Commit Graph

141 Commits

Author SHA1 Message Date
Jo
fee50be1bb
Sessions: Remove invalid session cookie if it's invalid/expired/missing (#59556)
only remove invalid session cookie if it's invalid/expired/missing
2022-11-30 15:33:19 +01:00
Karl Persson
062c5b805c
Auth: Merge ActiveAuthTokenService into UserAuthTokenService (#59032)
* Auth: Merge UserTokenService and ActiveAuthTokenService

* Auth: Rename function
2022-11-22 10:58:59 +01:00
Karl Persson
fef1e1d5bc
Auth: Refactor auth package (#58920)
* Auth: move interface to its own file

* Auth: move to test package

* Auth: move quota consts to auth file

* Auth: move service to impl package

* Auth: move interfaces and related models to auth package

* Auth: Create sub package and type alias to avoid circular dependency
2022-11-18 09:56:06 +01:00
Sofia Papagiannaki
9855e74b92
Chore: Refactor quota service (#58643)
Chore: Refactor quota service (#57586)

* Chore: refactore quota service

* Apply suggestions from code review
2022-11-14 21:08:10 +02:00
Sofia Papagiannaki
96cdf77995
Revert "Chore: Refactor quota service (#57586)" (#58394)
This reverts commit 326ea86a57.
2022-11-08 11:52:07 +02:00
Sofia Papagiannaki
326ea86a57
Chore: Refactor quota service (#57586)
* Chore: refactore quota service

* Apply suggestions from code review
2022-11-08 10:25:34 +02:00
Kristin Laemmert
05709ce411
chore: remove sqlstore & mockstore dependencies from (most) packages (#57087)
* chore: add alias for InitTestDB and Session

Adds an alias for the sqlstore InitTestDB and Session, and updates tests using these to reduce dependencies on the sqlstore.Store.

* next pass of removing sqlstore imports
* last little bit
* remove mockstore where possible
2022-10-19 09:02:15 -04:00
Misi
9c954d06ab
Auth: Refresh OAuth access_token automatically using the refresh_token (#56076)
* Verify OAuth token expiration for oauth users in the ctx handler middleware

* Use refresh token to get a new access token

* Refactor oauth_token.go

* Add tests for the middleware changes

* Align other tests

* Add tests, wip

* Add more tests

* Add InvalidateOAuthTokens method

* Fix ExpiryDate update to default

* Invalidate OAuth tokens during logout

* Improve logout

* Add more comments

* Cleanup

* Fix import order

* Add error to HasOAuthEntry return values

* add dev debug logs

* Fix tests

Co-authored-by: jguer <joao.guerreiro@grafana.com>
2022-10-18 18:17:28 +02:00
Sofia Papagiannaki
8b77ee2734
SQLStore: Ensure that sessions are always closed (#55864)
* SQLStore: Ensure that sessions are always closed

Delete `NewSession()` in favour of `WithDbSession()`

* Add WithDbSessionForceNewSession to the interface

* Apply suggestions from code review
2022-09-29 15:55:47 +03:00
Marcus Efraimsson
862a6a2fa6
Logging: Introduce API for contextual logging (#55198)
Introduces a FromContext method on the log.Logger interface that 
allows contextual key/value pairs to be attached, e.g. per request, 
so that any logger using this API will automatically get the per request 
context attached. The proposal makes the traceID available for 
contextual logger , if available, and would allow logs originating from 
a certain HTTP request to be correlated with traceID.
In addition, when tracing not enabled, skip adding
traceID=00000000000000000000000000000000
to logs.
2022-09-20 18:32:06 +02:00
Emil Tullstedt
b287047052
Chore: Upgrade Go to 1.19.1 (#54902)
* WIP

* Set public_suffix to a pre Ruby 2.6 version

* we don't need to install python

* Stretch->Buster

* Bump versions in lib.star

* Manually update linter

Sort of messy, but the .mod-file need to contain all dependencies that
use 1.16+ features, otherwise they're assumed to be compiled with
-lang=go1.16 and cannot access generics et al.

Bingo doesn't seem to understand that, but it's possible to manually
update things to get Bingo happy.

