Skip to content

chore: implement organization sync and create idpsync package #14432

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 23 commits into from
Aug 30, 2024
Merged

chore: implement organization sync and create idpsync package #14432

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
a8d0495
chore: implement filters for the organizations query
Emyrk Aug 28, 2024
d788be7
chore: implement organization sync and create idpsync package
Emyrk Aug 26, 2024
f596da1
chore: refactor into agpl and enterprise
Emyrk Aug 26, 2024
d42772c
compilation fixes
Emyrk Aug 26, 2024
7d3ec14
fix compile issues
Emyrk Aug 26, 2024
9287fb9
trying to figure out how to initialize both AGPL and enterprise
Emyrk Aug 26, 2024
9c12b18
ended up with a global factory funciton
Emyrk Aug 26, 2024
210239f
fixup compile issues
Emyrk Aug 26, 2024
94e05e7
fixup errors
Emyrk Aug 27, 2024
e2badf4
fixup some comments
Emyrk Aug 27, 2024
eb7e2c5
Actually enable org sync in the oidc flow
Emyrk Aug 27, 2024
951a724
test: start implementing sync tests
Emyrk Aug 27, 2024
8350cca
fixup duplicate assignments
Emyrk Aug 27, 2024
d5bf63a
linting
Emyrk Aug 27, 2024
b3144c0
move the config into api options
Emyrk Aug 27, 2024
72b501e
change sqlc version
Emyrk Aug 28, 2024
5216230
some cleanup
Emyrk Aug 28, 2024
e73919e
test: add full org sync tests
Emyrk Aug 28, 2024
e37d476
linting
Emyrk Aug 28, 2024
a8647ce
make gen
Emyrk Aug 28, 2024
02812e4
update golden files
Emyrk Aug 28, 2024
e18bc8f
PR comments
Emyrk Aug 28, 2024
3516008
fmt
Emyrk Aug 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
update golden files
  • Loading branch information
@Emyrk
Emyrk committed Aug 29, 2024
commit 02812e471eaac46eb37f566f3834713aac9e47ba
13 changes: 13 additions & 0 deletions cli/testdata/coder_server_--help.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -433,6 +433,11 @@ OIDC OPTIONS:
groups. This filter is applied after the group mapping and before the
regex filter.

--oidc-organization-assign-default bool, $CODER_OIDC_ORGANIZATION_ASSIGN_DEFAULT (default: true)
If set to true, users will always be added to the default
organization. If organization sync is enabled, then the default org is
always added to the user's set of expectedorganizations.

--oidc-auth-url-params struct[map[string]string], $CODER_OIDC_AUTH_URL_PARAMS (default: {"access_type": "offline"})
OIDC auth URL parameters to pass to the upstream provider.

Expand Down Expand Up @@ -479,6 +484,14 @@ OIDC OPTIONS:
--oidc-name-field string, $CODER_OIDC_NAME_FIELD (default: name)
OIDC claim field to use as the name.

--oidc-organization-field string, $CODER_OIDC_ORGANIZATION_FIELD
This field must be set if using the organization sync feature. Set to
the claim to be used for organizations.

--oidc-organization-mapping struct[map[string][]uuid.UUID], $CODER_OIDC_ORGANIZATION_MAPPING (default: {})
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Is it possible for this to be just map[string][]uuid.UUID?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you explain why we need this instead of solely relying on the --oidc-organization-field? Orgs are uniquely named right?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have to use the type serpent.Struct[map[string][]uuid.UUID] to be compatible with all parsing.

Can you explain why we need this instead of solely relying on the --oidc-organization-field? Orgs are uniquely named right?

I could use names, but that assumes the IDP will use Coder organization names in their claims, which we've found with groups that this almost never the case.

A map of OIDC claims and the organizations in Coder it should map to.
This is required because organization IDs must be used within Coder.

--oidc-group-regex-filter regexp, $CODER_OIDC_GROUP_REGEX_FILTER (default: .*)
If provided any group name not matching the regex is ignored. This
allows for filtering out groups that are not needed. This filter is
Expand Down
13 changes: 13 additions & 0 deletions cli/testdata/server-config.yaml.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -319,6 +319,19 @@ oidc:
# Ignore the userinfo endpoint and only use the ID token for user information.
# (default: false, type: bool)
ignoreUserInfo: false
# This field must be set if using the organization sync feature. Set to the claim
# to be used for organizations.
# (default: <unset>, type: string)
organizationField: ""
# If set to true, users will always be added to the default organization. If
# organization sync is enabled, then the default org is always added to the user's
# set of expectedorganizations.
# (default: true, type: bool)
organizationAssignDefault: true
# A map of OIDC claims and the organizations in Coder it should map to. This is
# required because organization IDs must be used within Coder.
# (default: {}, type: struct[map[string][]uuid.UUID])
organizationMapping: {}
# This field must be set if using the group sync feature and the scope name is not
# 'groups'. Set to the claim to be used for groups.
# (default: <unset>, type: string)
Expand Down
13 changes: 13 additions & 0 deletions enterprise/cli/testdata/coder_server_--help.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -434,6 +434,11 @@ OIDC OPTIONS:
groups. This filter is applied after the group mapping and before the
regex filter.

--oidc-organization-assign-default bool, $CODER_OIDC_ORGANIZATION_ASSIGN_DEFAULT (default: true)
If set to true, users will always be added to the default
organization. If organization sync is enabled, then the default org is
always added to the user's set of expectedorganizations.

--oidc-auth-url-params struct[map[string]string], $CODER_OIDC_AUTH_URL_PARAMS (default: {"access_type": "offline"})
OIDC auth URL parameters to pass to the upstream provider.

Expand Down Expand Up @@ -480,6 +485,14 @@ OIDC OPTIONS:
--oidc-name-field string, $CODER_OIDC_NAME_FIELD (default: name)
OIDC claim field to use as the name.

--oidc-organization-field string, $CODER_OIDC_ORGANIZATION_FIELD
This field must be set if using the organization sync feature. Set to
the claim to be used for organizations.

--oidc-organization-mapping struct[map[string][]uuid.UUID], $CODER_OIDC_ORGANIZATION_MAPPING (default: {})
A map of OIDC claims and the organizations in Coder it should map to.
This is required because organization IDs must be used within Coder.

--oidc-group-regex-filter regexp, $CODER_OIDC_GROUP_REGEX_FILTER (default: .*)
If provided any group name not matching the regex is ignored. This
allows for filtering out groups that are not needed. This filter is
Expand Down