Commit Graph

13 Commits

Author SHA1 Message Date
Gabriel MABILLE
2795f9827a
ExtSvcAccounts: FIX prevent service account deletion (#84502)
* ExtSvcAccounts: Fix External Service Accounts Login check

Co-authored-by: Karl Persson <kalle.persson@grafana.com>

* Remove service accounts assignments and permissions on delete

* Fix first set of tests

* Fix second batch of tests

* Fix third batch of tests

---------

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
2024-03-14 19:11:02 +01:00
Gabriel MABILLE
80d6bf6da0
AuthN: Remove embedded oauth server (#83146)
* AuthN: Remove embedded oauth server

* Restore main

* go mod tidy

* Fix problem

* Remove permission intersection

* Fix test and lint

* Fix TestData test

* Revert to origin/main

* Update go.mod

* Update go.mod

* Update go.sum
2024-02-26 11:29:09 +01:00
Ryan McKinley
f69fd3726b
FeatureToggles: Add context and and an explicit global check (#78081) 2023-11-14 12:50:27 -08:00
linoman
408dab8c57
IAM: Protect managed service account frontend details page (#77839)
* Add `isManaged` property to frontend model

* Remove enabled and token buttons for managed SA

* Replace trash icon for lock icon for managed SA

* Block the role picker for managed SA

* Filter SA list usiong the managed filter

* Rename external for managed

* Add only managed filter

* Toggle the enable buttons for managed sa

* Disable add token and delete token buttons

* Remove the edit name button

* Disable the Role picker for managed sa

* Hide the permissions section

* Add managed by row

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>
2023-11-14 17:52:48 +01:00
linoman
5bc4f56c79
IAM: Protect external service accounts frontend list page (#77834)
* Add `isExternal` property to frontend model

* Remove enabled and token buttons for external SA

* Replace trash icon for lock icon for external SA

* Block the role picker for external SA

* Filter SA list using the external filter

* Add only external filter at backend

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2023-11-09 17:45:46 +01:00
Gabriel MABILLE
bf363b3234
ServiceAccounts: Use isManaged in DTO instead of isExternal (#77634)
* ServiceAccounts: Use IsManaged in DTO instead of isExternal

* Revert omitempty

* Modify the other DTO

* Swagger
2023-11-03 17:49:11 +01:00
linoman
c50ada3a1a
auth: wire service account proxy (#77215)
* Add interface verification compliance

* rework service account api to a provider

* wire the service accounts api

* rewire the implementation of sa srv for the proxy

---------

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
2023-11-03 10:27:43 +01:00
Gabriel MABILLE
2727f41474
AuthN: Change the external service account state on plugin state change (#77157)
* Disable plugin service account

* Revert extsvc injection

* handle plugin state changes

* Use isProxyEnabled

* Remove plugininteg changes

* Change update function to also work for mysql 😩

* Change test to also check no collateral update

* Update pkg/services/serviceaccounts/database/store_test.go

* Update pkg/services/serviceaccounts/database/store_test.go
2023-10-27 13:46:25 +02:00
linoman
dff7403b29
auth: implement feature flag for service account proxy (#77129)
* add FlagExternalServiceAccounts to proxy service

* add FlagExternalServiceAccounts value to tests

---------

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2023-10-25 16:44:05 +02:00
linoman
1bc81b7bd1
auth: migrate api interface implementation (#77040)
* expand serviceaccount service interface

* implemet FakeServiceAccountService

* Replace SA service interface from api

* merge sa proxy tests with new fake service

* implement DeleteServiceAccountToken

* add test for DeleteServiceAccountToken
2023-10-25 12:40:30 +02:00
Gabriel MABILLE
897e3a4dab
AuthN: Add metrics to external service accounts management (#76789)
* AuthN: Add metrics to external service accounts management

* Add a new metric to count stored external service accounts

* Update variable names

Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>

* Add test to SearchOrgServiceAccounts

* Add feature flags checks before registering and using the metrics

---------

Co-authored-by: linoman <2051016+linoman@users.noreply.github.com>
2023-10-24 15:54:14 +02:00
Gabriel MABILLE
3015e5921f
Chore: Move extsvcaccounts package to serviceaccounts (#76977)
* Chore: Move extsvcaccounts package to serviceaccounts

* Fix proxy

* Fix tests

* Fix linting
2023-10-24 11:01:04 +02:00
linoman
359d84799e
auth: add serviceaccount proxy (#76815)
* Add proxy service template

* Replace SA srv with proxy for external SA srv

* Move service account prefix to a constant

* Prevent deletion from external service account

* Make SA validation a resusable function

* Add protection for creating service accounts

* Add protection when updating service accounts

* Add IsExternal field for service account

* Protect ext service account token generation

* Add verbose errors for form name or sa name

* add tests

* Add logs

* Adjusts tests

---------

Co-authored-by: Misi <mgyongyosi@users.noreply.github.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2023-10-23 14:09:42 +02:00