Skip to content

feat: synchronize oidc user roles #8595

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 22 commits into from
Jul 24, 2023
Merged

feat: synchronize oidc user roles #8595

Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
81feea5
feat: oidc user role sync
Emyrk Jul 19, 2023
1e6bd37
allow mapping 1:many
Emyrk Jul 19, 2023
aad5744
Expose user login type via api
Emyrk Jul 19, 2023
f9c7cc5
make gen
Emyrk Jul 19, 2023
a7614e3
Adjust users page to not allow editing roles when they cannot
Emyrk Jul 19, 2023
3fcb55d
Add TOD
Emyrk Jul 19, 2023
89b1b69
Add unit test to test manual role assign
Emyrk Jul 19, 2023
b64e372
Add swagger docs as generated
Emyrk Jul 19, 2023
9fddd5e
add cli generated files as generated
Emyrk Jul 19, 2023
882f93c
Fix import
Emyrk Jul 19, 2023
f092c50
Remove comment
Emyrk Jul 19, 2023
5e3b6f8
Add new entitlement to control this feature
Emyrk Jul 20, 2023
4bf31c0
Linting
Emyrk Jul 20, 2023
3ad152f
not sure what feature enablements are, but required for tests
Emyrk Jul 20, 2023
293a9b0
Merge remote-tracking branch 'origin/main' into stevenmasley/oidc_rol…
Emyrk Jul 20, 2023
b0ae795
Fix merge error
Emyrk Jul 20, 2023
231e47b
Fix unit test
Emyrk Jul 20, 2023
40e362c
Update golden files
Emyrk Jul 20, 2023
bac7743
raise a FE prop field up the stack
Emyrk Jul 20, 2023
6cf15e7
Fix ts type
Emyrk Jul 20, 2023
a2208bb
fixup! Fix ts type
Emyrk Jul 20, 2023
a5227e8
Fix comment
Emyrk Jul 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add unit test to test manual role assign
  • Loading branch information
@Emyrk
Emyrk committed Jul 19, 2023
commit 89b1b69e192033f0fb3093ffef7ee3a442556f3c
40 changes: 39 additions & 1 deletion enterprise/coderd/userauth_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ import (
// nolint:bodyclose
func TestUserOIDC(t *testing.T) {
t.Parallel()
t.Run("Roles", func(t *testing.T) {
t.Run("RoleSync", func(t *testing.T) {
t.Parallel()

t.Run("NewUserAndRemoveRoles", func(t *testing.T) {
Expand Down Expand Up @@ -78,6 +78,44 @@ func TestUserOIDC(t *testing.T) {

require.Len(t, user.Roles, 0)
})
t.Run("BlockAssignRoles", func(t *testing.T) {
t.Parallel()

ctx := testutil.Context(t, testutil.WaitMedium)
conf := coderdtest.NewOIDCConfig(t, "")

config := conf.OIDCConfig(t, jwt.MapClaims{})
config.AllowSignups = true
config.UserRoleField = "roles"

client, _ := coderdenttest.New(t, &coderdenttest.Options{
Options: &coderdtest.Options{
OIDCConfig: config,
},
LicenseOptions: &coderdenttest.LicenseOptions{
Features: license.Features{codersdk.FeatureTemplateRBAC: 1},
},
})

admin, err := client.User(ctx, "me")
require.NoError(t, err)
require.Len(t, admin.OrganizationIDs, 1)

resp := oidcCallback(t, client, conf.EncodeClaims(t, jwt.MapClaims{
"email": "alice@coder.com",
"roles": []string{},
}))
require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
// Try to manually update user roles, even though controlled by oidc
// role sync.
_, err = client.UpdateUserRoles(ctx, "alice", codersdk.UpdateRoles{
Roles: []string{
rbac.RoleTemplateAdmin(),
},
})
require.Error(t, err)
require.ErrorContains(t, err, "Cannot modify roles for OIDC users when role sync is enabled.")
})
})

t.Run("Groups", func(t *testing.T) {
Expand Down