Skip to content

N
nexpie-grafana-theme
Commit f2fc7aa3 by Alexander Zobnin Committed by GitHub
Options

Azure OAuth: enable teamsync (#22160) 

* Azure OAuth: extract groups from token for teamsync

* Docs: changed some headers

* Azure OAuth: fix tests

* Azure OAuth: fix linter error (simplify)

* Azure OAuth: add allowed_groups option

* Azure OAuth: docs for team sync and allowed_groups

* Azure OAuth: tests for allowed_groups

* Update docs/sources/auth/azuread.md

Co-Authored-By: Leonard Gram <leo@xlson.com>

Co-authored-by: Leonard Gram <leo@xlson.com>
parent 961cb6b2
Showing with 132 additions and 26 deletions
conf/defaults.ini
...@@ -376,6 +376,8 @@ client_secret = some_client_secret ...@@ -376,6 +376,8 @@ client_secret = some_client_secret
scopes = openid email profile scopes = openid email profile
auth_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize auth_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize
token_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token token_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
allowed_domains =
allowed_groups =
#################################### Generic OAuth ####################### #################################### Generic OAuth #######################
[auth.generic_oauth] [auth.generic_oauth]
......
conf/sample.ini
...@@ -366,6 +366,8 @@ ...@@ -366,6 +366,8 @@
;scopes = openid email profile ;scopes = openid email profile
;auth_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize ;auth_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize
;token_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token ;token_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
;allowed_domains =
;allowed_groups =
#################################### Generic OAuth ########################## #################################### Generic OAuth ##########################
[auth.generic_oauth] [auth.generic_oauth]
......
docs/sources/auth/azuread.md
+++ +++
title = "Azure AD OAuth2 Authentication" title = "Azure AD OAuth2 authentication"
description = "Grafana OAuthentication Guide " description = "Grafana Azure AD OAuth Guide "
keywords = ["grafana", "configuration", "documentation", "oauth"] keywords = ["grafana", "configuration", "documentation", "oauth"]
type = "docs" type = "docs"
[menu.docs] [menu.docs]
...@@ -10,16 +10,14 @@ parent = "authentication" ...@@ -10,16 +10,14 @@ parent = "authentication"
weight = 3 weight = 3
+++ +++
# Azure AD OAuth2 Authentication # Azure AD OAuth2 authentication
The Azure AD authentication provides the possibility to use an Azure Active Directory tenant as an identity provider for Grafana. The Azure AD authentication provides the possibility to use an Azure Active Directory tenant as an identity provider for Grafana. By using Azure AD Application Roles it is also possible to assign Users and Groups to Grafana roles from the Azure Portal.
By using Azure AD Application Roles it is also possible to assign Users and Groups to Grafana roles from the Azure Portal. ## Create the Azure AD application
To enable the Azure AD OAuth2 you must register your application with Azure AD. To enable the Azure AD OAuth2 you must register your application with Azure AD.
# Create Azure AD application
1. Log in to [Azure Portal](https://portal.azure.com) and click **Azure Active Directory** in the side menu. 1. Log in to [Azure Portal](https://portal.azure.com) and click **Azure Active Directory** in the side menu.
1. Click **App Registrations** and add a new application registration: 1. Click **App Registrations** and add a new application registration:
...@@ -92,6 +90,8 @@ To enable the Azure AD OAuth2 you must register your application with Azure AD. ...@@ -92,6 +90,8 @@ To enable the Azure AD OAuth2 you must register your application with Azure AD.
1. Click on **Users and groups** and add Users/Groups to the Grafana roles by using **Add User**. 1. Click on **Users and groups** and add Users/Groups to the Grafana roles by using **Add User**.
## Enable Azure AD Oauth in Grafana
1. Add the following to the [Grafana configuration file]({{< relref "../installation/configuration.md#config-file-locations" >}}): 1. Add the following to the [Grafana configuration file]({{< relref "../installation/configuration.md#config-file-locations" >}}):
```ini ```ini
...@@ -104,6 +104,35 @@ client_secret = CLIENT_SECRET ...@@ -104,6 +104,35 @@ client_secret = CLIENT_SECRET
scopes = openid email profile scopes = openid email profile
