feat: Identity brokering (#730)

* feat: add/ remove external idps * feat: external idp add /remove * fix: auth proto * fix: handle login * feat: loginpolicy on authrequest * feat: idp providers on login * feat: link external idp * fix: check login policy on check username * feat: add mapping fields for idp config * feat: use user org id if existing * feat: use user org id if existing * feat: register external user * feat: register external user * feat: user linking * feat: user linking * feat: design external login * feat: design external login * fix: tests * fix: regenerate login design * feat: next step test linking process * feat: next step test linking process * feat: cascade remove external idps on user * fix: tests * fix: tests * feat: external idp requsts on users * fix: generate protos * feat: login styles * feat: login styles * fix: link user * fix: register user on specifig org * fix: user linking * fix: register external, linking auto * fix: remove unnecessary request from proto * fix: tests * fix: new oidc package * fix: migration version * fix: policy permissions * Update internal/ui/login/static/i18n/en.yaml Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/static/i18n/en.yaml Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/handler/renderer.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/handler/renderer.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: pr requests * Update internal/ui/login/handler/link_users_handler.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: pr requests * fix: pr requests * fix: pr requests * fix: login name size * fix: profile image light * fix: colors * fix: pr requests * fix: remove redirect uri validator * fix: remove redirect uri validator Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2025-08-12 03:57:32 +00:00 · 2020-09-18 13:26:28 +02:00
parent 1d542a0c57
commit 320ddfa46d
141 changed files with 30057 additions and 12535 deletions
--- a/internal/auth/repository/eventsourcing/handler/handler.go
+++ b/internal/auth/repository/eventsourcing/handler/handler.go
@@ -53,6 +53,10 @@ func Register(configs Configs, bulkLimit, errorCount uint64, view *view.View, ev
 			iamEvents:     repos.IamEvents,
 			iamID:         systemDefaults.IamID},
 		&MachineKeys{handler: handler{view, bulkLimit, configs.cycleDuration("MachineKey"), errorCount}},
+		&LoginPolicy{handler: handler{view, bulkLimit, configs.cycleDuration("LoginPolicy"), errorCount}},
+		&IDPConfig{handler: handler{view, bulkLimit, configs.cycleDuration("IDPConfig"), errorCount}},
+		&IDPProvider{handler: handler{view, bulkLimit, configs.cycleDuration("IDPProvider"), errorCount}, systemDefaults: systemDefaults, orgEvents: repos.OrgEvents, iamEvents: repos.IamEvents},
+		&ExternalIDP{handler: handler{view, bulkLimit, configs.cycleDuration("ExternalIDP"), errorCount}, systemDefaults: systemDefaults, orgEvents: repos.OrgEvents, iamEvents: repos.IamEvents},
 	}
 }

--- a/internal/auth/repository/eventsourcing/handler/idp_config.go
+++ b/internal/auth/repository/eventsourcing/handler/idp_config.go
@@ -0,0 +1,82 @@
+package handler
+
+import (
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	es_models "github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/eventstore/spooler"
+	iam_model "github.com/caos/zitadel/internal/iam/model"
+	iam_es_model "github.com/caos/zitadel/internal/iam/repository/eventsourcing/model"
+	iam_view_model "github.com/caos/zitadel/internal/iam/repository/view/model"
+	"github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
+)
+
+type IDPConfig struct {
+	handler
+}
+
+const (
+	idpConfigTable = "auth.idp_configs"
+)
+
+func (m *IDPConfig) ViewModel() string {
+	return idpConfigTable
+}
+
+func (m *IDPConfig) EventQuery() (*models.SearchQuery, error) {
+	sequence, err := m.view.GetLatestIDPConfigSequence()
+	if err != nil {
+		return nil, err
+	}
+	return es_models.NewSearchQuery().
+		AggregateTypeFilter(model.OrgAggregate, iam_es_model.IAMAggregate).
