feat: Identity brokering (#730)

* feat: add/ remove external idps * feat: external idp add /remove * fix: auth proto * fix: handle login * feat: loginpolicy on authrequest * feat: idp providers on login * feat: link external idp * fix: check login policy on check username * feat: add mapping fields for idp config * feat: use user org id if existing * feat: use user org id if existing * feat: register external user * feat: register external user * feat: user linking * feat: user linking * feat: design external login * feat: design external login * fix: tests * fix: regenerate login design * feat: next step test linking process * feat: next step test linking process * feat: cascade remove external idps on user * fix: tests * fix: tests * feat: external idp requsts on users * fix: generate protos * feat: login styles * feat: login styles * fix: link user * fix: register user on specifig org * fix: user linking * fix: register external, linking auto * fix: remove unnecessary request from proto * fix: tests * fix: new oidc package * fix: migration version * fix: policy permissions * Update internal/ui/login/static/i18n/en.yaml Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/static/i18n/en.yaml Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/handler/renderer.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/handler/renderer.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: pr requests * Update internal/ui/login/handler/link_users_handler.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: pr requests * fix: pr requests * fix: pr requests * fix: login name size * fix: profile image light * fix: colors * fix: pr requests * fix: remove redirect uri validator * fix: remove redirect uri validator Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2025-08-12 08:37:32 +00:00 · 2020-09-18 13:26:28 +02:00
parent 1d542a0c57
commit 320ddfa46d
141 changed files with 30057 additions and 12535 deletions
--- a/internal/auth/repository/eventsourcing/view/external_idps.go
+++ b/internal/auth/repository/eventsourcing/view/external_idps.go
@@ -0,0 +1,73 @@
+package view
+
+import (
+	"github.com/caos/zitadel/internal/errors"
+	usr_model "github.com/caos/zitadel/internal/user/model"
+	"github.com/caos/zitadel/internal/user/repository/view"
+	"github.com/caos/zitadel/internal/user/repository/view/model"
+	global_view "github.com/caos/zitadel/internal/view/repository"
+)
+
+const (
+	externalIDPTable = "auth.user_external_idps"
+)
+
+func (v *View) ExternalIDPByExternalUserIDAndIDPConfigID(externalUserID, idpConfigID string) (*model.ExternalIDPView, error) {
+	return view.ExternalIDPByExternalUserIDAndIDPConfigID(v.Db, externalIDPTable, externalUserID, idpConfigID)
+}
+
+func (v *View) ExternalIDPByExternalUserIDAndIDPConfigIDAndResourceOwner(externalUserID, idpConfigID, resourceOwner string) (*model.ExternalIDPView, error) {
+	return view.ExternalIDPByExternalUserIDAndIDPConfigIDAndResourceOwner(v.Db, externalIDPTable, externalUserID, idpConfigID, resourceOwner)
+}
+
+func (v *View) ExternalIDPsByIDPConfigID(idpConfigID string) ([]*model.ExternalIDPView, error) {
+	return view.ExternalIDPsByIDPConfigID(v.Db, externalIDPTable, idpConfigID)
+}
+
+func (v *View) ExternalIDPsByUserID(userID string) ([]*model.ExternalIDPView, error) {
+	return view.ExternalIDPsByUserID(v.Db, externalIDPTable, userID)
+}
+
+func (v *View) SearchExternalIDPs(request *usr_model.ExternalIDPSearchRequest) ([]*model.ExternalIDPView, uint64, error) {
+	return view.SearchExternalIDPs(v.Db, externalIDPTable, request)
+}
+
+func (v *View) PutExternalIDP(externalIDP *model.ExternalIDPView, sequence uint64) error {
+	err := view.PutExternalIDP(v.Db, externalIDPTable, externalIDP)
+	if err != nil {
+		return err
+	}
+	return v.ProcessedExternalIDPSequence(sequence)
+}
+
+func (v *View) PutExternalIDPs(sequence uint64, externalIDPs ...*model.ExternalIDPView) error {
+	err := view.PutExternalIDPs(v.Db, externalIDPTable, externalIDPs...)