auth_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize auth_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/authorize
token_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token token_url = https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token
allowed_domains =
allowed_groups =
``` ```
> Note: Ensure that the [root_url]({{< relref "../installation/configuration/#root-url" >}}) in Grafana is set in your Azure Application Reply URLs (App -> Settings -> Reply URLs) > Note: Ensure that the [root_url]({{< relref "../installation/configuration/#root-url" >}}) in Grafana is set in your Azure Application Reply URLs (App -> Settings -> Reply URLs)
### Configure allowed groups and domains
To limit access to authenticated users that are members of one or more groups, set `allowed_groups`
to a comma- or space-separated list of group Object Ids. Object Id for a specific group can be found on the Azure portal: go to Azure Active Directory -> Groups. For instance, if you want to
only give access to members of the group `example` which has Id `8bab1c86-8fba-33e5-2089-1d1c80ec267d`, set
```ini
allowed_groups = 8bab1c86-8fba-33e5-2089-1d1c80ec267d
```
The `allowed_domains` option limits access to the users belonging to the specific domains. Domains should be separated by space or comma.
```ini
allowed_domains = mycompany.com mycompany.org
```
### Team Sync (Enterprise only)
> Only available in Grafana Enterprise v6.7+
With Team Sync you can map your Azure AD groups to teams in Grafana so that your users will automatically be added to
the correct teams.
Azure AD groups can be referenced by group Object Id, like `8bab1c86-8fba-33e5-2089-1d1c80ec267d`.
[Learn more about Team Sync]({{< relref "team-sync.md" >}})
pkg/login/social/azuread_oauth.go
...@@ -15,6 +15,7 @@ import ( ...@@ -15,6 +15,7 @@ import (
type SocialAzureAD struct { type SocialAzureAD struct {
*SocialBase *SocialBase
allowedDomains []string allowedDomains []string
allowedGroups []string
allowSignup bool allowSignup bool
} }
...@@ -22,6 +23,7 @@ type azureClaims struct { ...@@ -22,6 +23,7 @@ type azureClaims struct {
Email string `json:"email"` Email string `json:"email"`
PreferredUsername string `json:"preferred_username"` PreferredUsername string `json:"preferred_username"`
Roles []string `json:"roles"` Roles []string `json:"roles"`
Groups []string `json:"groups"`
Name string `json:"name"` Name string `json:"name"`
ID string `json:"oid"` ID string `json:"oid"`
} }
...@@ -62,15 +64,37 @@ func (s *SocialAzureAD) UserInfo(_ *http.Client, token *oauth2.Token) (*BasicUse ...@@ -62,15 +64,37 @@ func (s *SocialAzureAD) UserInfo(_ *http.Client, token *oauth2.Token) (*BasicUse
role := extractRole(claims) role := extractRole(claims)
groups := extractGroups(claims)
if !s.IsGroupMember(groups) {
return nil, ErrMissingGroupMembership
}
return &BasicUserInfo{ return &BasicUserInfo{
Id: claims.ID, Id: claims.ID,
Name: claims.Name, Name: claims.Name,
Email: email, Email: email,
Login: email, Login: email,
Role: string(role), Role: string(role),
Groups: groups,
}, nil }, nil
} }
func (s *SocialAzureAD) IsGroupMember(groups []string) bool {
if len(s.allowedGroups) == 0 {
return true
}
for _, allowedGroup := range s.allowedGroups {
for _, group := range groups {
if group == allowedGroup {
return true
}
}
}
return false
}
func extractEmail(claims azureClaims) string { func extractEmail(claims azureClaims) string {
if claims.Email == "" { if claims.Email == "" {
if claims.PreferredUsername != "" { if claims.PreferredUsername != "" {
...@@ -109,3 +133,9 @@ func hasRole(roles []string, role models.RoleType) bool { ...@@ -109,3 +133,9 @@ func hasRole(roles []string, role models.RoleType) bool {
} }
return false return false
} }
func extractGroups(claims azureClaims) []string {
groups := make([]string, 0)
groups = append(groups, claims.Groups...)
return groups
}
pkg/login/social/azuread_oauth_test.go
package social package social
import ( import (
"golang.org/x/oauth2"
"gopkg.in/square/go-jose.v2"
"gopkg.in/square/go-jose.v2/jwt"
"net/http" "net/http"
"reflect" "reflect"
"testing" "testing"
"time" "time"
"golang.org/x/oauth2"
"gopkg.in/square/go-jose.v2"
"gopkg.in/square/go-jose.v2/jwt"
) )
func TestSocialAzureAD_UserInfo(t *testing.T) { func TestSocialAzureAD_UserInfo(t *testing.T) {
type fields struct { type fields struct {
SocialBase *SocialBase SocialBase *SocialBase
allowedDomains []string allowedDomains []string
allowedGroups []string
allowSignup bool allowSignup bool
} }
type args struct { type args struct {