+		LatestSequenceFilter(sequence.CurrentSequence), nil
+}
+
+func (m *IDPConfig) Reduce(event *models.Event) (err error) {
+	switch event.AggregateType {
+	case model.OrgAggregate:
+		err = m.processIdpConfig(iam_model.IDPProviderTypeOrg, event)
+	case iam_es_model.IAMAggregate:
+		err = m.processIdpConfig(iam_model.IDPProviderTypeSystem, event)
+	}
+	return err
+}
+
+func (m *IDPConfig) processIdpConfig(providerType iam_model.IDPProviderType, event *models.Event) (err error) {
+	idp := new(iam_view_model.IDPConfigView)
+	switch event.Type {
+	case model.IDPConfigAdded,
+		iam_es_model.IDPConfigAdded:
+		err = idp.AppendEvent(providerType, event)
+	case model.IDPConfigChanged, iam_es_model.IDPConfigChanged,
+		model.OIDCIDPConfigAdded, iam_es_model.OIDCIDPConfigAdded,
+		model.OIDCIDPConfigChanged, iam_es_model.OIDCIDPConfigChanged:
+		err = idp.SetData(event)
+		if err != nil {
+			return err
+		}
+		idp, err = m.view.IDPConfigByID(idp.IDPConfigID)
+		if err != nil {
+			return err
+		}
+		err = idp.AppendEvent(providerType, event)
+	case model.IDPConfigRemoved, iam_es_model.IDPConfigRemoved:
+		err = idp.SetData(event)
+		if err != nil {
+			return err
+		}
+		return m.view.DeleteIDPConfig(idp.IDPConfigID, event.Sequence)
+	default:
+		return m.view.ProcessedIDPConfigSequence(event.Sequence)
+	}
+	if err != nil {
+		return err
+	}
+	return m.view.PutIDPConfig(idp, idp.Sequence)
+}
+
+func (m *IDPConfig) OnError(event *models.Event, err error) error {
+	logging.LogWithFields("SPOOL-Ejf8s", "id", event.AggregateID).WithError(err).Warn("something went wrong in idp config handler")
+	return spooler.HandleError(event, err, m.view.GetLatestIDPConfigFailedEvent, m.view.ProcessedIDPConfigFailedEvent, m.view.ProcessedIDPConfigSequence, m.errorCountUntilSkip)
+}
--- a/internal/auth/repository/eventsourcing/handler/idp_providers.go
+++ b/internal/auth/repository/eventsourcing/handler/idp_providers.go
@@ -0,0 +1,120 @@
+package handler
+
+import (
+	"context"
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/config/systemdefaults"
+	"github.com/caos/zitadel/internal/iam/repository/eventsourcing"
+	org_es "github.com/caos/zitadel/internal/org/repository/eventsourcing"
+	org_es_model "github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
+
+	"github.com/caos/zitadel/internal/eventstore/models"
+	es_models "github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/eventstore/spooler"
+	iam_model "github.com/caos/zitadel/internal/iam/model"
+	"github.com/caos/zitadel/internal/iam/repository/eventsourcing/model"
+	iam_view_model "github.com/caos/zitadel/internal/iam/repository/view/model"
+)
+
+type IDPProvider struct {
+	handler
+	systemDefaults systemdefaults.SystemDefaults
+	iamEvents      *eventsourcing.IAMEventstore
+	orgEvents      *org_es.OrgEventstore
+}
+
+const (
+	idpProviderTable = "auth.idp_providers"
+)
+
+func (m *IDPProvider) ViewModel() string {
+	return idpProviderTable
+}
+
+func (m *IDPProvider) EventQuery() (*models.SearchQuery, error) {
+	sequence, err := m.view.GetLatestIDPProviderSequence()
+	if err != nil {
+		return nil, err
+	}
+	return es_models.NewSearchQuery().
+		AggregateTypeFilter(model.IAMAggregate, org_es_model.OrgAggregate).
