feat: add flag to disable password auth #5991
Conversation
Adds a flag --disable-password-auth that prevents the password login endpoint from working unless the user has the "owner" (aka. site admin) role. Adds a subcommand `coder server create-admin-user` which creates a user directly in the database with the "owner" role, the "admin" role in every organization, and password auth. This is to avoid lock-out situations where all accounts have the login type set to an identity provider and nobody can login.
| @@ -1607,3 +1785,71 @@ func buildLogger(cmd *cobra.Command, cfg *codersdk.DeploymentConfig) (slog.Logge | |||
| } | |||
| }, nil | |||
| } | |||
|
|
|||
| func connectToPostgres(ctx context.Context, logger slog.Logger, driver string, dbURL string) (*sql.DB, error) { | |||
There was a problem hiding this comment.
nit: Maybe extract it to a separate file too?
There was a problem hiding this comment.
I think I'll leave it here for now since it's mostly only used for server.go and makes sense to live here to me.
|
@deansheather - I really appreciate this. One question. I'm not proficient in Go, and I looked over the PR and didn't see it, but when the --disable-password-auth is enabled, does that also cause the automatic redirect of users to the (single) OIDC provider? In other words, avoiding having the user click the one button to go to the provider? The button isn't necessary with a single provider and would allow Coder to have a proper SSO user experience. That was the main goal of the user story in #4433, which this PR is supposed to close. 😀 Scott |
|
@smolinari This PR doesn't do that intentionally as we still allow site owners to login via password auth. We could add an auto-redirect thing later on as long as we have a bypass. @bpmct as per the above comment I'm removing #4433 from this PR. |
|
Ahh my bad, I see the comments above. |
Adds a flag --disable-password-auth that prevents the password login endpoint from working unless the user has the "owner" (aka. site admin) role.
Adds a subcommand
coder server create-admin-userwhich creates a user directly in the database with the "owner" role, the "admin" role in every organization, and password auth. This is to avoid lock-out situations where all accounts have the login type set to an identity provider and nobody can login.Closes #5989
cc: @ElliotG