* undo reformatting

* Various lint improvements

* More from the linter

* goimports -w ./pkg/

* Disable gocritic

* Add/modify linter exceptions

* lint + flatten nested list

Go 1.19 doesn't support nested lists, and there wasn't an obvious workaround.
https://go.dev/doc/comment#lists
2022-09-12 12:03:49 +02:00
Ieva
de6584b976
Auth: Extend auth token errors with user ID (#54633)
* add user ID to user token errors

* remove colon

* move user ID to debug log, so it wouldn't accidentally be added in response
2022-09-02 14:38:25 +01:00
Jo
062d255124
Handle ioutil deprecations (#53526)
* replace ioutil.ReadFile -> os.ReadFile

* replace ioutil.ReadAll -> io.ReadAll

* replace ioutil.TempFile -> os.CreateTemp

* replace ioutil.NopCloser -> io.NopCloser

* replace ioutil.WriteFile -> os.WriteFile

* replace ioutil.TempDir -> os.MkdirTemp

* replace ioutil.Discard -> io.Discard
2022-08-10 15:37:51 +02:00
Selene
085ae014cd
Sync: Move ActiveTokenCount to a new service (#52991)
* Move ActiveTokenCount to a new service

* Fixing tests

* fix `RootSystem`

Co-authored-by: Artur Wierzbicki <artur.wierzbicki@grafana.com>
2022-07-29 16:30:46 +02:00
idafurjes
6c43eb0b4d
Split Create User (#50502)
* Split Create User

* Use new create user and User from package user

* Add service to wire

* Making create user work

* Replace user from user pkg

* One more

* Move Insert to orguser Service/Store

* Remove unnecessary conversion

* Cleaunp

* Fix Get User and add fakes

* Fixing get org id for user logic, adding fakes and other adjustments

* Add some tests for ourguser service and store

* Fix insert org logic

* Add comment about deprecation

* Fix after merge with main

* Move orguser service/store to org service/store

* Remove orguser from wire

* Unimplement new Create user and use User from pkg user

* Fix wire generation

* Fix lint

* Fix lint - use only User and CrateUserCommand from user pkg

* Remove User and CreateUserCommand from models

* Fix lint 2
2022-06-28 14:32:25 +02:00
idafurjes
b8852ef6a3
Chore: Remove context.TODO() (#43409)
* Remove context.TODO() from services

* Fix live test

* Remove context.TODO
2021-12-22 11:02:42 +01:00
Emil Tullstedt
12e0a94316
JWT: Split race-y test into two stable tests (#41950) 2021-11-19 12:05:04 +01:00
Emil Tullstedt
dbb8246b6b
JWT: Increase distance from now in tests (#41794) 2021-11-17 12:03:56 +01:00
Guillaume GILL
7c5de96503
Auth: Omit all base64 paddings in JWT tokens for the JWT auth (#35602)
Omitting all base64 paddings (=) in JWT tokens.

Fixes #34496
2021-10-27 18:50:30 +02:00
Serge Zaitsev
995afa2221
Chore: Refactor GoConvey in auth package (#40850)
* refactor goconvey in auth package

* make linter happy
2021-10-27 16:08:21 +02:00
idafurjes
f4f0d74838
Chore: Add context to user (#39649)
* Add context to user

* Add context for enterprise

* Add context for UpdateUserLastSeenAtCommand

* Remove xorm
2021-10-04 15:46:09 +02:00
Arve Knudsen
78596a6756
Migrate to Wire for dependency injection (#32289)
Fixes #30144