+		LatestSequenceFilter(sequence.CurrentSequence), nil
+}
+
+func (m *IDPProvider) Reduce(event *models.Event) (err error) {
+	switch event.AggregateType {
+	case model.IAMAggregate, org_es_model.OrgAggregate:
+		err = m.processIdpProvider(event)
+	}
+	return err
+}
+
+func (m *IDPProvider) processIdpProvider(event *models.Event) (err error) {
+	provider := new(iam_view_model.IDPProviderView)
+	switch event.Type {
+	case model.LoginPolicyIDPProviderAdded, org_es_model.LoginPolicyIDPProviderAdded:
+		err = provider.AppendEvent(event)
+		if err != nil {
+			return err
+		}
+		err = m.fillData(provider)
+	case model.LoginPolicyIDPProviderRemoved, model.LoginPolicyIDPProviderCascadeRemoved,
+		org_es_model.LoginPolicyIDPProviderRemoved, org_es_model.LoginPolicyIDPProviderCascadeRemoved:
+		err = provider.SetData(event)
+		if err != nil {
+			return err
+		}
+		return m.view.DeleteIDPProvider(event.AggregateID, provider.IDPConfigID, event.Sequence)
+	case model.IDPConfigChanged, org_es_model.IDPConfigChanged:
+		config := new(iam_model.IDPConfig)
+		config.AppendEvent(event)
+		providers, err := m.view.IDPProvidersByIDPConfigID(config.IDPConfigID)
+		if err != nil {
+			return err
+		}
+		if provider.IDPProviderType == int32(iam_model.IDPProviderTypeSystem) {
+			config, err = m.iamEvents.GetIDPConfig(context.Background(), provider.AggregateID, config.IDPConfigID)
+		} else {
+			config, err = m.orgEvents.GetIDPConfig(context.Background(), provider.AggregateID, provider.IDPConfigID)
+		}
+		if err != nil {
+			return err
+		}
+		for _, provider := range providers {
+			m.fillConfigData(provider, config)
+		}
+		return m.view.PutIDPProviders(event.Sequence, providers...)
+	case org_es_model.LoginPolicyRemoved:
+		return m.view.DeleteIDPProvidersByAggregateID(event.AggregateID, event.Sequence)
+	default:
+		return m.view.ProcessedIDPProviderSequence(event.Sequence)
+	}
+	if err != nil {
+		return err
+	}
+	return m.view.PutIDPProvider(provider, provider.Sequence)
+}
+
+func (m *IDPProvider) fillData(provider *iam_view_model.IDPProviderView) (err error) {
+	var config *iam_model.IDPConfig
+	if provider.IDPProviderType == int32(iam_model.IDPProviderTypeSystem) {
+		config, err = m.iamEvents.GetIDPConfig(context.Background(), m.systemDefaults.IamID, provider.IDPConfigID)
+	} else {
+		config, err = m.orgEvents.GetIDPConfig(context.Background(), provider.AggregateID, provider.IDPConfigID)
+	}
+	if err != nil {
+		return err
+	}
+	m.fillConfigData(provider, config)
+	return nil
+}
+
+func (m *IDPProvider) fillConfigData(provider *iam_view_model.IDPProviderView, config *iam_model.IDPConfig) {
+	provider.Name = config.Name
+	provider.IDPConfigType = int32(config.Type)
+}
+
+func (m *IDPProvider) OnError(event *models.Event, err error) error {
+	logging.LogWithFields("SPOOL-Fjd89", "id", event.AggregateID).WithError(err).Warn("something went wrong in idp provider handler")
+	return spooler.HandleError(event, err, m.view.GetLatestIDPProviderFailedEvent, m.view.ProcessedIDPProviderFailedEvent, m.view.ProcessedIDPProviderSequence, m.errorCountUntilSkip)
+}
--- a/internal/auth/repository/eventsourcing/handler/login_policy.go
+++ b/internal/auth/repository/eventsourcing/handler/login_policy.go
@@ -0,0 +1,67 @@
+package handler
+
+import (
+	"github.com/caos/logging"
+	iam_es_model "github.com/caos/zitadel/internal/iam/repository/eventsourcing/model"
+
+	"github.com/caos/zitadel/internal/eventstore/models"
+	es_models "github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/eventstore/spooler"
+	iam_model "github.com/caos/zitadel/internal/iam/repository/view/model"
+	"github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
+)
+
+type LoginPolicy struct {
+	handler
+}
+
+const (
+	loginPolicyTable = "auth.login_policies"
+)
+
+func (m *LoginPolicy) ViewModel() string {
+	return loginPolicyTable
+}
+
+func (m *LoginPolicy) EventQuery() (*models.SearchQuery, error) {
+	sequence, err := m.view.GetLatestLoginPolicySequence()
+	if err != nil {
+		return nil, err
+	}
+	return es_models.NewSearchQuery().