+	if err != nil {
+		return err
+	}
+	return v.ProcessedExternalIDPSequence(sequence)
+}
+
+func (v *View) DeleteExternalIDP(externalUserID, idpConfigID string, eventSequence uint64) error {
+	err := view.DeleteExternalIDP(v.Db, externalIDPTable, externalUserID, idpConfigID)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	return v.ProcessedExternalIDPSequence(eventSequence)
+}
+
+func (v *View) GetLatestExternalIDPSequence() (*global_view.CurrentSequence, error) {
+	return v.latestSequence(externalIDPTable)
+}
+
+func (v *View) ProcessedExternalIDPSequence(eventSequence uint64) error {
+	return v.saveCurrentSequence(externalIDPTable, eventSequence)
+}
+
+func (v *View) GetLatestExternalIDPFailedEvent(sequence uint64) (*global_view.FailedEvent, error) {
+	return v.latestFailedEvent(externalIDPTable, sequence)
+}
+
+func (v *View) ProcessedExternalIDPFailedEvent(failedEvent *global_view.FailedEvent) error {
+	return v.saveFailedEvent(failedEvent)
+}
--- a/internal/auth/repository/eventsourcing/view/idp_configs.go
+++ b/internal/auth/repository/eventsourcing/view/idp_configs.go
@@ -0,0 +1,57 @@
+package view
+
+import (
+	"github.com/caos/zitadel/internal/errors"
+	iam_model "github.com/caos/zitadel/internal/iam/model"
+	"github.com/caos/zitadel/internal/iam/repository/view"
+	iam_es_model "github.com/caos/zitadel/internal/iam/repository/view/model"
+	global_view "github.com/caos/zitadel/internal/view/repository"
+)
+
+const (
+	idpConfigTable = "auth.idp_configs"
+)
+
+func (v *View) IDPConfigByID(idpID string) (*iam_es_model.IDPConfigView, error) {
+	return view.IDPByID(v.Db, idpConfigTable, idpID)
+}
+
+func (v *View) GetIDPConfigsByAggregateID(aggregateID string) ([]*iam_es_model.IDPConfigView, error) {
+	return view.GetIDPConfigsByAggregateID(v.Db, idpConfigTable, aggregateID)
+}
+
+func (v *View) SearchIDPConfigs(request *iam_model.IDPConfigSearchRequest) ([]*iam_es_model.IDPConfigView, uint64, error) {
+	return view.SearchIDPs(v.Db, idpConfigTable, request)
+}
+
+func (v *View) PutIDPConfig(idp *iam_es_model.IDPConfigView, sequence uint64) error {
+	err := view.PutIDP(v.Db, idpConfigTable, idp)
+	if err != nil {
+		return err
+	}
+	return v.ProcessedIDPConfigSequence(sequence)
+}
+
+func (v *View) DeleteIDPConfig(idpID string, eventSequence uint64) error {
+	err := view.DeleteIDP(v.Db, idpConfigTable, idpID)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	return v.ProcessedIDPConfigSequence(eventSequence)
+}
+
+func (v *View) GetLatestIDPConfigSequence() (*global_view.CurrentSequence, error) {
+	return v.latestSequence(idpConfigTable)
+}
+
+func (v *View) ProcessedIDPConfigSequence(eventSequence uint64) error {
+	return v.saveCurrentSequence(idpConfigTable, eventSequence)
+}
+
+func (v *View) GetLatestIDPConfigFailedEvent(sequence uint64) (*global_view.FailedEvent, error) {
+	return v.latestFailedEvent(idpConfigTable, sequence)
+}
+
+func (v *View) ProcessedIDPConfigFailedEvent(failedEvent *global_view.FailedEvent) error {
+	return v.saveFailedEvent(failedEvent)
+}
--- a/internal/auth/repository/eventsourcing/view/idp_providers.go
+++ b/internal/auth/repository/eventsourcing/view/idp_providers.go
@@ -0,0 +1,77 @@
+package view
+
+import (
+	"github.com/caos/zitadel/internal/errors"
+	iam_model "github.com/caos/zitadel/internal/iam/model"
+	"github.com/caos/zitadel/internal/iam/repository/view"
+	"github.com/caos/zitadel/internal/iam/repository/view/model"
+	global_view "github.com/caos/zitadel/internal/view/repository"
+)
+
+const (
+	idpProviderTable = "auth.idp_providers"
+)
+
+func (v *View) IDPProviderByAggregateAndIDPConfigID(aggregateID, idpConfigID string) (*model.IDPProviderView, error) {
+	return view.GetIDPProviderByAggregateIDAndConfigID(v.Db, idpProviderTable, aggregateID, idpConfigID)
+}
+
+func (v *View) IDPProvidersByIDPConfigID(idpConfigID string) ([]*model.IDPProviderView, error) {
+	return view.IDPProvidersByIdpConfigID(v.Db, idpProviderTable, idpConfigID)
+}
+
+func (v *View) IDPProvidersByAggregateID(aggregateID string) ([]*model.IDPProviderView, error) {
+	return view.IDPProvidersByAggregateID(v.Db, idpProviderTable, aggregateID)
+}
+
+func (v *View) SearchIDPProviders(request *iam_model.IDPProviderSearchRequest) ([]*model.IDPProviderView, uint64, error) {
+	return view.SearchIDPProviders(v.Db, idpProviderTable, request)
+}
+
+func (v *View) PutIDPProvider(provider *model.IDPProviderView, sequence uint64) error {
+	err := view.PutIDPProvider(v.Db, idpProviderTable, provider)
+	if err != nil {
+		return err
+	}
+	return v.ProcessedIDPProviderSequence(sequence)
+}
+
+func (v *View) PutIDPProviders(sequence uint64, providers ...*model.IDPProviderView) error {
+	err := view.PutIDPProviders(v.Db, idpProviderTable, providers...)