Co-authored-by: dsotirakis <sotirakis.dim@gmail.com>
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Co-authored-by: Ida Furjesova <ida.furjesova@grafana.com>
Co-authored-by: Jack Westbrook <jack.westbrook@gmail.com>
Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
Co-authored-by: Leon Sorokin <leeoniya@gmail.com>
Co-authored-by: Andrej Ocenas <mr.ocenas@gmail.com>
Co-authored-by: spinillos <selenepinillos@gmail.com>
Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: Leonard Gram <leo@xlson.com>
2021-08-25 15:11:22 +02:00
Carl Bergquist
a10fa5cad3
Instrumentation: Start tracing database requests (#34572)
Signed-off-by: bergquist <carl.bergquist@gmail.com>
2021-05-27 13:55:33 +02:00
Vladimir Kochnev
39a3b0d0b0
Auth: support JWT Authentication (#29995) 2021-03-31 08:40:44 -07:00
Joan López de la Franca Beltran
610999cfa2
Auth: Allow soft token revocation (#31601)
* Add revoked_at field to user auth token to allow soft revokes

* Allow soft token revocations

* Update token revocations and tests

* Return error info on revokedTokenErr

* Override session cookie only when no revokedErr nor API request

* Display modal on revoked token error

* Feedback: Refactor TokenRevokedModal to FC

* Add GetUserRevokedTokens into UserTokenService

* Backendsrv: adds tests and refactors soft token path

* Apply feedback

* Write redirect cookie on token revoked error

* Update TokenRevokedModal style

* Return meaningful error info

* Some UI changes

* Update backend_srv tests

* Minor style fix on backend_srv tests

* Replace deprecated method usage to publish events

* Fix backend_srv tests

* Apply suggestions from code review

Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>
Co-authored-by: Hugo Häggmark <hugo.haggmark@gmail.com>

* Apply suggestions from code review

* Apply suggestions from code review

Co-authored-by: Hugo Häggmark <hugo.haggmark@gmail.com>

* Minor style fix after PR suggestion commit

* Apply suggestions from code review

Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>

* Prettier fixes

Co-authored-by: Hugo Häggmark <hugo.haggmark@gmail.com>
Co-authored-by: Alex Khomenko <Clarity-89@users.noreply.github.com>
Co-authored-by: Ursula Kallio <73951760+osg-grafana@users.noreply.github.com>
2021-03-16 17:44:02 +01:00
Carl Bergquist
5114fa39ce
we should never log unhashed tokens (#31432)
Signed-off-by: bergquist <carl.bergquist@gmail.com>
2021-02-24 10:04:25 +01:00
Agnès Toulet
2a70c73025
Auth: add expired token error and update CreateToken function (#30203)
* Auth: add error for expired token

* Auth: save token error into context data

* Auth: send full user and req context to CreateToken

* Auth: add token ID in context

* add TokenExpiredError struct

* update auth tests

* remove most of the changes to CreateToken func

* clean up

* Login: add requestURI in CreateToken ctx

* update RequestURIKey comment
2021-01-19 17:55:53 +01:00
Arve Knudsen
25048ebdf8
Chore: Add CloudWatch HTTP API tests (#29691)
* CloudWatch: Add HTTP API tests

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>
2021-01-07 11:36:13 +01:00
Arve Knudsen
12661e8a9d
Move middleware context handler logic to service (#29605)
* middleware: Move context handler to own service

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

Co-authored-by: Emil Tullsted <sakjur@users.noreply.github.com>
Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
2020-12-11 11:44:44 +01:00
taciomcosta
10ff4eecef
Backend: fix IPv6 address parsing erroneous (#28585)
* Backend: Fix parsing of client IP address

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

Co-authored-by: Arve Knudsen <arve.knudsen@gmail.com>
2020-11-25 07:55:22 +01:00
Arve Knudsen
b5379c5335
Chore: Fix SQL related Go variable naming (#28887)
* Chore: Fix variable naming

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>
2020-11-11 06:21:08 +01:00
Arve Knudsen
676d393ec9
Chore: Fix issues reported by staticcheck; enable stylecheck linter (#28866)
* Chore: Fix issues reported by staticcheck

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Apply suggestions from code review

Co-authored-by: Emil Tullstedt <emil.tullstedt@grafana.com>
2020-11-05 15:37:11 +01:00
Arve Knudsen
a078e40238
Settings: Rename constants/variables to follow Go naming standards (#28002)
* settings: Rename constants/variables to follow Go naming standards
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>
2020-10-02 15:45:45 +02:00
Hansuuuuuuuuuu
8d971ab2f2
Auth: Replace maximum inactive/lifetime settings of days to duration (#27150)
Allows login_maximum_inactive_lifetime_duration and 
login_maximum_lifetime_duration to be configured using 
time.Duration-compatible values while retaining backward compatibility.

