Handle when access token has already been refreshed in OAuth token sync (#77118) 
* Use singleflight to prevent logging error if the token has already been refreshed

* Change order of error checks

* align tests, change error name

* Change sf key

* Update based on the review

* refactor
 2023-10-25 18:15:41 +02:00
MisiandIsabel 3dbda43d44 Docs: Update whats-new-next with RBAC permission validation (#76470) 
* Update whats-new-next with RBAC permission validation

* run prettier

* Fixed version syntax

* Update docs/sources/whatsnew/whats-new-next/index.md

Co-authored-by: Isabel <76437239+imatwawana@users.noreply.github.com>

* update docs

* update

* fix merge

---------

Co-authored-by: Isabel <76437239+imatwawana@users.noreply.github.com>
 2023-10-13 17:27:16 +02:00
Misi b6dff85127 Chore: Update grafana/saml to the latest (#76363) 
* Update go.mod

* add missing squad to dependency
 2023-10-12 10:20:00 +02:00
Misi bd2191c158 Auth: OAuth token sync improvements (#75943) 
* Add metric, improve token refresh

* changes

* handle ctx cancelled

* Fix import order
 2023-10-05 11:19:43 +02:00
MisiandChristopher Moyer e1aad9c9bf Docs: Update RBAC documentation (#75869) 
* Align docs to current permissions in code

* Update permissions list

* Add example responses, fix link

* Apply suggestions from code review

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

* Update based on reviews

---------

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
 2023-10-04 17:53:26 +02:00
MisiandChristopher Moyer 4551de148c Docs: Add SameSite troubleshooting to SAML docs (#75590) 
* Add SameSite troubleshooting to SAML docs

* Update docs/sources/setup-grafana/configure-security/configure-authentication/saml/index.md

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

---------

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
 2023-09-28 16:37:41 +02:00
Misi 2f22946f06 RBAC: Enable permission validation by default (#73804) 2023-08-25 14:07:40 +02:00
Misi d7166f5f96 RBAC: Remove unused scope from alert.instances:read fixed role (#73268) 
Fix alert.instances:read scope for fixed role
 2023-08-16 09:55:49 +02:00
Misi ba723c911a Auth: Don't rotate session cookie from frontend for JWT Auth (#72744) 
Skip client token rotation for JWT auth
 2023-08-03 09:18:44 +02:00
Misi bba11d04cb Auth: Add key_id config param to auth.jwt (#72711) 
* Specify keyID for public key provided in PEM format for JWT Auth

* Update docs

* Update sample.ini
 2023-08-03 09:13:23 +02:00
Misi dcf26564db OAuth: Introduce user_refresh_token setting and make it default for the selected providers (#71533) 
* First changes

* WIP docs

* Align current tests

* Add test for UseRefreshToken

* Update docs

* Fix

* Remove unnecessary AuthCodeURL from generic_oauth

* Change GitHub to disable use_refresh_token by default
 2023-07-14 14:03:01 +02:00
MisiandGabriel MABILLE 5efc3386d3 AuthZ: Extend /api/search to work with self-contained permissions (#70749) 
* Search sql filter draft, unfinished

* Search works for empty roles

* Add current AuthModule to SignedInUser

* clean up, changes to the search

* Use constant prefixes

* Change AuthModule to AuthenticatedBy

* Add tests for using the permissions from the SignedInUser

* Refactor and simplify code

* Fix sql generation for pg and mysql

* Fixes, clean up

* Add test for empty permission list

* Fix

* Fix any vs all in case of edit permission

* Update pkg/services/authn/authn.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Update pkg/services/sqlstore/permissions/dashboard_test.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Fixes, changes based on the review

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
 2023-07-12 12:31:36 +02:00
MisiandEve Meelan 54f1c8a40d Docs: Add note for setting root_url in case of NGINX TLS termination (#71287) 
* Add note for setting root_url in case of TLS termination

* Update docs/sources/tutorials/run-grafana-behind-a-proxy/index.md

Co-authored-by: Eve Meelan <81647476+Eve832@users.noreply.github.com>

---------

Co-authored-by: Eve Meelan <81647476+Eve832@users.noreply.github.com>
 2023-07-11 17:29:26 +02:00
MisiandGabriel MABILLE 607670a9fa Auth: Use SHA-1 for generating an ID for External Service Role (#71079) 
* Use sha1 (160 bit hash)

* Update pkg/services/accesscontrol/database/externalservices.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Satisfy linter, clean up

