mirror of
https://github.com/grafana/grafana.git
synced 2026-08-18 17:15:08 -05:00
c2d3c90bc8
* Auth: check of auth_token in url and resolve user if present * check if auth_token is passed in url * Auth: Pass auth_token for request if present in path * no need to decode token in index * temp * use loadURLToken and set authorization header * cache token in memory and strip it from url * Use loadURLToken * Keep token in url * strip sensitive query strings from url used by context logger * adapt login by url to jwt token * add jwt iframe devenv * add jwt iframe devenv instructions * add access note * add test for cleaning request * ensure jwt token is not carried into handlers * do not reshuffle queries, might be important * add correct db dump location * prefer set token instead of cached token Co-authored-by: Ieva <ieva.vasiljeva@grafana.com> Co-authored-by: Karl Persson <kalle.persson@grafana.com> Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
107 lines
2.7 KiB
Go
107 lines
2.7 KiB
Go
package contexthandler
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
|
|
"github.com/grafana/grafana/pkg/login"
|
|
"github.com/grafana/grafana/pkg/models"
|
|
"github.com/grafana/grafana/pkg/services/user"
|
|
)
|
|
|
|
const InvalidJWT = "Invalid JWT"
|
|
const UserNotFound = "User not found"
|
|
|
|
func (h *ContextHandler) initContextWithJWT(ctx *models.ReqContext, orgId int64) bool {
|
|
if !h.Cfg.JWTAuthEnabled || h.Cfg.JWTAuthHeaderName == "" {
|
|
return false
|
|
}
|
|
|
|
jwtToken := ctx.Req.Header.Get(h.Cfg.JWTAuthHeaderName)
|
|
if jwtToken == "" && h.Cfg.JWTAuthURLLogin {
|
|
jwtToken = ctx.Req.URL.Query().Get("auth_token")
|
|
}
|
|
|
|
if jwtToken == "" {
|
|
return false
|
|
}
|
|
|
|
claims, err := h.JWTAuthService.Verify(ctx.Req.Context(), jwtToken)
|
|
if err != nil {
|
|
ctx.Logger.Debug("Failed to verify JWT", "error", err)
|
|
ctx.JsonApiErr(http.StatusUnauthorized, InvalidJWT, err)
|
|
return true
|
|
}
|
|
|
|
query := models.GetSignedInUserQuery{OrgId: orgId}
|
|
|
|
sub, _ := claims["sub"].(string)
|
|
|
|
if sub == "" {
|
|
ctx.Logger.Warn("Got a JWT without the mandatory 'sub' claim", "error", err)
|
|
ctx.JsonApiErr(http.StatusUnauthorized, InvalidJWT, err)
|
|
return true
|
|
}
|
|
extUser := &models.ExternalUserInfo{
|
|
AuthModule: "jwt",
|
|
AuthId: sub,
|
|
}
|
|
|
|
if key := h.Cfg.JWTAuthUsernameClaim; key != "" {
|
|
query.Login, _ = claims[key].(string)
|
|
extUser.Login, _ = claims[key].(string)
|
|
}
|
|
if key := h.Cfg.JWTAuthEmailClaim; key != "" {
|
|
query.Email, _ = claims[key].(string)
|
|
extUser.Email, _ = claims[key].(string)
|
|
}
|
|
|
|
if name, _ := claims["name"].(string); name != "" {
|
|
extUser.Name = name
|
|
}
|
|
|
|
if query.Login == "" && query.Email == "" {
|
|
ctx.Logger.Debug("Failed to get an authentication claim from JWT")
|
|
ctx.JsonApiErr(http.StatusUnauthorized, InvalidJWT, err)
|
|
return true
|
|
}
|
|
|
|
if h.Cfg.JWTAuthAutoSignUp {
|
|
upsert := &models.UpsertUserCommand{
|
|
ReqContext: ctx,
|
|
SignupAllowed: h.Cfg.JWTAuthAutoSignUp,
|
|
ExternalUser: extUser,
|
|
UserLookupParams: models.UserLookupParams{
|
|
UserID: nil,
|
|
Login: &query.Login,
|
|
Email: &query.Email,
|
|
},
|
|
}
|
|
if err := h.loginService.UpsertUser(ctx.Req.Context(), upsert); err != nil {
|
|
ctx.Logger.Error("Failed to upsert JWT user", "error", err)
|
|
return false
|
|
}
|
|
}
|
|
|
|
if err := h.SQLStore.GetSignedInUserWithCacheCtx(ctx.Req.Context(), &query); err != nil {
|
|
if errors.Is(err, user.ErrUserNotFound) {
|
|
ctx.Logger.Debug(
|
|
"Failed to find user using JWT claims",
|
|
"email_claim", query.Email,
|
|
"username_claim", query.Login,
|
|
)
|
|
err = login.ErrInvalidCredentials
|
|
ctx.JsonApiErr(http.StatusUnauthorized, UserNotFound, err)
|
|
} else {
|
|
ctx.Logger.Error("Failed to get signed in user", "error", err)
|
|
ctx.JsonApiErr(http.StatusUnauthorized, InvalidJWT, err)
|
|
}
|
|
return true
|
|
}
|
|
|
|
ctx.SignedInUser = query.Result
|
|
ctx.IsSignedIn = true
|
|
|
|
return true
|
|
}
|