Fixes #17554

Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
2020-09-14 15:57:38 +02:00
Arve Knudsen
41d432b5ae
Chore: Enable whitespace linter (#25903)
Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>
2020-07-06 20:17:28 +02:00
Arve Knudsen
2a78d2a61c
pkg/services: Check errors (#19712)
* pkg/services: Check errors
* pkg/services: Don't treat context.Canceled|context.DeadlineExceeded as error
2019-10-22 14:08:18 +02:00
Arve Knudsen
b858a5f496
Don't truncate IPv6 addresses (#19573)
* Bugfix: Fix parsing of IPv6 addresses

Make sure that IPv6 addresses aren't truncated when parsing. Fixes #18924
* util: Change network address parsing funcs to return error
* pkg/api: Return NetworkAddress instead of host/port
2019-10-09 08:58:45 +02:00
Leonard Gram
d71043609e
Testing: Include BatchRevoke for all tokens in the fake. (#17728) 2019-07-02 09:42:35 +02:00
Alexander Zobnin
60ddad8fdb
Batch disable users (#17254)
* batch disable users

* batch revoke users tokens

* split batch disable user and revoke token

* fix tests for batch disable users

* Chore: add BatchDisableUsers() to the bus
2019-05-31 13:22:22 +03:00
zhulongcheng
2fff8f77dc move log package to /infra (#17023)
ref #14679