+		AggregateTypeFilter(model.OrgAggregate, iam_es_model.IAMAggregate).
+		LatestSequenceFilter(sequence.CurrentSequence), nil
+}
+
+func (m *LoginPolicy) Reduce(event *models.Event) (err error) {
+	switch event.AggregateType {
+	case model.OrgAggregate, iam_es_model.IAMAggregate:
+		err = m.processLoginPolicy(event)
+	}
+	return err
+}
+
+func (m *LoginPolicy) processLoginPolicy(event *models.Event) (err error) {
+	policy := new(iam_model.LoginPolicyView)
+	switch event.Type {
+	case iam_es_model.LoginPolicyAdded, model.LoginPolicyAdded:
+		err = policy.AppendEvent(event)
+	case iam_es_model.LoginPolicyChanged, model.LoginPolicyChanged:
+		policy, err = m.view.LoginPolicyByAggregateID(event.AggregateID)
+		if err != nil {
+			return err
+		}
+		err = policy.AppendEvent(event)
+	default:
+		return m.view.ProcessedLoginPolicySequence(event.Sequence)
+	}
+	if err != nil {
+		return err
+	}
+	return m.view.PutLoginPolicy(policy, policy.Sequence)
+}
+
+func (m *LoginPolicy) OnError(event *models.Event, err error) error {
+	logging.LogWithFields("SPOOL-5id9s", "id", event.AggregateID).WithError(err).Warn("something went wrong in login policy handler")
+	return spooler.HandleError(event, err, m.view.GetLatestLoginPolicyFailedEvent, m.view.ProcessedLoginPolicyFailedEvent, m.view.ProcessedLoginPolicySequence, m.errorCountUntilSkip)
+}
--- a/internal/auth/repository/eventsourcing/handler/user_external_idps.go
+++ b/internal/auth/repository/eventsourcing/handler/user_external_idps.go
@@ -0,0 +1,126 @@
+package handler
+
+import (
+	"context"
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/config/systemdefaults"
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/iam/repository/eventsourcing"
+	org_es "github.com/caos/zitadel/internal/org/repository/eventsourcing"
+	org_es_model "github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
+	"github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
+	usr_view_model "github.com/caos/zitadel/internal/user/repository/view/model"
+
+	"github.com/caos/zitadel/internal/eventstore/models"
+	es_models "github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/eventstore/spooler"
+	iam_model "github.com/caos/zitadel/internal/iam/model"
+	iam_es_model "github.com/caos/zitadel/internal/iam/repository/eventsourcing/model"
+)
+
+type ExternalIDP struct {
+	handler
+	systemDefaults systemdefaults.SystemDefaults
+	iamEvents      *eventsourcing.IAMEventstore
+	orgEvents      *org_es.OrgEventstore
+}
+
+const (
+	externalIDPTable = "auth.user_external_idps"
+)
+
+func (m *ExternalIDP) ViewModel() string {
+	return externalIDPTable
+}
+
+func (m *ExternalIDP) EventQuery() (*models.SearchQuery, error) {
+	sequence, err := m.view.GetLatestExternalIDPSequence()
+	if err != nil {
+		return nil, err
+	}
+	return es_models.NewSearchQuery().
