Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Auth: Add Generic oauth skip org role sync setting #62418

Merged
merged 11 commits into from
Feb 1, 2023
Merged

Auth: Add Generic oauth skip org role sync setting #62418

merged 11 commits into from
Feb 1, 2023

Conversation

eleijonmarck
Copy link
Contributor

@eleijonmarck eleijonmarck commented Jan 28, 2023 •
edited
Loading

What is this feature?
This adds the skip_org_role_sync setting for the generic_oauth section of oauth.

  • adds setting for generic oauth to skip org role sync
  • docs
  • added tests for skip role sync
  • added a column name header for "Synced from"

Fixes #
https://github.com/grafana/grafana-enterprise/issues/4235

Special notes for your reviewer:
demo -

@eleijonmarck eleijonmarck added this to the 9.4.0 milestone Jan 28, 2023
@eleijonmarck eleijonmarck modified the milestone: 9.4.0 Jan 31, 2023
eleijonmarck
eleijonmarck commented Jan 31, 2023
View reviewed changes
docs/sources/setup-grafana/configure-grafana/_index.md
@@ -936,10 +936,25 @@ The following table shows the OAuth provider's setting with the default value an
| OAuth Provider | `oauth_skip_org_role_sync_update` | `skip_org_role_sync` | Behavior |
| --- | --- | --- | --- |
| GitLab | false | false | User organization roles are set with `defaultRole` and cannot be changed |
| Github | true | false | User organization roles are set with `defaultRole` for GitLab, and Grafana Admins are set. For other providers, the synchronization is skipped, and the org role can be changed, along with other OAuth provider users' org roles. |
| GitLab | true | false | User organization roles are set with `defaultRole` for GitLab, and Grafana Admins are set. For other providers, the synchronization is skipped, and the org role can be changed, along with other OAuth provider users' org roles. |
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix: typo

eleijonmarck
eleijonmarck commented Jan 31, 2023
View reviewed changes
pkg/services/login/authinfo.go
default:
return "OAuth" // FIXME: replace with "Unknown" and handle generic oauth as a case
return "Unknown"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

now unknown instead of OAuth. Maybe we should still keep "oauth"?

Abivilant here

eleijonmarck
eleijonmarck commented Jan 31, 2023
View reviewed changes
pkg/setting/setting.go
@@ -22,11 +22,12 @@ import (
"time"

"github.com/gobwas/glob"
"github.com/prometheus/common/model"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

go imports

eleijonmarck
eleijonmarck commented Jan 31, 2023
View reviewed changes
public/app/features/admin/UserAdminPage.tsx
@@ -39,8 +39,6 @@ interface OwnProps extends GrafanaRouteComponentProps<{ id: string }> {
error?: UserAdminError;
}

const SyncedOAuthLabels: string[] = ['OAuth'];
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we can now remove this 👍

eleijonmarck
eleijonmarck commented Jan 31, 2023
View reviewed changes
public/app/features/admin/UserListAdminPage.tsx
@@ -150,7 +150,7 @@ const UserListAdminPageUnConnected = ({
<Icon name="question-circle" />
</Tooltip>
</th>
<th style={{ width: '1%' }}></th>
<th style={{ width: '1%' }}>Synced from</th>
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added header for the columns, which provides the synced provider

@eleijonmarck eleijonmarck marked this pull request as ready for review January 31, 2023 12:27
@eleijonmarck eleijonmarck requested review from torkelo and a team as code owners January 31, 2023 12:27
@eleijonmarck eleijonmarck requested a review from a team January 31, 2023 12:27
@eleijonmarck eleijonmarck requested a review from a team as a code owner January 31, 2023 12:27
chri2547
chri2547 reviewed Jan 31, 2023
View reviewed changes
docs/sources/setup-grafana/configure-security/configure-authentication/generic-oauth/index.md
@@ -392,3 +392,16 @@ Payload:
...
}
```

## Skip organization role sync
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@eleijonmarck , the formatting of this text (it's in blue?) makes me think something is incorrect futher up in the doc. Please check Line 220. I think the quotes need to be a > symbol?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice catch! https://github.com/grafana/grafana/pull/62418/files#diff-6f48d0293f506b4c2640e69b3ec00bdfbc40114533042c25a83d26e749dba565R220

should be fixed

Jguer
Jguer reviewed Feb 1, 2023
View reviewed changes
pkg/services/login/authinfo.go
@@ -46,7 +46,9 @@ func GetAuthProviderLabel(authModule string) string {
return "JWT"
case AuthProxyAuthModule:
return "Auth Proxy"
case "oauth_generic_oauth":
return "Generic OAuth"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return "Generic OAuth"
return "OAuth"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so far we follow the configuration "pattern" of the [auth.provider] and then return that value. This would be the "outlier" for that pattern

Thought this would be good for the implementation when we want to have this more configured. I guess this is not really concerning as it is to the frontend.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's revisit this when we refactor!

@eleijonmarck eleijonmarck force-pushed the eleijonmarck/auth/oauth-generic-skip-org-role-sync branch from 67454e4 to 391bf9c Compare February 1, 2023 15:28
@eleijonmarck eleijonmarck merged commit 8ff19bd into main Feb 1, 2023
@eleijonmarck eleijonmarck deleted the eleijonmarck/auth/oauth-generic-skip-org-role-sync branch February 1, 2023 16:27
chri2547
chri2547 reviewed Feb 1, 2023
View reviewed changes
Copy link
Collaborator

@chri2547 chri2547 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved!

@eleijonmarck eleijonmarck modified the milestones: 9.4.0, 9.5.0 Feb 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@chri2547 chri2547 chri2547 left review comments

@Jguer Jguer Jguer approved these changes

@vtorosyan vtorosyan Awaiting requested review from vtorosyan vtorosyan was automatically assigned from grafana/grafana-authnz-team

@alexanderzobnin alexanderzobnin Awaiting requested review from alexanderzobnin alexanderzobnin was automatically assigned from grafana/grafana-authnz-team

@kalleep kalleep Awaiting requested review from kalleep

@IevaVasiljeva IevaVasiljeva Awaiting requested review from IevaVasiljeva

Assignees
No one assigned
Labels
add to changelog area/backend area/frontend enterprise-failed no-backport Skip backport of PR type/docs
Projects
None yet
Milestone
9.5.0
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@eleijonmarck @Jguer @chri2547 @grafanabot