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
 2023-07-10 09:47:33 +02:00
Misi 789ee2121e Auth: Fixed CVE-2023-3128 (#70571) 
Fixed CVE-2023-3128
 2023-06-23 11:43:47 +02:00
Misi 0e3fbbf636 Auth: Add missing context parameter (#70565) 
Add missing parameter
 2023-06-23 11:04:54 +03:00
Misi 28bb960e42 AuthN: Make clientTokenRotation work when Grafana is accessible on a sub url (#69385) 
Fix clientTokenRotation for auth-proxy
 2023-06-01 17:06:00 +02:00
Misi 6702f07a87 AuthN: Use EqualFold for skipping introspection endpoint (#69126) 
Add equality check for introspect ep in basic.go
 2023-05-26 10:22:59 +02:00
Misi 74fd874365 AuthN: Fix render auth when clientTokenRotation is enabled (#68709) 
Add isRenderRequest check to scheduleTokenRotationJob
 2023-05-25 14:04:56 +02:00
Misi df4db412cb Auth: Fix visibility of the Invite button on /admin/users page (#68991) 
* Fix for invite button visibility

* Align test
 2023-05-25 13:58:41 +02:00
MisiandGabriel MABILLE 43be4f095a Auth: Add alpha version of the Extended JWT client (#67999) 
* initial commit

* Add tests, add configuration options

* Extend signingkeys.Service with GetServerPublicKey method

* Add, cleanup tests

* Add tests for entitlements claim

* Fix linting errors

* Suggestion to use a struct to extend the claims

(cherry picked from commit 8078b99f1d57c9426a15693d850c1ca5f0432cbe)

* Add requested changes

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Add test for orgID check

* Cleanup

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
 2023-05-11 15:12:53 +02:00
Misi 23d8f7c2fe RBAC: Fix SearchUsersPermissions when the filter is empty (#68176) 
Fix SearchUsersPermission action filter
 2023-05-10 11:24:37 +02:00
Misi e17737ba87 Chore: Update SAML lib (#824) 
Update saml lib
 2023-04-27 14:40:44 +03:00
MisiandAlexander Zobnin b3aaf544a6 Auth: Add authentication config frontend routes to api.go (#66931) 
* Add auth config frontend routes to api.go

* Remove SAML related endpoints

* Fix routes

* Enable authconfig for Enterprise, Cloud Pro and Advanced

* Fix

* Update public/app/routes/routes.tsx

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>

---------

Co-authored-by: Alexander Zobnin <alexanderzobnin@gmail.com>
 2023-04-25 13:13:55 +02:00
Misi 8548218776 Devenv: Add prometheus_oauth2_proxy_azure devenv (#66825) 
Add prometheus_oauth2_proxy_azure devenv
 2023-04-19 17:28:14 +02:00
Misi 4cac95d1c2 Auth: Remove the session cookie only if it's invalid or revoked (#65984) 
Remove the cookie if it's invalid or revoked
 2023-04-13 09:23:39 +02:00
Misi 2c21090931 AccessControl: Allow editors to access GET /api/datasources (#66343) 
Allow editors to access GET /datasources
 2023-04-12 14:53:05 +02:00
Misi 6543259a7d Auth: Add SyncPermissions post auth hook (#64205) 
* Add SyncPermissionsFromDB post auth hook

* Delete FromDB prefix

* Align tests

* Fixes

* Change SyncPermissionsHook prio
 2023-03-08 13:35:54 +01:00
Misi 7c1d9769ca Auth: Rotate token patch (#62676) 
* Use singleflight.Group

* Align tests

* Cleanup
 2023-02-02 14:36:16 +01:00
Misi b8b08ea292 Auth: Add sub claim check to JWT Auth pre-checks (#61417) 
* Auth: Add sub claim check to JWT Auth pre-checks

* Add #nosec annotation to the test tokens
 2023-01-16 10:50:34 +01:00
Misi b3a44649ce RolePicker: Align groupHeader to the list items horizontally (#61060) 
RolePicker: align groupHeader to the list items horizontally
 2023-01-10 10:43:02 +01:00
Misi 6d8bf5ac01 LDAP: Disable user in case it has been removed from LDAP directory (#60231) 
* Fix login flow

* Align test

* Fix comments

* Improve test
 2022-12-14 03:41:51 -05:00
Misi 7bb5200cc2 Devenv: OpenLDAP-Mac improvements (#60229) 
* Use groupOfUniqueNames and uniqueMember

* Update README.md
 2022-12-13 18:20:37 +01:00
MisiandKarl Persson 9c98314e9f OAuth: Refactor OAuth parameters handling to support obtaining refresh tokens for Google OAuth (#58782) 
* Add ApprovalForce to AuthCodeOptions

* Extract access token validity check to a function

* Refactor

* Oauth: set options internally instead of exposing new function

* Align tests

* Remove unused function

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
 2022-11-18 10:12:17 +01:00
MisiChristopher MoyerEric Leijonmarck
 		4915d21c25 OAuth: Feature toggle for access token expiration check and docs (#58179) 
* Add feature toggle for access token expiration check