...@@ -44,7 +46,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { ...@@ -44,7 +46,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) {
Login: "me@example.com", Login: "me@example.com",
Company: "", Company: "",
Role: "Viewer", Role: "Viewer",
Groups: nil, Groups: []string{},
}, },
}, },
{ {
...@@ -81,7 +83,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { ...@@ -81,7 +83,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) {
Login: "me@example.com", Login: "me@example.com",
Company: "", Company: "",
Role: "Viewer", Role: "Viewer",
Groups: nil, Groups: []string{},
}, },
}, },
{ {
...@@ -100,7 +102,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { ...@@ -100,7 +102,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) {
Login: "me@example.com", Login: "me@example.com",
Company: "", Company: "",
Role: "Admin", Role: "Admin",
Groups: nil, Groups: []string{},
}, },
}, },
{ {
...@@ -119,7 +121,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { ...@@ -119,7 +121,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) {
Login: "me@example.com", Login: "me@example.com",
Company: "", Company: "",
Role: "Admin", Role: "Admin",
Groups: nil, Groups: []string{},
}, },
}, },
{ {
...@@ -138,7 +140,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { ...@@ -138,7 +140,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) {
Login: "me@example.com", Login: "me@example.com",
Company: "", Company: "",
Role: "Viewer", Role: "Viewer",
Groups: nil, Groups: []string{},
}, },
}, },
...@@ -158,7 +160,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { ...@@ -158,7 +160,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) {
Login: "me@example.com", Login: "me@example.com",
Company: "", Company: "",
Role: "Editor", Role: "Editor",
Groups: nil, Groups: []string{},
}, },
}, },
{ {
...@@ -177,7 +179,46 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { ...@@ -177,7 +179,46 @@ func TestSocialAzureAD_UserInfo(t *testing.T) {
Login: "me@example.com", Login: "me@example.com",
Company: "", Company: "",
Role: "Admin", Role: "Admin",
Groups: nil, Groups: []string{},
},
},
{
name: "Error if user is not a member of allowed_groups",
fields: fields{
allowedGroups: []string{"dead-beef"},
},
claims: &azureClaims{
Email: "me@example.com",
PreferredUsername: "",
Roles: []string{},
Groups: []string{"foo", "bar"},
Name: "My Name",
ID: "1234",
},
want: nil,
wantErr: true,
},
{
name: "Error if user is a member of allowed_groups",
fields: fields{
allowedGroups: []string{"foo", "bar"},
},
claims: &azureClaims{
Email: "me@example.com",
PreferredUsername: "",
Roles: []string{},
Groups: []string{"foo"},
Name: "My Name",
ID: "1234",
},
want: &BasicUserInfo{
Id: "1234",
Name: "My Name",
Email: "me@example.com",
Login: "me@example.com",
Company: "",
Role: "Viewer",
Groups: []string{"foo"},
}, },
}, },
} }
...@@ -186,6 +227,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) { ...@@ -186,6 +227,7 @@ func TestSocialAzureAD_UserInfo(t *testing.T) {
s := &SocialAzureAD{ s := &SocialAzureAD{
SocialBase: tt.fields.SocialBase, SocialBase: tt.fields.SocialBase,
allowedDomains: tt.fields.allowedDomains, allowedDomains: tt.fields.allowedDomains,
allowedGroups: tt.fields.allowedGroups,
allowSignup: tt.fields.allowSignup, allowSignup: tt.fields.allowSignup,
} }
......
pkg/login/social/common.go
...@@ -9,6 +9,10 @@ import ( ...@@ -9,6 +9,10 @@ import (
"github.com/grafana/grafana/pkg/infra/log" "github.com/grafana/grafana/pkg/infra/log"
) )
var (
ErrMissingGroupMembership = &Error{"User not a member of one of the required groups"}
)
type HttpGetResponse struct { type HttpGetResponse struct {
Body []byte Body []byte
Headers http.Header Headers http.Header
......
pkg/login/social/gitlab_oauth.go
...@@ -19,10 +19,6 @@ type SocialGitlab struct { ...@@ -19,10 +19,6 @@ type SocialGitlab struct {
allowSignup bool allowSignup bool
} }
var (
ErrMissingGroupMembership = &Error{"User not a member of one of the required groups"}
)
func (s *SocialGitlab) Type() int { func (s *SocialGitlab) Type() int {
return int(models.GITLAB) return int(models.GITLAB)
} }
......
pkg/login/social/social.go
...@@ -160,6 +160,7 @@ func NewOAuthService() { ...@@ -160,6 +160,7 @@ func NewOAuthService() {
log: logger, log: logger,
}, },
allowedDomains: info.AllowedDomains, allowedDomains: info.AllowedDomains,
allowedGroups: util.SplitString(sec.Key("allowed_groups").String()),
allowSignup: info.AllowSignup, allowSignup: info.AllowSignup,
} }
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment