Commit Graph

26 Commits

Author SHA1 Message Date
Gabriel MABILLE
8988e04044
RBAC: Add permission registry (#91247)
* RBAC: Permission registry

* Populate permission registry

* Wire

* conflic_user_cmd

* Update pkg/services/accesscontrol/permreg/permreg_test.go

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* PR feedback

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>

* Remove ToDo, tackle in subsequent PR

---------

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
2024-08-02 09:32:06 +02:00
Karl Persson
e568b86ac0
Zanzana: Initial work to allow partial data migrations (#89919)
* Zanana: Add Write method to interface

* Zanzana: Add utilities for translating RBAC to openFGA tuple keys

* RBAC: Add zanzana synchronizer

* Run zanzana sync in access controll provider
2024-07-02 14:45:25 +02:00
Ryan McKinley
99d8025829
Chore: Move identity and errutil to apimachinery module (#89116) 2024-06-13 07:11:35 +03:00
Gabriel MABILLE
b1520e93f1
Fix: Regenerate token on failed encryption/decryption (#88732)
* Add function to rotate the extsvc token

* Recover from failed token decryption

* add log

* Remove error check

* Log outside error
2024-06-05 11:56:54 +02:00
Gabriel MABILLE
3d9908f363
Fix: Prevent ExtSvcTokens from containing nil characters (#88243)
* Fix: Prevent ExtSvcTokens from containing nil characters

* Rebase

* Add more logs

* Nit. nil -> NUL

* Nit. Part -> Parts

* Back to const

* Account for comments

Co-authored-by: Claudiu Dragalina-Paraipan <claudiu.dragalina@grafana.com>

---------

Co-authored-by: Claudiu Dragalina-Paraipan <claudiu.dragalina@grafana.com>
2024-05-28 10:39:46 +02:00
Ieva
bd2b248f0e
RBAC: Clean up action set code (#88147)
* remove unused action set code, refactor the existing code

* fix import ordering

* use a separate interface for permission expansion after all, to avoid circular dependencies

* add comments, fix a test
2024-05-23 12:14:01 +01:00
Ieva
3e77768144
RBAC: Expand action sets when fetching permissions (#87967)
* logic to expand action set to the underlying actions when permissions are fetched from the DB

* updates needed for dependency injection

* clean up some code, also deduplicate scopes when grouping scopes and actions

* expand on a comment

* rename a method
2024-05-21 15:09:26 +01:00
Alexander Zobnin
82dea4b3e5
Access control: Cache basic roles and teams permissions (#87043)
* RBAC: Cache basic roles permissions

* Cache teams permissions

* Set cache TTL to 1 minute

* Add OSS implementation

* Fetch basic role permissions correctly

* fix conflict_user_command

* Fix teams permissions query

* Add traces for GetUserPermissions

* Fix folders tests

* Fix colflict user command

* Update store mock

* Fix linter error

* Reuse GetUserPermissions for fetching basic roles

* tests for GetTeamsPermissions

* pre-allocate slice capacity

* Fix linter
2024-05-07 15:23:11 +02:00
Dave Henderson
5687243d0b
Feature Flags: use FeatureToggles interface where possible (#85131)
* Feature Flags: use FeatureToggles interface where possible

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

* Replace TestFeatureToggles with existing WithFeatures

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>

---------

Signed-off-by: Dave Henderson <dave.henderson@grafana.com>
2024-04-04 12:22:31 -04:00
Xavi Lacasa
a813046f3d
Better tracing during extSvcAcc registration (#84719) 2024-03-21 16:41:10 +01:00
Gabriel MABILLE
2795f9827a
ExtSvcAccounts: FIX prevent service account deletion (#84502)
* ExtSvcAccounts: Fix External Service Accounts Login check

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

* Remove service accounts assignments and permissions on delete

* Fix first set of tests

* Fix second batch of tests

* Fix third batch of tests

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
2024-03-14 19:11:02 +01:00
Gabriel MABILLE
80d6bf6da0
AuthN: Remove embedded oauth server (#83146)
* AuthN: Remove embedded oauth server

* Restore main

* go mod tidy

* Fix problem

* Remove permission intersection

* Fix test and lint

* Fix TestData test

* Revert to origin/main

* Update go.mod

* Update go.mod

* Update go.sum
2024-02-26 11:29:09 +01:00
Gabriel MABILLE
846eadff63
RBAC Search: Replace userLogin filter by namespacedID filter (#81810)
* Add namespace ID

* Refactor and add tests

* Rename maxOneOption -> atMostOneOption

* Add ToDo

* Remove UserLogin & UserID for NamespaceID

Co-authored-by: jguer <joao.guerreiro@grafana.com>

* Remove unecessary import of the userSvc

* Update pkg/services/accesscontrol/acimpl/service.go

* fix 1 -> userID

* Update pkg/services/accesscontrol/accesscontrol.go

---------

Co-authored-by: jguer <joao.guerreiro@grafana.com>
2024-02-16 11:42:36 +01:00
Gabriel MABILLE
722b78f3e0
RBAC: Add userLogin filter to the permission search endpoint (#81137)
* RBAC: Search add user login filter

