feat: Identity brokering (#730)

* feat: add/ remove external idps * feat: external idp add /remove * fix: auth proto * fix: handle login * feat: loginpolicy on authrequest * feat: idp providers on login * feat: link external idp * fix: check login policy on check username * feat: add mapping fields for idp config * feat: use user org id if existing * feat: use user org id if existing * feat: register external user * feat: register external user * feat: user linking * feat: user linking * feat: design external login * feat: design external login * fix: tests * fix: regenerate login design * feat: next step test linking process * feat: next step test linking process * feat: cascade remove external idps on user * fix: tests * fix: tests * feat: external idp requsts on users * fix: generate protos * feat: login styles * feat: login styles * fix: link user * fix: register user on specifig org * fix: user linking * fix: register external, linking auto * fix: remove unnecessary request from proto * fix: tests * fix: new oidc package * fix: migration version * fix: policy permissions * Update internal/ui/login/static/i18n/en.yaml Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/static/i18n/en.yaml Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/handler/renderer.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/handler/renderer.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: pr requests * Update internal/ui/login/handler/link_users_handler.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: pr requests * fix: pr requests * fix: pr requests * fix: login name size * fix: profile image light * fix: colors * fix: pr requests * fix: remove redirect uri validator * fix: remove redirect uri validator Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2025-12-01 14:25:05 +00:00 · 2020-09-18 13:26:28 +02:00
parent 1d542a0c57
commit 320ddfa46d
141 changed files with 30057 additions and 12535 deletions
--- a/internal/management/repository/eventsourcing/eventstore/org.go
+++ b/internal/management/repository/eventsourcing/eventstore/org.go
@@ -8,6 +8,7 @@ import (
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	iam_es_model "github.com/caos/zitadel/internal/iam/repository/view/model"
 	iam_view_model "github.com/caos/zitadel/internal/iam/repository/view/model"
+	usr_model "github.com/caos/zitadel/internal/user/model"
 	"strings"

 	"github.com/caos/zitadel/internal/api/authz"
@@ -218,7 +219,7 @@ func (repo *OrgRepository) IDPConfigByID(ctx context.Context, idpConfigID string
 	if err != nil {
 		return nil, err
 	}
-	return iam_view_model.IdpConfigViewToModel(idp), nil
+	return iam_view_model.IDPConfigViewToModel(idp), nil
 }
 func (repo *OrgRepository) AddOIDCIDPConfig(ctx context.Context, idp *iam_model.IDPConfig) (*iam_model.IDPConfig, error) {
 	idp.AggregateID = authz.GetCtxData(ctx).OrgID
@@ -239,8 +240,27 @@ func (repo *OrgRepository) ReactivateIDPConfig(ctx context.Context, idpConfigID
 }

 func (repo *OrgRepository) RemoveIDPConfig(ctx context.Context, idpConfigID string) error {
+	aggregates := make([]*es_models.Aggregate, 0)
 	idp := iam_model.NewIDPConfig(authz.GetCtxData(ctx).OrgID, idpConfigID)
-	return repo.OrgEventstore.RemoveIDPConfig(ctx, idp)
+	_, agg, err := repo.OrgEventstore.PrepareRemoveIDPConfig(ctx, idp)
+	if err != nil {
+
+	}
+	aggregates = append(aggregates, agg)
+	externalIDPs, err := repo.View.ExternalIDPsByIDPConfigID(idpConfigID)
+	if err != nil {
+		return err
+	}
+	for _, externalIDP := range externalIDPs {
+		idpRemove := &usr_model.ExternalIDP{ObjectRoot: es_models.ObjectRoot{AggregateID: externalIDP.UserID}, IDPConfigID: externalIDP.IDPConfigID, UserID: externalIDP.ExternalUserID}
+		idpAgg := make([]*es_models.Aggregate, 0)
+		_, idpAgg, err = repo.UserEvents.PrepareRemoveExternalIDP(ctx, idpRemove, true)
+		if err != nil {
+			return err
+		}
+		aggregates = append(aggregates, idpAgg...)
+	}
+	return sdk.PushAggregates(ctx, repo.Eventstore.PushAggregates, nil, aggregates...)
 }

 func (repo *OrgRepository) ChangeOIDCIDPConfig(ctx context.Context, oidcConfig *iam_model.OIDCIDPConfig) (*iam_model.OIDCIDPConfig, error) {
@@ -338,6 +358,25 @@ func (repo *OrgRepository) AddIDPProviderToLoginPolicy(ctx context.Context, prov
 }

