Commit Graph

8 Commits

Author SHA1 Message Date
Steffen Baarsgaard b047175330
Auth: Support JWT configs `tls_client_ca` and `jwk_set_bearer_token_file` (#109095)
* Auth.jwt: Support config tls_client_ca

* Auth.jwt: Support config jwk_set_bearer_token_file

* Docs: Document new JWKS url options and mention tls_skip_verify_insecure

* Docs: Fix note on JWKS response caching

* chore: Refactor getBearerToken into standalone function

* docs: Apply wording/formatting suggestions

Co-authored-by: Victor Cinaglia <victorcinaglia@gmail.com>

* chore: Simplify ca helper function using testcerts

Co-authored-by: Victor Cinaglia <victorcinaglia@gmail.com>

* chore: Update doc and add comment preventing potential erroneous optimization

Co-authored-by: Victor Cinaglia <victorcinaglia@gmail.com>

chore: Reword comment prevent an erroneous refactor

* docs: Update casing

Co-authored-by: Victor Cinaglia <victorcinaglia@gmail.com>

---------

Co-authored-by: Victor Cinaglia <victorcinaglia@gmail.com>
2025-08-26 09:50:06 -03:00
Quentin Bisson aeca9a80a4
JWT: Add org role mapping support to the JWT provider (#101584)
* add org role mapping to the jwt provider

* Fix indentation for OrgMapping assignment

* add-test

* fix linting

* add org_attribute_path

* fix test

* update doc

* update doc

* Update pkg/services/authn/clients/jwt.go

* Update docs

---------

Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com>
2025-03-21 14:18:53 +01:00
Filip "Ret2Me" Poplewski 561156c4da
Auth: Add support for the TlsSkipVerify parameter to JWT Auth (#91514)
* feat(auth/JWTAuth): add support for the TlsSkipVerify parameter

* feat(auth/JWTAuth): add param to default.ini and sample.ini

---------

Co-authored-by: Mihaly Gyongyosi <mgyongyosi@users.noreply.github.com>
2025-03-03 11:18:14 +02:00
Charandas c210617735
K8s: use contexthandler in standalone handler chain (#90102) 2024-07-08 12:22:10 -07:00
Charandas a9da6ce1d5
ext_jwt: streamline expected aud in access tokens and id tokens (#87401) 2024-05-07 11:20:16 -07:00
Jo 5340a6e548
Auth: Extended JWT client for OBO and Service Authentication (#83814)
* reenable ext-jwt-client

* fixup settings struct

* add user and service auth

* lint up

* add user auth to grafana ext

* fixes

* Populate token permissions

Co-authored-by: jguer <joao.guerreiro@grafana.com>

* fix tests

* fix lint

* small prealloc

* small prealloc

* use special namespace for access policies

* fix access policy auth

* fix tests

* fix uncalled settings expander

* add feature toggle

* small feedback fixes

* rename entitlements to permissions

* add authlibn

* allow viewing the signed in user info for non user namespace

* fix invalid namespacedID

* use authlib as verifier for tokens

* Update pkg/services/authn/clients/ext_jwt.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* Update pkg/services/authn/clients/ext_jwt_test.go

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

* fix parameter names

* change asserts to normal package

* add rule for assert

* fix ownerships

* Local diff

* test and lint

* Fix test

* Fix ac test

* Fix pluginproxy test

* Revert testdata changes

* Force revert on test data

---------

Co-authored-by: gamab <gabriel.mabille@grafana.com>
Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>
2024-04-02 17:45:15 +02:00
linoman e4250a72db
JWT: Find login and email claims with JMESPATH (#85305)
* add function to static function to static service

* find email and login claims with jmespath

* rename configuration files

* Replace JWTClaims struct for map

* check for subclaims error
2024-03-28 17:25:26 +01:00
Jo 6f62d970e3
JWT Authentication: Add support for specifying groups in auth.jwt for teamsync (#82175)
* merge JSON search logic

* document public methods

* improve test coverage

* use separate JWT setting struct

* correct use of cfg.JWTAuth

* add group tests

* fix DynMap typing

* add settings to default ini

* add groups option to devenv path

* fix test

* lint

* revert jwt-proxy change

* remove redundant check

* fix parallel test
2024-02-09 16:35:58 +01:00