* Switch to a userService resolving instead

* Remove unused error

* Fallback to use the cache

* account for userID filter

* Account for the error

* snake case

* Add test cases

* Add api tests

* Fix return on error

* Re-order imports
2024-01-26 09:43:16 +01:00
Ryan McKinley
1caaa56de0
FeatureFlags: Use interface rather than manager (#80000) 2024-01-09 10:38:06 -08:00
Gabriel MABILLE
72d32eed27
ExtSvcAuth: Assign roles locally (#78669)
* ExtSvcAuth: Assign roles locally

* Fix test

* HandlePluginStateChanged in the OrgID

* Remove Global from command

* Use AssignmentOrgID instead of OrgID

* Remove unecessary test case
2023-11-29 12:12:30 +01:00
Gabriel MABILLE
25c2d99350
ExtSvcAuth: Add traces to external service accounts setup (#76779)
* AuthN: Add traces to external service accounts setup
2023-11-16 20:45:31 +01:00
Gabriel MABILLE
ba717454e1
ExtSvcAuth: Clean up orphaned external services on start up (#77951)
* Plugin: Remove external service on plugin removal

* Early exit no service account

* Add log

* WIP

* Cable OAuth2Server client removal

* Move function lower

* Add function to test removal

* Add test to RemoveExternalService

* Test RemoveExtSvcAccount

* remove apostrophy in comment

* Add cfg to plugin installer to check features

* Add feature flag check in the service registration service

* Comments

* Move metrics Inc

* Initialize map

* Reorder

* Initialize mutex as well

* Add HasExternalService as suggested

* WIP: CleanUpOrphanedExternalServices

* Commit suggestion

Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>

* Nit on test.

Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>

* oauthserver return names

* Name is not Slug

* Use plugin ID not slug

* Add background job

* remove negation on feature check

* Add test to the CleanUp function

* Test GetExternalServiceNames

* rename test

* Add test for ExtSvcAccountsService_GetExternalServiceNames

* Add a todo

* Add todo

* Option based on mix

* Rewrite a bit the comment

* Opinionated choice use slugs instead of names everywhere

* Nit.

* Comments and re-ordering

* Comment

* Add log

* Add context

---------

Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>
2023-11-16 12:07:42 +01:00
Ryan McKinley
f69fd3726b
FeatureToggles: Add context and and an explicit global check (#78081) 2023-11-14 12:50:27 -08:00
Gabriel MABILLE
fe8d0e6381
ExtSvcAuth: Refactor external service registry to use ExternalServiceRegistry variables (#78056)
ExtSvcAuth: Refactor external service registry to use ExternalServiceRegistry
2023-11-13 16:23:11 +01:00
Gabriel MABILLE
20a2840046
Plugin: Remove external service on plugin removal (#77712)
* Plugin: Remove external service on plugin removal

* Add feature flag check in the service registration service

* Initialize map

* Add HasExternalService as suggested

* Commit suggestion

Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>

* Nit on test.

Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>


---------

Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>
2023-11-13 13:18:13 +01:00
Gabriel MABILLE
25b30aeb6d
Plugin: Enable service account based on plugin settings on init (#77193)
* Disable plugin service account

* Revert extsvc injection

* handle plugin state changes

* Use isProxyEnabled

* Remove plugininteg changes

* Change update function to also work for mysql 😩

* Plugin: enable service account based on plugin settings on
initialization

* Remove misleading comment

* Fix tests

* test message

* Clean up tests

* Simplify tests

* Re-order imports

* Remove unecessary comment

* Enable datasource plugins by default

Co-authored-by: Andres Martinez Gotor <andres.martinez@grafana.com>

---------

Co-authored-by: Andres Martinez Gotor <andres.martinez@grafana.com>
2023-10-27 14:27:06 +02:00
Gabriel MABILLE
2727f41474
AuthN: Change the external service account state on plugin state change (#77157)
* Disable plugin service account

* Revert extsvc injection

* handle plugin state changes

* Use isProxyEnabled

* Remove plugininteg changes

* Change update function to also work for mysql 😩

* Change test to also check no collateral update

* Update pkg/services/serviceaccounts/database/store_test.go

* Update pkg/services/serviceaccounts/database/store_test.go
2023-10-27 13:46:25 +02:00
linoman
1bc81b7bd1
auth: migrate api interface implementation (#77040)
* expand serviceaccount service interface

* implemet FakeServiceAccountService

* Replace SA service interface from api

* merge sa proxy tests with new fake service

* implement DeleteServiceAccountToken

* add test for DeleteServiceAccountToken
2023-10-25 12:40:30 +02:00
Gabriel MABILLE
897e3a4dab
AuthN: Add metrics to external service accounts management (#76789)
* AuthN: Add metrics to external service accounts management

* Add a new metric to count stored external service accounts

* Update variable names

Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>

* Add test to SearchOrgServiceAccounts

* Add feature flags checks before registering and using the metrics

---------

Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>
2023-10-24 15:54:14 +02:00
Gabriel MABILLE
3015e5921f
Chore: Move extsvcaccounts package to serviceaccounts (#76977)
* Chore: Move extsvcaccounts package to serviceaccounts

* Fix proxy

* Fix tests

* Fix linting
2023-10-24 11:01:04 +02:00