 func (repo *OrgRepository) RemoveIDPProviderFromIdpProvider(ctx context.Context, provider *iam_model.IDPProvider) error {
+	aggregates := make([]*es_models.Aggregate, 0)
 	provider.AggregateID = authz.GetCtxData(ctx).OrgID
-	return repo.OrgEventstore.RemoveIDPProviderFromLoginPolicy(ctx, provider)
+	_, agg, err := repo.OrgEventstore.PrepareRemoveIDPProviderFromLoginPolicy(ctx, provider, false)
+	if err != nil {
+		return err
+	}
+	aggregates = append(aggregates, agg)
+	externalIDPs, err := repo.View.ExternalIDPsByIDPConfigID(provider.IdpConfigID)
+	if err != nil {
+		return err
+	}
+	for _, externalIDP := range externalIDPs {
+		idpRemove := &usr_model.ExternalIDP{ObjectRoot: es_models.ObjectRoot{AggregateID: externalIDP.UserID}, IDPConfigID: externalIDP.IDPConfigID, UserID: externalIDP.ExternalUserID}
+		idpAgg := make([]*es_models.Aggregate, 0)
+		_, idpAgg, err = repo.UserEvents.PrepareRemoveExternalIDP(ctx, idpRemove, true)
+		if err != nil {
+			return err
+		}
+		aggregates = append(aggregates, idpAgg...)
+	}
+	return sdk.PushAggregates(ctx, repo.Eventstore.PushAggregates, nil, aggregates...)
 }
--- a/internal/management/repository/eventsourcing/eventstore/user.go
+++ b/internal/management/repository/eventsourcing/eventstore/user.go
@@ -181,6 +181,31 @@ func (repo *UserRepo) ProfileByID(ctx context.Context, userID string) (*usr_mode
 	return user.GetProfile()
 }

+func (repo *UserRepo) SearchExternalIDPs(ctx context.Context, request *usr_model.ExternalIDPSearchRequest) (*usr_model.ExternalIDPSearchResponse, error) {
+	request.EnsureLimit(repo.SearchLimit)
+	sequence, seqErr := repo.View.GetLatestExternalIDPSequence()
+	logging.Log("EVENT-Qs7uf").OnError(seqErr).Warn("could not read latest external idp sequence")
+	externalIDPS, count, err := repo.View.SearchExternalIDPs(request)
+	if err != nil {
+		return nil, err
+	}
+	result := &usr_model.ExternalIDPSearchResponse{
+		Offset:      request.Offset,
+		Limit:       request.Limit,
+		TotalResult: count,
+		Result:      model.ExternalIDPViewsToModel(externalIDPS),
+	}
+	if seqErr == nil {
+		result.Sequence = sequence.CurrentSequence
+		result.Timestamp = sequence.CurrentTimestamp
+	}
+	return result, nil
+}
+
+func (repo *UserRepo) RemoveExternalIDP(ctx context.Context, externalIDP *usr_model.ExternalIDP) error {
+	return repo.UserEvents.RemoveExternalIDP(ctx, externalIDP)
+}
+
 func (repo *UserRepo) ChangeMachine(ctx context.Context, machine *usr_model.Machine) (*usr_model.Machine, error) {
 	return repo.UserEvents.ChangeMachine(ctx, machine)
 }
--- a/internal/management/repository/eventsourcing/handler/handler.go
+++ b/internal/management/repository/eventsourcing/handler/handler.go
@@ -52,6 +52,7 @@ func Register(configs Configs, bulkLimit, errorCount uint64, view *view.View, ev
 		&IDPConfig{handler: handler{view, bulkLimit, configs.cycleDuration("IDPConfig"), errorCount}},
 		&LoginPolicy{handler: handler{view, bulkLimit, configs.cycleDuration("LoginPolicy"), errorCount}},
 		&IDPProvider{handler: handler{view, bulkLimit, configs.cycleDuration("IDPProvider"), errorCount}, systemDefaults: defaults, iamEvents: repos.IamEvents, orgEvents: repos.OrgEvents},
+		&ExternalIDP{handler: handler{view, bulkLimit, configs.cycleDuration("ExternalIDP"), errorCount}, systemDefaults: defaults, iamEvents: repos.IamEvents, orgEvents: repos.OrgEvents},
 	}
 }

