Skip to content

chore: add query to fetch top level idp claim fields #15525

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Nov 18, 2024
Merged

chore: add query to fetch top level idp claim fields #15525

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
1ae65f3
chore: add query to fetch top level idp claim fields
Emyrk Nov 14, 2024
c9df165
chore: add unit test to verify OIDCClaims query
Emyrk Nov 14, 2024
1189fe7
add api endpoints
Emyrk Nov 14, 2024
91d0eba
make gen
Emyrk Nov 14, 2024
406faba
dbauthz tests
Emyrk Nov 14, 2024
33c0bc4
linting
Emyrk Nov 14, 2024
2e95753
fix public schema
Emyrk Nov 14, 2024
1648c22
fixup! fix public schema
Emyrk Nov 14, 2024
2dae39b
fmt
Emyrk Nov 14, 2024
2ee2d62
fixup comment
Emyrk Nov 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
fixup comment
  • Loading branch information
@Emyrk
Emyrk committed Nov 18, 2024
commit 2ee2d62ed50257bea52014384e54f59fb64f3de4
27 changes: 27 additions & 0 deletions coderd/database/oidcclaims_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,10 @@ func TestOIDCClaims(t *testing.T) {
"alice-id": "from-bob",
},
UserInfoClaims: nil,
MergedClaims: map[string]interface{}{
"sub": "alice",
"alice-id": "from-bob",
},
},
// Always should be a no-op
Foo: "bar",
Expand All @@ -62,6 +66,20 @@ func TestOIDCClaims(t *testing.T) {
"bob-info": []string{},
"number": 42,
},
MergedClaims: map[string]interface{}{
"sub": "bob",
"bob-info": []string{},
"number": 42,
"bob-id": "from-bob",
"array": []string{
"a", "b", "c",
},
"map": map[string]interface{}{
"key": "value",
"foo": "bar",
},
"nil": nil,
},
}))
charlie := g.withLink(database.LoginTypeOIDC, toJSON(database.UserLinkClaims{
IDTokenClaims: map[string]interface{}{
Expand All @@ -72,6 +90,11 @@ func TestOIDCClaims(t *testing.T) {
"sub": "charlie",
"charlie-info": "charlie",
},
MergedClaims: map[string]interface{}{
"sub": "charlie",
"charlie-id": "charlie",
"charlie-info": "charlie",
},
}))

// users that just try to cause problems, but should not affect the output of
Expand All @@ -89,6 +112,10 @@ func TestOIDCClaims(t *testing.T) {
UserInfoClaims: map[string]interface{}{
"do-not": "look",
},
MergedClaims: map[string]interface{}{
"not": "allowed",
"do-not": "look",
},
})), // github should be omitted

// extra random users
Expand Down
3 changes: 1 addition & 2 deletions coderd/database/querier.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

26 changes: 4 additions & 22 deletions coderd/database/queries.sql.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

26 changes: 4 additions & 22 deletions coderd/database/queries/user_links.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,36 +60,18 @@ WHERE


-- name: OIDCClaimFields :many
-- OIDCClaimFields returns a list of distinct keys in both the id_token_claims and user_info_claims fields.
-- OIDCClaimFields returns a list of distinct keys in the the merged_claims fields.
-- This query is used to generate the list of available sync fields for idp sync settings.
SELECT
DISTINCT jsonb_object_keys(claims->'id_token_claims')
DISTINCT jsonb_object_keys(claims->'merged_claims')
FROM
user_links
WHERE
-- Only return rows where the top level key exists
claims ? 'id_token_claims' AND
claims ? 'merged_claims' AND
-- 'null' is the default value for the id_token_claims field
-- jsonb 'null' is not the same as SQL NULL. Strip these out.
jsonb_typeof(claims->'id_token_claims') != 'null' AND
login_type = 'oidc'
AND CASE WHEN @organization_id :: uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN
user_links.user_id = ANY(SELECT organization_members.user_id FROM organization_members WHERE organization_id = @organization_id)
ELSE true
END

-- Merge with user_info claims.
UNION

-- This query is identical to the one above, except for 'user_info_claims'.
-- There might be some way to do this more concisely at a cost of readability.
SELECT
DISTINCT jsonb_object_keys(claims->'user_info_claims')
FROM
user_links
WHERE
claims ? 'user_info_claims' AND
jsonb_typeof(claims->'user_info_claims') != 'null' AND
jsonb_typeof(claims->'merged_claims') != 'null' AND
login_type = 'oidc'
AND CASE WHEN @organization_id :: uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN
user_links.user_id = ANY(SELECT organization_members.user_id FROM organization_members WHERE organization_id = @organization_id)
Expand Down
7 changes: 0 additions & 7 deletions coderd/userauth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1395,13 +1395,6 @@ func mergeClaims(a, b map[string]interface{}) map[string]interface{} {
return c
}

// OauthDebugContext provides helpful information for admins to debug
// OAuth login issues.
type OauthDebugContext struct {
IDTokenClaims map[string]interface{} `json:"id_token_claims"`
UserInfoClaims map[string]interface{} `json:"user_info_claims"`
}

type oauthLoginParams struct {
User database.User
Link database.UserLink
Expand Down
Loading