grafana/pkg/services/accesscontrol
Gabriel MABILLE edf1775d49
AuthN: Embed an OAuth2 server for external service authentication (#68086)
* Moving POC files from #64283 to a new branch

Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>

* Adding missing permission definition

Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>

* Force the service instantiation while client isn't merged

Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>

* Merge conf with main

Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>

* Leave go-sqlite3 version unchanged

Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>

* tidy

Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>

* User SearchUserPermissions instead of SearchUsersPermissions

* Replace DummyKeyService with signingkeys.Service

* Use user🆔<id> as subject

* Fix introspection endpoint issue

* Add X-Grafana-Org-Id to get_resources.bash script

* Regenerate toggles_gen.go
* Fix basic.go

* Add GetExternalService tests

* Add GetPublicKeyScopes tests

* Add GetScopesOnUser tests

* Add GetScopes tests

* Add ParsePublicKeyPem tests

* Add database test for GetByName

* re-add comments

* client tests added

* Add GetExternalServicePublicKey tests

* Add other test case to GetExternalServicePublicKey

* client_credentials grant test

* Add test to jwtbearer grant

* Test Comments

* Add handleKeyOptions tests

* Add RSA key generation test

* Add ECDSA by default to EmbeddedSigningKeysService

* Clean up org id scope and audiences

* Add audiences to the DB

* Fix check on Audience

* Fix double import

* Add AC Store mock and align oauthserver tests

* Fix test after rebase

* Adding missing store function to mock

* Fix double import

* Add CODEOWNER

* Fix some linting errors

* errors don't need type assertion

* Typo codeowners

* use mockery for oauthserver store

* Add feature toggle check

* Fix db tests to handle the feature flag

* Adding call to DeleteExternalServiceRole

* Fix flaky test

* Re-organize routes comments and plan futur work

* Add client_id check to Extended JWT client

* Clean up

* Fix

* Remove background service registry instantiation of the OAuth server

* Comment cleanup

* Remove unused client function

* Update go.mod to use the latest ory/fosite commit

* Remove oauth2_server related configs from defaults.ini

* Add audiences to DTO

* Fix flaky test

* Remove registration endpoint and demo scripts. Document code

* Rename packages

* Remove the OAuthService vs OAuthServer confusion

* fix incorrect import ext_jwt_test

* Comments and order

* Comment basic auth

* Remove unecessary todo

* Clean api

* Moving ParsePublicKeyPem to utils

* re ordering functions in service.go

* Fix comment

* comment on the redirect uri

* Add RBAC actions, not only scopes

* Fix tests

* re-import featuremgmt in migrations

* Fix wire

* Fix scopes in test

* Fix flaky test

* Remove todo, the intersection should always return the minimal set

* Remove unecessary check from intersection code

* Allow env overrides on settings

* remove the term app name

* Remove app keyword for client instead and use Name instead of ExternalServiceName

* LogID remove ExternalService ref

* Use Name instead of ExternalServiceName

* Imports order

* Inline

* Using ExternalService and ExternalServiceDTO

* Remove xorm tags

* comment

* Rename client files

* client -> external service

* comments

* Move test to correct package

* slimmer test

* cachedUser -> cachedExternalService

* Fix aggregate store test

* PluginAuthSession -> AuthSession

* Revert the nil cehcks

* Remove unecessary extra

* Removing custom session

* fix typo in test

* Use constants for tests

* Simplify HandleToken tests

* Refactor the HandleTokenRequest test

* test message

* Review test

* Prevent flacky test on client as well

* go imports

* Revert changes from 526e48ad45

* AuthN: Change the External Service registration form (#68649)

* AuthN: change the External Service registration form

* Gen default permissions

* Change demo script registration form

* Remove unecessary comment

* Nit.

* Reduce cyclomatic complexity

* Remove demo_scripts

* Handle case with no service account

* Comments

* Group key gen

* Nit.