* Add docs for configuring refresh tokens

* Update docs

* Update docs based on review

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

* Improve documentation

* Change access_type default to Offline

* Update docs/sources/setup-grafana/configure-security/configure-authentication/gitlab/index.md

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

* Update docs/sources/setup-grafana/configure-security/configure-authentication/google/index.md

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

* Update pkg/services/featuremgmt/registry.go

Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>

* Regenerate toggles

* Update Generic OAuth docs

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
Co-authored-by: Eric Leijonmarck <eric.leijonmarck@gmail.com>
 2022-11-14 16:47:46 +01:00
Misiandjguer 9c954d06ab Auth: Refresh OAuth access_token automatically using the refresh_token (#56076) 
* Verify OAuth token expiration for oauth users in the ctx handler middleware

* Use refresh token to get a new access token

* Refactor oauth_token.go

* Add tests for the middleware changes

* Align other tests

* Add tests, wip

* Add more tests

* Add InvalidateOAuthTokens method

* Fix ExpiryDate update to default

* Invalidate OAuth tokens during logout

* Improve logout

* Add more comments

* Cleanup

* Fix import order

* Add error to HasOAuthEntry return values

* add dev debug logs

* Fix tests

Co-authored-by: jguer <joao.guerreiro@grafana.com>
 2022-10-18 18:17:28 +02:00
Misi 1de0f4453e Chore: Make NewCookieOptions exported in cookies.go (#56476) 2022-10-06 20:00:54 +02:00
Misi 8405a99fef Chore: Add changed enterprise devenv path to .gitignore (#55408) 2022-09-19 12:15:28 -04:00
Misi c5be9605a2 Chore: Use TimeNow instead of time.Now in user sql store to make it testable (#54983) 2022-09-09 18:43:14 +02:00
Mihály Gyöngyösi 53c095aae7 RBAC: Disable RBACPermissionValidation by default (#54626) 
* update conf/provisioning/access-control/sample.yaml
 2022-09-02 17:18:01 +02:00
Mihály Gyöngyösi 60839d9c30 RBAC: Config setting to disable permission validation (#54447) 
* Add scope_validation_enabled config setting to rbac section

* Rename config setting
 2022-08-31 16:58:45 +02:00
Mihály Gyöngyösi 990f673202 Docs: Fix typo in custom-role-actions-scopes.md (#54294) 
* Fix typo in custom-role-actions-scopes.md

* Address lint issue
 2022-08-29 11:59:17 +02:00
Mihály GyöngyösiandAlex Khomenko aace0b1e7f Admin: Create/Edit Team/ServiceAccount UI changes (#53889) 
* RolePicker: Handle inherited with

* Small ammendment to Create Service Account layout

* RolePicker: introduce maxWidth prop

* Clean up

* Change VerticalGroup spacing to large on Team Settings page

* Introduce constant for submenu width

* Update public/app/core/components/RolePicker/RolePicker.tsx

Simplify style parameter

Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>

* Add description to the improved calculation

Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>
 2022-08-25 13:30:11 +02:00
Mihály Gyöngyösi a915977002 Teams: Add TeamRolePicker to the Create and Edit Team pages (#53775) 
* Add TeamRolePicker to CreateTeam and TeamSettings pages

* Align tests to the changes

* Change TeamRolePicker

* Add useRoleOptions hook

* Clean up

* Requested changes by reviewers

* Fixes

* Fixes
 2022-08-18 13:21:06 +02:00
Mihály Gyöngyösi 1c0ab501aa UsersTable: Display Disabled flag in Organizations' Users table (#53656) 
* Add disabled column to Org's Users table

* fix typo

* Change column order

* Add test for testing whether GetOrgUsers populates the DTO correctly
* Remove type assertion
 2022-08-15 10:58:58 +02:00
Mihály Gyöngyösiandjguer 57a46767cd AccessControl: Move GetCacheKey to SignedInUser (#53591) 
* Add HasUniqueId and IsApiKeyUser to SignedInUser

* Improve GetCacheKey by explicit checks and error branch

* Align SignedInUser to merged changes

* change comparison method

Co-authored-by: jguer <joao.guerreiro@grafana.com>
 2022-08-12 09:47:47 +02:00
Mihály Gyöngyösi 3ac4415d6d Devenv: Universal jwt_proxy environment (#53377) 
* change hostname to env.grafana.local to not collide with any custom host.docker.internal settings
* add WSL2 documentation
* update general documentation
* cleanup
 2022-08-09 17:02:36 +02:00
Mihály Gyöngyösi dc775c7577 RolePicker: Fix RolePicker menu positioning (#53201) 
Fixes #52800
 2022-08-03 14:35:51 +02:00