+		AggregateTypeFilter(model.UserAggregate, iam_es_model.IAMAggregate, org_es_model.OrgAggregate).
+		LatestSequenceFilter(sequence.CurrentSequence), nil
+}
+
+func (m *ExternalIDP) Reduce(event *models.Event) (err error) {
+	switch event.AggregateType {
+	case model.UserAggregate:
+		err = m.processUser(event)
+	case iam_es_model.IAMAggregate, org_es_model.OrgAggregate:
+		err = m.processIdpConfig(event)
+	}
+	return err
+}
+
+func (m *ExternalIDP) processUser(event *models.Event) (err error) {
+	externalIDP := new(usr_view_model.ExternalIDPView)
+	switch event.Type {
+	case model.HumanExternalIDPAdded:
+		err = externalIDP.AppendEvent(event)
+		if err != nil {
+			return err
+		}
+		err = m.fillData(externalIDP)
+	case model.HumanExternalIDPRemoved, model.HumanExternalIDPCascadeRemoved:
+		err = externalIDP.SetData(event)
+		if err != nil {
+			return err
+		}
+		return m.view.DeleteExternalIDP(externalIDP.ExternalUserID, externalIDP.IDPConfigID, event.Sequence)
+	default:
+		return m.view.ProcessedExternalIDPSequence(event.Sequence)
+	}
+	if err != nil {
+		return err
+	}
+	return m.view.PutExternalIDP(externalIDP, externalIDP.Sequence)
+}
+
+func (m *ExternalIDP) processIdpConfig(event *models.Event) (err error) {
+	switch event.Type {
+	case iam_es_model.IDPConfigChanged, org_es_model.IDPConfigChanged:
+		config := new(iam_model.IDPConfig)
+		config.AppendEvent(event)
+		exterinalIDPs, err := m.view.ExternalIDPsByIDPConfigID(config.IDPConfigID)
+		if err != nil {
+			return err
+		}
+		if event.AggregateType == iam_es_model.IAMAggregate {
+			config, err = m.iamEvents.GetIDPConfig(context.Background(), config.AggregateID, config.IDPConfigID)
+		} else {
+			config, err = m.orgEvents.GetIDPConfig(context.Background(), config.AggregateID, config.IDPConfigID)
+		}
+		if err != nil {
+			return err
+		}
+		for _, provider := range exterinalIDPs {
+			m.fillConfigData(provider, config)
+		}
+		return m.view.PutExternalIDPs(event.Sequence, exterinalIDPs...)
+	default:
+		return m.view.ProcessedExternalIDPSequence(event.Sequence)
+	}
+	return nil
+}
+
+func (m *ExternalIDP) fillData(externalIDP *usr_view_model.ExternalIDPView) error {
+	config, err := m.orgEvents.GetIDPConfig(context.Background(), externalIDP.ResourceOwner, externalIDP.IDPConfigID)
+	if caos_errs.IsNotFound(err) {
+		config, err = m.iamEvents.GetIDPConfig(context.Background(), m.systemDefaults.IamID, externalIDP.IDPConfigID)
+	}
+	if err != nil {
+		return err
+	}
+	m.fillConfigData(externalIDP, config)
+	return nil
+}
+
+func (m *ExternalIDP) fillConfigData(externalIDP *usr_view_model.ExternalIDPView, config *iam_model.IDPConfig) {
+	externalIDP.IDPName = config.Name
+}
+
+func (m *ExternalIDP) OnError(event *models.Event, err error) error {
+	logging.LogWithFields("SPOOL-4Rsu8", "id", event.AggregateID).WithError(err).Warn("something went wrong in idp provider handler")
+	return spooler.HandleError(event, err, m.view.GetLatestExternalIDPFailedEvent, m.view.ProcessedExternalIDPFailedEvent, m.view.ProcessedExternalIDPSequence, m.errorCountUntilSkip)
+}