mirror of
https://github.com/grafana/grafana.git
synced 2025-02-25 18:55:37 -06:00
3d1c624c12
* db: add login attempt migrations * db: add possibility to create login attempts * db: add possibility to retrieve login attempt count per username * auth: validation and update of login attempts for invalid credentials If login attempt count for user authenticating is 5 or more the last 5 minutes we temporarily block the user access to login * db: add possibility to delete expired login attempts * cleanup: Delete login attempts older than 10 minutes The cleanup job are running continuously and triggering each 10 minute * fix typo: rename consequent to consequent * auth: enable login attempt validation for ldap logins * auth: disable login attempts validation by configuration Setting is named DisableLoginAttemptsValidation and is false by default Config disable_login_attempts_validation is placed under security section #7616 * auth: don't run cleanup of login attempts if feature is disabled #7616 * auth: rename settings.go to ldap_settings.go * auth: refactor AuthenticateUser Extract grafana login, ldap login and login attemp validation together with their tests to separate files. Enables testing of many more aspects when authenticating a user. #7616 * auth: rename login attempt validation to brute force login protection Setting DisableLoginAttemptsValidation => DisableBruteForceLoginProtection Configuration disable_login_attempts_validation => disable_brute_force_login_protection #7616
56 lines
1.1 KiB
Go
56 lines
1.1 KiB
Go
package login
|
|
|
|
import (
|
|
"errors"
|
|
|
|
"github.com/grafana/grafana/pkg/bus"
|
|
m "github.com/grafana/grafana/pkg/models"
|
|
)
|
|
|
|
var (
|
|
ErrInvalidCredentials = errors.New("Invalid Username or Password")
|
|
ErrTooManyLoginAttempts = errors.New("Too many consecutive incorrect login attempts for user. Login for user temporarily blocked")
|
|
)
|
|
|
|
type LoginUserQuery struct {
|
|
Username string
|
|
Password string
|
|
User *m.User
|
|
IpAddress string
|
|
}
|
|
|
|
func Init() {
|
|
bus.AddHandler("auth", AuthenticateUser)
|
|
loadLdapConfig()
|
|
}
|
|
|
|
func AuthenticateUser(query *LoginUserQuery) error {
|
|
if err := validateLoginAttempts(query.Username); err != nil {
|
|
return err
|
|
}
|
|
|
|
err := loginUsingGrafanaDB(query)
|
|
if err == nil || (err != m.ErrUserNotFound && err != ErrInvalidCredentials) {
|
|
return err
|
|
}
|
|
|
|
ldapEnabled, ldapErr := loginUsingLdap(query)
|
|
if ldapEnabled {
|
|
if ldapErr == nil || ldapErr != ErrInvalidCredentials {
|
|
return ldapErr
|
|
}
|
|
|
|
err = ldapErr
|
|
}
|
|
|
|
if err == ErrInvalidCredentials {
|
|
saveInvalidLoginAttempt(query)
|
|
}
|
|
|
|
if err == m.ErrUserNotFound {
|
|
return ErrInvalidCredentials
|
|
}
|
|
|
|
return err
|
|
}
|