+	if err != nil {
+		return err
+	}
+	return v.ProcessedIDPProviderSequence(sequence)
+}
+
+func (v *View) DeleteIDPProvider(aggregateID, idpConfigID string, eventSequence uint64) error {
+	err := view.DeleteIDPProvider(v.Db, idpProviderTable, aggregateID, idpConfigID)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	return v.ProcessedIDPProviderSequence(eventSequence)
+}
+
+func (v *View) DeleteIDPProvidersByAggregateID(aggregateID string, eventSequence uint64) error {
+	err := view.DeleteIDPProvidersByAggregateID(v.Db, idpProviderTable, aggregateID)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	return v.ProcessedIDPProviderSequence(eventSequence)
+}
+
+func (v *View) GetLatestIDPProviderSequence() (*global_view.CurrentSequence, error) {
+	return v.latestSequence(idpProviderTable)
+}
+
+func (v *View) ProcessedIDPProviderSequence(eventSequence uint64) error {
+	return v.saveCurrentSequence(idpProviderTable, eventSequence)
+}
+
+func (v *View) GetLatestIDPProviderFailedEvent(sequence uint64) (*global_view.FailedEvent, error) {
+	return v.latestFailedEvent(idpProviderTable, sequence)
+}
+
+func (v *View) ProcessedIDPProviderFailedEvent(failedEvent *global_view.FailedEvent) error {
+	return v.saveFailedEvent(failedEvent)
+}
--- a/internal/auth/repository/eventsourcing/view/login_policies.go
+++ b/internal/auth/repository/eventsourcing/view/login_policies.go
@@ -0,0 +1,48 @@
+package view
+
+import (
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/iam/repository/view"
+	"github.com/caos/zitadel/internal/iam/repository/view/model"
+	global_view "github.com/caos/zitadel/internal/view/repository"
+)
+
+const (
+	loginPolicyTable = "auth.login_policies"
+)
+
+func (v *View) LoginPolicyByAggregateID(aggregateID string) (*model.LoginPolicyView, error) {
+	return view.GetLoginPolicyByAggregateID(v.Db, loginPolicyTable, aggregateID)
+}
+
+func (v *View) PutLoginPolicy(policy *model.LoginPolicyView, sequence uint64) error {
+	err := view.PutLoginPolicy(v.Db, loginPolicyTable, policy)
+	if err != nil {
+		return err
+	}
+	return v.ProcessedLoginPolicySequence(sequence)
+}
+
+func (v *View) DeleteLoginPolicy(aggregateID string, eventSequence uint64) error {
+	err := view.DeleteLoginPolicy(v.Db, loginPolicyTable, aggregateID)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	return v.ProcessedLoginPolicySequence(eventSequence)
+}
+
+func (v *View) GetLatestLoginPolicySequence() (*global_view.CurrentSequence, error) {
+	return v.latestSequence(loginPolicyTable)
+}
+
+func (v *View) ProcessedLoginPolicySequence(eventSequence uint64) error {
+	return v.saveCurrentSequence(loginPolicyTable, eventSequence)
+}
+
+func (v *View) GetLatestLoginPolicyFailedEvent(sequence uint64) (*global_view.FailedEvent, error) {
+	return v.latestFailedEvent(loginPolicyTable, sequence)
+}
+
+func (v *View) ProcessedLoginPolicyFailedEvent(failedEvent *global_view.FailedEvent) error {
+	return v.saveFailedEvent(failedEvent)
+}
--- a/internal/auth/repository/eventsourcing/view/user.go
+++ b/internal/auth/repository/eventsourcing/view/user.go
@@ -23,6 +23,10 @@ func (v *View) UserByLoginName(loginName string) (*model.UserView, error) {
 	return view.UserByLoginName(v.Db, userTable, loginName)
 }

+func (v *View) UserByLoginNameAndResourceOwner(loginName, resourceOwner string) (*model.UserView, error) {
+	return view.UserByLoginNameAndResourceOwner(v.Db, userTable, loginName, resourceOwner)
+}
+
 func (v *View) UsersByOrgID(orgID string) ([]*model.UserView, error) {
 	return view.UsersByOrgID(v.Db, userTable, orgID)
 }