mirror of
https://github.com/grafana/grafana.git
synced 2025-02-25 18:55:37 -06:00
7b7b95341e
* LDAP: Allow an user to be synchronised against LDAP This PR introduces the /ldap/sync/:id endpoint. It allows a user to be synchronized against LDAP on demand. A few things to note are: LDAP needs to be enabled for the sync to work It only works against users that originally authenticated against LDAP If the user is the Grafana admin and it needs to be disabled - it will not sync the information Includes a tiny refactor that favours the JSONEq assertion helper instead of manually parsing JSON strings.
103 lines
2.4 KiB
Go
103 lines
2.4 KiB
Go
package login
|
|
|
|
import (
|
|
"github.com/grafana/grafana/pkg/bus"
|
|
"github.com/grafana/grafana/pkg/infra/log"
|
|
"github.com/grafana/grafana/pkg/models"
|
|
"github.com/grafana/grafana/pkg/services/ldap"
|
|
"github.com/grafana/grafana/pkg/services/multildap"
|
|
"github.com/grafana/grafana/pkg/setting"
|
|
"github.com/grafana/grafana/pkg/util/errutil"
|
|
)
|
|
|
|
// getLDAPConfig gets LDAP config
|
|
var getLDAPConfig = multildap.GetConfig
|
|
|
|
// isLDAPEnabled checks if LDAP is enabled
|
|
var isLDAPEnabled = multildap.IsEnabled
|
|
|
|
// newLDAP creates multiple LDAP instance
|
|
var newLDAP = multildap.New
|
|
|
|
// logger for the LDAP auth
|
|
var logger = log.New("login.ldap")
|
|
|
|
// loginUsingLDAP logs in user using LDAP. It returns whether LDAP is enabled and optional error and query arg will be
|
|
// populated with the logged in user if successful.
|
|
var loginUsingLDAP = func(query *models.LoginUserQuery) (bool, error) {
|
|
enabled := isLDAPEnabled()
|
|
|
|
if !enabled {
|
|
return false, nil
|
|
}
|
|
|
|
config, err := getLDAPConfig()
|
|
if err != nil {
|
|
return true, errutil.Wrap("Failed to get LDAP config", err)
|
|
}
|
|
|
|
externalUser, err := newLDAP(config.Servers).Login(query)
|
|
if err != nil {
|
|
if err == ldap.ErrCouldNotFindUser {
|
|
// Ignore the error since user might not be present anyway
|
|
DisableExternalUser(query.Username)
|
|
|
|
return true, ldap.ErrInvalidCredentials
|
|
}
|
|
|
|
return true, err
|
|
}
|
|
|
|
upsert := &models.UpsertUserCommand{
|
|
ExternalUser: externalUser,
|
|
SignupAllowed: setting.LDAPAllowSignup,
|
|
}
|
|
err = bus.Dispatch(upsert)
|
|
if err != nil {
|
|
return true, err
|
|
}
|
|
query.User = upsert.Result
|
|
|
|
return true, nil
|
|
}
|
|
|
|
// DisableExternalUser marks external user as disabled in Grafana db
|
|
func DisableExternalUser(username string) error {
|
|
// Check if external user exist in Grafana
|
|
userQuery := &models.GetExternalUserInfoByLoginQuery{
|
|
LoginOrEmail: username,
|
|
}
|
|
|
|
if err := bus.Dispatch(userQuery); err != nil {
|
|
return err
|
|
}
|
|
|
|
userInfo := userQuery.Result
|
|
if !userInfo.IsDisabled {
|
|
|
|
logger.Debug(
|
|
"Disabling external user",
|
|
"user",
|
|
userQuery.Result.Login,
|
|
)
|
|
|
|
// Mark user as disabled in grafana db
|
|
disableUserCmd := &models.DisableUserCommand{
|
|
UserId: userQuery.Result.UserId,
|
|
IsDisabled: true,
|
|
}
|
|
|
|
if err := bus.Dispatch(disableUserCmd); err != nil {
|
|
logger.Debug(
|
|
"Error disabling external user",
|
|
"user",
|
|
userQuery.Result.Login,
|
|
"message",
|
|
err.Error(),
|
|
)
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|