Signed-off-by: zhulongcheng <zhulongcheng.me@gmail.com>
2019-05-13 08:45:54 +02:00
Carl Bergquist
9660356638
Auth: Enable retries and transaction for some db calls for auth tokens (#16785)
the WithSession wrapper handles retries and connection
management so the caller dont have to worry about it.
2019-04-30 14:42:01 +02:00
Carl Bergquist
490515aec6
build: partially replace gometalinter with golangci-lint (#16610)
we still use gometalinter for goconst since it doesn't 
report errors for duplicated in test files
2019-04-16 10:27:07 +02:00
Marcus Efraimsson
8029e48588
support get user tokens/revoke all user tokens in UserTokenService 2019-03-08 15:15:17 +01:00
bergquist
7754c37a1f reduce loglevel to debug 2019-02-19 08:22:33 +01:00
bergquist
e163aadfe4 use authtoken for session quota restrictions
closes #15360
2019-02-12 15:10:55 +01:00
bergquist
170783c292 make hourly cleanup the default behavior 2019-02-07 10:51:35 +01:00
Marcus Efraimsson
1a140ee199
run token cleanup job when grafana starts, then each hour 2019-02-06 22:27:08 +01:00
Marcus Efraimsson
8ae066ab5d
move authtoken package into auth package 2019-02-06 17:02:57 +01:00
Marcus Efraimsson
8678620730
move UserToken and UserTokenService to models package 2019-02-06 16:55:12 +01:00
Marcus Efraimsson
a60124a88c
change UserToken from interface to struct 2019-02-06 16:30:50 +01:00
Marcus Efraimsson
d8658a765c
enhanced expiration logic for lookup token
tokens are not expired if created_at > now - LoginMaxLifetimeDays and
rotated_at > now - LoginMaxInactiveLifetimeDays
2019-02-06 08:30:14 +01:00
Marcus Efraimsson
9483506590
auth token clean up job now runs on schedule and deletes all expired tokens
delete tokens having created_at <= LoginMaxLifetimeDays or
rotated_at <= LoginMaxInactiveLifetimeDays
2019-02-05 21:20:11 +01:00
Marcus Efraimsson
0915f931ae
change configuration settings in auth package 2019-02-05 21:12:30 +01:00
Marcus Efraimsson
7cd3cd6cd4
auth package refactoring
moving middleware/hooks away from package
exposing public struct UserToken accessible from other packages
fix debug log lines so the same order and naming are used
2019-02-05 00:10:56 +01:00
Marcus Efraimsson
fb3c510178
Merge branch 'master' into delete_session_on_logout 2019-02-04 20:23:05 +01:00
bergquist
a6bd2c73a0 introduce samesite setting for login cookie
ref #15067
2019-02-01 11:47:21 +01:00
bergquist
a1b3986532 always delete session cookie even if db delete fails 2019-02-01 09:59:53 +01:00
bergquist
91bd908e03 adds more tests signing out session 2019-01-31 22:24:04 +01:00
bergquist
11c4967bdc changes some info logging to debug 2019-01-31 21:51:14 +01:00
bergquist
88ca54eba9 renames signout function 2019-01-31 16:26:36 +01:00
bergquist
43ac79685a delete auth token on signout 2019-01-31 16:13:35 +01:00
bergquist
75760aa892 dont specify domain for auth cookies 2019-01-25 10:40:50 +01:00
bergquist
d6edaa1328 moves cookie https setting to [security] 2019-01-24 19:04:58 +01:00
bergquist
516037fbdd makes sure rotation is always higher than urgent rotation 2019-01-24 13:54:45 +01:00
bergquist
fd0f9f2dd2 fixes broken test 2019-01-24 12:06:44 +01:00
bergquist
ff483f3782 removes old cookie auth configuration 2019-01-24 10:55:10 +01:00
bergquist
56a521b264 makes auth token rotation time configurable 2019-01-24 10:50:18 +01:00
Carl Bergquist
766122856b
Merge pull request #14995 from bergquist/token_oauth
Stores hashed state code in cookie for OAuth logins.
2019-01-23 10:39:12 +01:00
bergquist
c3ff3d644c fixes nil ref in tests 2019-01-22 16:16:32 +01:00
bergquist
64124b5042 add setting for how to long we should keep expired tokens 2019-01-22 15:31:43 +01:00
bergquist
12f8338977 stores hashed state code in cookie 2019-01-22 15:22:24 +01:00
bergquist
d3ec8e1ccb creates new config section for login settings 2019-01-22 15:22:11 +01:00
Marcus Efraimsson
4096449aec
extract auth token interface and remove auth token from context 2019-01-22 12:00:33 +01:00
Marcus Efraimsson
366e356e08
more auth token tests 2019-01-21 21:48:18 +01:00
bergquist
777bd9ea18 adds cleanup job for old session tokens 2019-01-21 19:03:32 +01:00
Marcus Efraimsson
f040f9a400
fix tests after renaming now 2019-01-21 16:53:00 +01:00
Marcus Efraimsson
38efc1d7d2
s/print/log 2019-01-21 15:53:40 +01:00
bergquist
92620af75f avoid calling now() multiple times 2019-01-21 15:48:17 +01:00
Marcus Efraimsson
dd8476d81a
passing auth token tests 2019-01-21 15:06:33 +01:00
Marcus Efraimsson
565408194a
handle expired tokens 2019-01-21 13:22:20 +01:00
bergquist
697ddccd8e set userToken on request when logging in 2019-01-21 11:42:10 +01:00
bergquist
55b3013eb3 moves initWithToken to auth package 2019-01-21 11:37:44 +01:00
Marcus Efraimsson
734a7d38b2
set cookie name from configuration 2019-01-21 11:21:43 +01:00
Marcus Efraimsson
766cfab374
change rotate time 2019-01-21 10:22:18 +01:00
Marcus Efraimsson
0d1e3759eb
mixor fixes 2019-01-21 10:20:23 +01:00
bergquist
2e97d39abe removes commented code 2019-01-21 10:01:48 +01:00
bergquist
47a7d93fd9 moves rotation into auth since both happens before c.Next() 2019-01-21 08:59:01 +01:00
bergquist
fd937e3d95 remove maxage from session token 2019-01-17 21:03:27 +01:00
bergquist
c2accfa4c0 inital code for rotate 2019-01-17 17:11:52 +01:00
bergquist
aba6148c43 login users based on token cookie 2019-01-16 16:44:40 +01:00
Marcus Efraimsson
b0df7280be
begin user auth token implementation 2019-01-15 15:16:20 +01:00