Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Auth: Move LDAP debug to Authentication menu #71285

Merged
merged 2 commits into from Jul 12, 2023
Merged

Auth: Move LDAP debug to Authentication menu #71285

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8924208
move LDAP page to Authentication
Jguer Jul 10, 2023
08aa6f1
tweak Auth menu showing permissions
Jguer Jul 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
14 changes: 9 additions & 5 deletions pkg/api/api.go
View file
Open in desktop
Expand Up @@ -106,7 +106,7 @@ func (hs *HTTPServer) registerRoutes() {
r.Get("/admin/orgs", authorizeInOrg(ac.UseGlobalOrg, ac.OrgsAccessEvaluator), hs.Index)
r.Get("/admin/orgs/edit/:id", authorizeInOrg(ac.UseGlobalOrg, ac.OrgsAccessEvaluator), hs.Index)
r.Get("/admin/stats", authorize(ac.EvalPermission(ac.ActionServerStatsRead)), hs.Index)
r.Get("/admin/ldap", authorize(ac.EvalPermission(ac.ActionLDAPStatusRead)), hs.Index)
r.Get("/admin/authentication/ldap", authorize(ac.EvalPermission(ac.ActionLDAPStatusRead)), hs.Index)
if hs.Features.IsEnabled(featuremgmt.FlagStorage) {
r.Get("/admin/storage", reqSignedIn, hs.Index)
r.Get("/admin/storage/*", reqSignedIn, hs.Index)
Expand Down Expand Up @@ -213,10 +213,7 @@ func (hs *HTTPServer) registerRoutes() {
r.Get("/user/auth-tokens/rotate", routing.Wrap(hs.RotateUserAuthTokenRedirect))
}

if hs.License.FeatureEnabled("saml") {
// TODO change the scope when we extend the auth UI to more providers
r.Get("/admin/authentication/", authorize(ac.EvalPermission(ac.ActionSettingsWrite, ac.ScopeSettingsSAML)), hs.Index)
}
r.Get("/admin/authentication/", authorize(evalAuthenticationSettings()), hs.Index)

// authed api
r.Group("/api", func(apiRoute routing.RouteRegister) {
Expand Down Expand Up @@ -649,3 +646,10 @@ func (hs *HTTPServer) registerRoutes() {
r.Get("/api/snapshots-delete/:deleteKey", reqSnapshotPublicModeOrSignedIn, routing.Wrap(hs.DeleteDashboardSnapshotByDeleteKey))
r.Delete("/api/snapshots/:key", reqSignedIn, routing.Wrap(hs.DeleteDashboardSnapshot))
}

func evalAuthenticationSettings() ac.Evaluator {
return ac.EvalAny(ac.EvalAll(
ac.EvalPermission(ac.ActionSettingsWrite, ac.ScopeSettingsSAML),
ac.EvalPermission(ac.ActionSettingsRead, ac.ScopeSettingsSAML),
), ac.EvalPermission(ac.ActionLDAPStatusRead))
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one issue that this PR raises is to have the ScopeSettingsLDAP ready. could we add that as a follow up issue ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 you want me to do it?

10 changes: 2 additions & 8 deletions pkg/services/navtree/navtreeimpl/admin.go
View file
Open in desktop
Expand Up @@ -121,12 +121,6 @@ func (s *ServiceImpl) getAdminNode(c *contextmodel.ReqContext) (*navtree.NavLink
})
}

if s.cfg.LDAPAuthEnabled && hasAccess(ac.EvalPermission(ac.ActionLDAPStatusRead)) {
configNodes = append(configNodes, &navtree.NavLink{
Text: "LDAP", Id: "ldap", Url: s.cfg.AppSubURL + "/admin/ldap", Icon: "book",
})
}

if hasAccess(ac.EvalPermission(ac.ActionSettingsRead, ac.ScopeSettingsAll)) && s.features.IsEnabled(featuremgmt.FlagStorage) {
storage := &navtree.NavLink{
Text: "Storage",
Expand Down Expand Up @@ -157,8 +151,8 @@ func enableServiceAccount(s *ServiceImpl, c *contextmodel.ReqContext) bool {
}

