auth.gitlab: account for role_attribute_path_strict (grafana#50088)

wybczu · Jun 3, 2022 · 6c7b6a7 · 6c7b6a7
1 parent a165b40
commit 6c7b6a7
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 7 deletions.
diff --git a/pkg/login/social/gitlab_oauth.go b/pkg/login/social/gitlab_oauth.go
@@ -2,6 +2,7 @@ package social
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"regexp"
@@ -13,9 +14,10 @@ import (
 
 type SocialGitlab struct {
 	*SocialBase
-	allowedGroups     []string
-	apiUrl            string
-	roleAttributePath string
+	allowedGroups       []string
+	apiUrl              string
+	roleAttributePath   string
+	roleAttributeStrict bool
 }
 
 func (s *SocialGitlab) Type() int {
@@ -119,6 +121,9 @@ func (s *SocialGitlab) UserInfo(client *http.Client, token *oauth2.Token) (*Basi
 	if err != nil {
 		s.log.Error("Failed to extract role", "error", err)
 	}
+	if s.roleAttributeStrict && !models.RoleType(role).IsValid() {
+		return nil, errors.New("invalid role")
+	}
 
 	userInfo := &BasicUserInfo{
 		Id:     fmt.Sprintf("%d", data.Id),

diff --git a/pkg/login/social/social.go b/pkg/login/social/social.go
@@ -130,10 +130,11 @@ func ProvideService(cfg *setting.Cfg) *SocialService {
 		// GitLab.
 		if name == "gitlab" {
 			ss.socialMap["gitlab"] = &SocialGitlab{
-				SocialBase:        newSocialBase(name, &config, info),
-				apiUrl:            info.ApiUrl,
-				allowedGroups:     util.SplitString(sec.Key("allowed_groups").String()),
-				roleAttributePath: info.RoleAttributePath,
+				SocialBase:          newSocialBase(name, &config, info),
+				apiUrl:              info.ApiUrl,
+				allowedGroups:       util.SplitString(sec.Key("allowed_groups").String()),
+				roleAttributePath:   info.RoleAttributePath,
+				roleAttributeStrict: info.RoleAttributeStrict,
 			}
 		}