--- a/internal/management/repository/eventsourcing/handler/user_external_idps.go
+++ b/internal/management/repository/eventsourcing/handler/user_external_idps.go
@@ -0,0 +1,126 @@
+package handler
+
+import (
+	"context"
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/config/systemdefaults"
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/iam/repository/eventsourcing"
+	org_es "github.com/caos/zitadel/internal/org/repository/eventsourcing"
+	org_es_model "github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
+	"github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
+	usr_view_model "github.com/caos/zitadel/internal/user/repository/view/model"
+
+	"github.com/caos/zitadel/internal/eventstore/models"
+	es_models "github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/eventstore/spooler"
+	iam_model "github.com/caos/zitadel/internal/iam/model"
+	iam_es_model "github.com/caos/zitadel/internal/iam/repository/eventsourcing/model"
+)
+
+type ExternalIDP struct {
+	handler
+	systemDefaults systemdefaults.SystemDefaults
+	iamEvents      *eventsourcing.IAMEventstore
+	orgEvents      *org_es.OrgEventstore
+}
+
+const (
+	externalIDPTable = "management.user_external_idps"
+)
+
+func (m *ExternalIDP) ViewModel() string {
+	return externalIDPTable
+}
+
+func (m *ExternalIDP) EventQuery() (*models.SearchQuery, error) {
+	sequence, err := m.view.GetLatestExternalIDPSequence()
+	if err != nil {
+		return nil, err
+	}
+	return es_models.NewSearchQuery().
+		AggregateTypeFilter(model.UserAggregate, iam_es_model.IAMAggregate, org_es_model.OrgAggregate).
+		LatestSequenceFilter(sequence.CurrentSequence), nil
+}
+
+func (m *ExternalIDP) Reduce(event *models.Event) (err error) {
+	switch event.AggregateType {
+	case model.UserAggregate:
+		err = m.processUser(event)
+	case iam_es_model.IAMAggregate, org_es_model.OrgAggregate:
+		err = m.processIdpConfig(event)
+	}
+	return err
+}
+
+func (m *ExternalIDP) processUser(event *models.Event) (err error) {
+	externalIDP := new(usr_view_model.ExternalIDPView)
+	switch event.Type {
+	case model.HumanExternalIDPAdded:
+		err = externalIDP.AppendEvent(event)
+		if err != nil {
+			return err
+		}
+		err = m.fillData(externalIDP)
+	case model.HumanExternalIDPRemoved, model.HumanExternalIDPCascadeRemoved:
+		err = externalIDP.SetData(event)
+		if err != nil {
+			return err
+		}
+		return m.view.DeleteExternalIDP(externalIDP.ExternalUserID, externalIDP.IDPConfigID, event.Sequence)
+	default:
+		return m.view.ProcessedExternalIDPSequence(event.Sequence)
+	}
+	if err != nil {
+		return err
+	}
+	return m.view.PutExternalIDP(externalIDP, externalIDP.Sequence)
+}
+
+func (m *ExternalIDP) processIdpConfig(event *models.Event) (err error) {
+	switch event.Type {
+	case iam_es_model.IDPConfigChanged, org_es_model.IDPConfigChanged:
+		config := new(iam_model.IDPConfig)
+		config.AppendEvent(event)
+		exterinalIDPs, err := m.view.ExternalIDPsByIDPConfigID(config.IDPConfigID)
+		if err != nil {
+			return err
+		}
+		if event.AggregateType == iam_es_model.IAMAggregate {
+			config, err = m.iamEvents.GetIDPConfig(context.Background(), config.AggregateID, config.IDPConfigID)
+		} else {
+			config, err = m.orgEvents.GetIDPConfig(context.Background(), config.AggregateID, config.IDPConfigID)
+		}
+		if err != nil {
+			return err
+		}
+		for _, provider := range exterinalIDPs {
+			m.fillConfigData(provider, config)
+		}
+		return m.view.PutExternalIDPs(event.Sequence, exterinalIDPs...)
+	default:
+		return m.view.ProcessedExternalIDPSequence(event.Sequence)
+	}
+	return nil
+}
+
+func (m *ExternalIDP) fillData(externalIDP *usr_view_model.ExternalIDPView) error {
+	config, err := m.orgEvents.GetIDPConfig(context.Background(), externalIDP.ResourceOwner, externalIDP.IDPConfigID)
+	if caos_errs.IsNotFound(err) {
+		config, err = m.iamEvents.GetIDPConfig(context.Background(), m.systemDefaults.IamID, externalIDP.IDPConfigID)
+	}
+	if err != nil {
+		return err
+	}
+	m.fillConfigData(externalIDP, config)
+	return nil
+}
+
+func (m *ExternalIDP) fillConfigData(externalIDP *usr_view_model.ExternalIDPView, config *iam_model.IDPConfig) {