* Check the SaveExternalService test

* Rename cachedUser to cachedClient in test

* One more test case to database test

* Comments

* Remove last org scope

Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>

* Update pkg/services/oauthserver/utils/utils_test.go

* Update pkg/services/sqlstore/migrations/oauthserver/migrations.go

Remove comment

* Update pkg/setting/setting.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

---------

Co-authored-by: Mihály Gyöngyösi <mgyongyosi@users.noreply.github.com>
2023-05-25 15:38:30 +02:00
..
acimpl AuthN: Embed an OAuth2 server for external service authentication (#68086) 2023-05-25 15:38:30 +02:00
actest AuthN: Embed an OAuth2 server for external service authentication (#68086) 2023-05-25 15:38:30 +02:00
api RBAC: Remove legacy ac from authorization middleware (#68898) 2023-05-24 09:49:42 +01:00
database Schema: Add schema for role+access policies (#68047) 2023-05-24 10:31:57 -07:00
mock RBAC: Add a function to delete external service roles (#68317) 2023-05-16 15:01:27 +02:00
ossaccesscontrol RBAC: inherit folder permissions when resolving managed permissions (#62244) 2023-01-30 14:19:42 +00:00
pluginutils Plugins: Migrate licensing and access control to pkg/services/pluginsintegration package (#65258) 2023-03-27 11:15:37 +02:00
resourcepermissions RBAC: Remove legacy ac from authorization middleware (#68898) 2023-05-24 09:49:42 +01:00
accesscontrol_test.go AuthN: Embed an OAuth2 server for external service authentication (#68086) 2023-05-25 15:38:30 +02:00
accesscontrol.go AuthN: Embed an OAuth2 server for external service authentication (#68086) 2023-05-25 15:38:30 +02:00
checker_test.go Chore: Fix goimports grouping (#62426) 2023-01-30 09:34:18 +01:00
checker.go RBAC: Permission check performance improvements for the new search (#60729) 2023-01-27 12:12:30 +00:00
errors.go RBAC: Add a function to save external service roles (#66299) 2023-05-09 13:19:38 +02:00
evaluator_test.go RBAC: Split up service into several components (#54002) 2022-08-24 13:29:17 +02:00
evaluator.go Perfomance: add preallocation for some slices (#59263) 2022-11-28 13:10:24 +01:00
filter_bench_test.go Chore: Remove Result field from datasources (#63048) 2023-02-09 15:49:44 +01:00
filter_test.go Chore: Remove Result field from datasources (#63048) 2023-02-09 15:49:44 +01:00
filter.go RBAC: Improve performance of dashboard filter query (#56813) 2022-10-25 11:14:27 +02:00
metadata_bench_test.go RBAC: Add function to generate wildcards from prefix (#54275) 2022-08-26 17:10:35 +02:00
metadata_test.go RBAC: Add function to generate wildcards from prefix (#54275) 2022-08-26 17:10:35 +02:00
metadata.go RBAC: Add function to generate wildcards from prefix (#54275) 2022-08-26 17:10:35 +02:00
middleware_test.go RBAC: Remove legacy ac from authorization middleware (#68898) 2023-05-24 09:49:42 +01:00
middleware.go RBAC: Remove legacy ac from authorization middleware (#68898) 2023-05-24 09:49:42 +01:00
models_test.go RBAC: Refine validation of external services permissions (#68633) 2023-05-17 16:28:14 +02:00
models.go AuthN: Embed an OAuth2 server for external service authentication (#68086) 2023-05-25 15:38:30 +02:00
resolvers_test.go Chore: Fix goimports grouping (#62426) 2023-01-30 09:34:18 +01:00
resolvers.go RBAC: Allow role registration for plugins (#57387) 2022-11-07 11:30:45 +01:00
roles_test.go AccessControl: Remove package lists for roles and grants (#47141) 2022-04-06 09:31:14 +02:00
roles.go SAML: change the config option for making SAML UI accessible to org Admins (#67399) 2023-04-28 11:48:26 +01:00
scope_test.go RBAC: Add function to generate wildcards from prefix (#54275) 2022-08-26 17:10:35 +02:00
scope.go RBAC: Permission check performance improvements for the new search (#60729) 2023-01-27 12:12:30 +00:00