func evalAuthenticationSettings() ac.Evaluator {
return ac.EvalAll(
return ac.EvalAny(ac.EvalAll(
ac.EvalPermission(ac.ActionSettingsWrite, ac.ScopeSettingsSAML),
ac.EvalPermission(ac.ActionSettingsRead, ac.ScopeSettingsSAML),
)
), ac.EvalPermission(ac.ActionLDAPStatusRead))
}
2 changes: 1 addition & 1 deletion public/app/features/admin/UserLdapSyncInfo.tsx
View file
Open in desktop
Expand Up @@ -14,7 +14,7 @@ interface Props {
interface State {}

const format = 'dddd YYYY-MM-DD HH:mm zz';
const debugLDAPMappingBaseURL = '/admin/ldap';
const debugLDAPMappingBaseURL = '/admin/authentication/ldap';

export class UserLdapSyncInfo extends PureComponent<Props, State> {
onUserSync = () => {
Expand Down
16 changes: 10 additions & 6 deletions public/app/features/admin/ldap/LdapPage.tsx
View file
Open in desktop
@@ -1,14 +1,13 @@
import React, { PureComponent } from 'react';
import { connect, ConnectedProps } from 'react-redux';

import { NavModel } from '@grafana/data';
import { NavModelItem } from '@grafana/data';
import { featureEnabled } from '@grafana/runtime';
import { Alert, Button, LegacyForms } from '@grafana/ui';
const { FormField } = LegacyForms;
import { Page } from 'app/core/components/Page/Page';
import { contextSrv } from 'app/core/core';
import { GrafanaRouteComponentProps } from 'app/core/navigation/types';
import { getNavModel } from 'app/core/selectors/navModel';
import {
AppNotificationSeverity,
LdapError,
Expand All @@ -32,7 +31,6 @@ import { LdapSyncInfo } from './LdapSyncInfo';
import { LdapUserInfo } from './LdapUserInfo';

interface OwnProps extends GrafanaRouteComponentProps<{}, { username?: string }> {
navModel: NavModel;
ldapConnectionInfo: LdapConnectionInfo;
ldapUser?: LdapUser;
ldapSyncInfo?: SyncInfo;
Expand All @@ -44,6 +42,13 @@ interface State {
isLoading: boolean;
}

const pageNav: NavModelItem = {
text: 'LDAP',
subTitle: `Verify your LDAP and user mapping configuration.`,
icon: 'book',
id: 'LDAP',
};

export class LdapPage extends PureComponent<Props, State> {
state = {
isLoading: true,
Expand Down Expand Up @@ -84,12 +89,12 @@ export class LdapPage extends PureComponent<Props, State> {
};

render() {
const { ldapUser, userError, ldapError, ldapSyncInfo, ldapConnectionInfo, navModel, queryParams } = this.props;
const { ldapUser, userError, ldapError, ldapSyncInfo, ldapConnectionInfo, queryParams } = this.props;
const { isLoading } = this.state;
const canReadLDAPUser = contextSrv.hasPermission(AccessControlAction.LDAPUsersRead);

return (
<Page navModel={navModel}>
<Page navId="authentication" pageNav={pageNav}>
<Page.Contents isLoading={isLoading}>
<>
{ldapError && ldapError.title && (
Expand Down Expand Up @@ -143,7 +148,6 @@ export class LdapPage extends PureComponent<Props, State> {
}

const mapStateToProps = (state: StoreState) => ({
navModel: getNavModel(state.navIndex, 'ldap'),
ldapConnectionInfo: state.ldap.connectionInfo,
ldapUser: state.ldap.user,
ldapSyncInfo: state.ldap.syncInfo,
Expand Down
2 changes: 1 addition & 1 deletion public/app/routes/routes.tsx
View file
Open in desktop
Expand Up @@ -377,7 +377,7 @@ export function getAppRoutes(): RouteDescriptor[] {
),
},
{
path: '/admin/ldap',
path: '/admin/authentication/ldap',
component: LdapPage,
},
// LOGIN / SIGNUP
Expand Down