+	externalIDP.IDPName = config.Name
+}
+
+func (m *ExternalIDP) OnError(event *models.Event, err error) error {
+	logging.LogWithFields("SPOOL-4Rsu8", "id", event.AggregateID).WithError(err).Warn("something went wrong in idp provider handler")
+	return spooler.HandleError(event, err, m.view.GetLatestExternalIDPFailedEvent, m.view.ProcessedExternalIDPFailedEvent, m.view.ProcessedExternalIDPSequence, m.errorCountUntilSkip)
+}
--- a/internal/management/repository/eventsourcing/view/external_idps.go
+++ b/internal/management/repository/eventsourcing/view/external_idps.go
@@ -0,0 +1,73 @@
+package view
+
+import (
+	"github.com/caos/zitadel/internal/errors"
+	usr_model "github.com/caos/zitadel/internal/user/model"
+	"github.com/caos/zitadel/internal/user/repository/view"
+	"github.com/caos/zitadel/internal/user/repository/view/model"
+	global_view "github.com/caos/zitadel/internal/view/repository"
+)
+
+const (
+	externalIDPTable = "management.user_external_idps"
+)
+
+func (v *View) ExternalIDPByExternalUserIDAndIDPConfigID(externalUserID, idpConfigID string) (*model.ExternalIDPView, error) {
+	return view.ExternalIDPByExternalUserIDAndIDPConfigID(v.Db, externalIDPTable, externalUserID, idpConfigID)
+}
+
+func (v *View) ExternalIDPByExternalUserIDAndIDPConfigIDAndResourceOwner(externalUserID, idpConfigID, resourceOwner string) (*model.ExternalIDPView, error) {
+	return view.ExternalIDPByExternalUserIDAndIDPConfigIDAndResourceOwner(v.Db, externalIDPTable, externalUserID, idpConfigID, resourceOwner)
+}
+
+func (v *View) ExternalIDPsByIDPConfigID(idpConfigID string) ([]*model.ExternalIDPView, error) {
+	return view.ExternalIDPsByIDPConfigID(v.Db, externalIDPTable, idpConfigID)
+}
+
+func (v *View) ExternalIDPsByUserID(userID string) ([]*model.ExternalIDPView, error) {
+	return view.ExternalIDPsByUserID(v.Db, externalIDPTable, userID)
+}
+
+func (v *View) SearchExternalIDPs(request *usr_model.ExternalIDPSearchRequest) ([]*model.ExternalIDPView, uint64, error) {
+	return view.SearchExternalIDPs(v.Db, externalIDPTable, request)
+}
+
+func (v *View) PutExternalIDP(externalIDP *model.ExternalIDPView, sequence uint64) error {
+	err := view.PutExternalIDP(v.Db, externalIDPTable, externalIDP)
+	if err != nil {
+		return err
+	}
+	return v.ProcessedExternalIDPSequence(sequence)
+}
+
+func (v *View) PutExternalIDPs(sequence uint64, externalIDPs ...*model.ExternalIDPView) error {
+	err := view.PutExternalIDPs(v.Db, externalIDPTable, externalIDPs...)
+	if err != nil {
+		return err
+	}
+	return v.ProcessedExternalIDPSequence(sequence)
+}
+
+func (v *View) DeleteExternalIDP(externalUserID, idpConfigID string, eventSequence uint64) error {
+	err := view.DeleteExternalIDP(v.Db, externalIDPTable, externalUserID, idpConfigID)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	return v.ProcessedExternalIDPSequence(eventSequence)
+}
+
+func (v *View) GetLatestExternalIDPSequence() (*global_view.CurrentSequence, error) {
+	return v.latestSequence(externalIDPTable)
+}
+
+func (v *View) ProcessedExternalIDPSequence(eventSequence uint64) error {
+	return v.saveCurrentSequence(externalIDPTable, eventSequence)
+}
+
+func (v *View) GetLatestExternalIDPFailedEvent(sequence uint64) (*global_view.FailedEvent, error) {
+	return v.latestFailedEvent(externalIDPTable, sequence)
+}
+
+func (v *View) ProcessedExternalIDPFailedEvent(failedEvent *global_view.FailedEvent) error {
+	return v.saveFailedEvent(failedEvent)
+}
--- a/internal/management/repository/user.go
+++ b/internal/management/repository/user.go
@@ -31,6 +31,9 @@ type UserRepository interface {

 	UserMfas(ctx context.Context, userID string) ([]*model.MultiFactor, error)

+	SearchExternalIDPs(ctx context.Context, request *model.ExternalIDPSearchRequest) (*model.ExternalIDPSearchResponse, error)
+	RemoveExternalIDP(ctx context.Context, externalIDP *model.ExternalIDP) error
+
 	SearchMachineKeys(ctx context.Context, request *model.MachineKeySearchRequest) (*model.MachineKeySearchResponse, error)
 	GetMachineKey(ctx context.Context, userID, keyID string) (*model.MachineKeyView, error)
 	ChangeMachine(ctx context.Context, machine *model.Machine) (*model.Machine, error)