feat: Identity brokering (#730)

* feat: add/ remove external idps * feat: external idp add /remove * fix: auth proto * fix: handle login * feat: loginpolicy on authrequest * feat: idp providers on login * feat: link external idp * fix: check login policy on check username * feat: add mapping fields for idp config * feat: use user org id if existing * feat: use user org id if existing * feat: register external user * feat: register external user * feat: user linking * feat: user linking * feat: design external login * feat: design external login * fix: tests * fix: regenerate login design * feat: next step test linking process * feat: next step test linking process * feat: cascade remove external idps on user * fix: tests * fix: tests * feat: external idp requsts on users * fix: generate protos * feat: login styles * feat: login styles * fix: link user * fix: register user on specifig org * fix: user linking * fix: register external, linking auto * fix: remove unnecessary request from proto * fix: tests * fix: new oidc package * fix: migration version * fix: policy permissions * Update internal/ui/login/static/i18n/en.yaml Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/static/i18n/en.yaml Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/handler/renderer.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/handler/renderer.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: pr requests * Update internal/ui/login/handler/link_users_handler.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: pr requests * fix: pr requests * fix: pr requests * fix: login name size * fix: profile image light * fix: colors * fix: pr requests * fix: remove redirect uri validator * fix: remove redirect uri validator Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2025-08-12 01:47:33 +00:00 · 2020-09-18 13:26:28 +02:00
parent 1d542a0c57
commit 320ddfa46d
141 changed files with 30057 additions and 12535 deletions
--- a/internal/user/repository/eventsourcing/model/external_idp.go
+++ b/internal/user/repository/eventsourcing/model/external_idp.go
@@ -0,0 +1,96 @@
+package model
+
+import (
+	"encoding/json"
+	"github.com/caos/logging"
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	es_models "github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/user/model"
+)
+
+type ExternalIDP struct {
+	es_models.ObjectRoot
+
+	IDPConfigID string `json:"idpConfigId,omitempty"`
+	UserID      string `json:"userId,omitempty"`
+	DisplayName string `json:"displayName,omitempty"`
+}
+
+func GetExternalIDP(idps []*ExternalIDP, id string) (int, *ExternalIDP) {
+	for i, idp := range idps {
+		if idp.UserID == id {
+			return i, idp
+		}
+	}
+	return -1, nil
+}
+
+func ExternalIDPsToModel(externalIDPs []*ExternalIDP) []*model.ExternalIDP {
+	convertedIDPs := make([]*model.ExternalIDP, len(externalIDPs))
+	for i, m := range externalIDPs {
+		convertedIDPs[i] = ExternalIDPToModel(m)
+	}
+	return convertedIDPs
+}
+
+func ExternalIDPsFromModel(externalIDPs []*model.ExternalIDP) []*ExternalIDP {
+	convertedIDPs := make([]*ExternalIDP, len(externalIDPs))
+	for i, m := range externalIDPs {
+		convertedIDPs[i] = ExternalIDPFromModel(m)
+	}
+	return convertedIDPs
+}
+
+func ExternalIDPFromModel(idp *model.ExternalIDP) *ExternalIDP {
+	if idp == nil {
+		return nil
+	}
+	return &ExternalIDP{
+		ObjectRoot:  idp.ObjectRoot,
+		IDPConfigID: idp.IDPConfigID,
+		UserID:      idp.UserID,
+		DisplayName: idp.DisplayName,
+	}
+}
+
+func ExternalIDPToModel(idp *ExternalIDP) *model.ExternalIDP {
+	return &model.ExternalIDP{
+		ObjectRoot:  idp.ObjectRoot,
+		IDPConfigID: idp.IDPConfigID,
+		UserID:      idp.UserID,
+	}
+}
+
+func (u *Human) appendExternalIDPAddedEvent(event *es_models.Event) error {
+	idp := new(ExternalIDP)
+	err := idp.setData(event)
+	if err != nil {
+		return err
+	}
+	idp.ObjectRoot.CreationDate = event.CreationDate
+	u.ExternalIDPs = append(u.ExternalIDPs, idp)
+	return nil
+}
+
+func (u *Human) appendExternalIDPRemovedEvent(event *es_models.Event) error {
+	idp := new(ExternalIDP)
+	err := idp.setData(event)
+	if err != nil {
+		return err
+	}
+	if i, externalIdp := GetExternalIDP(u.ExternalIDPs, idp.UserID); externalIdp != nil {
+		u.ExternalIDPs[i] = u.ExternalIDPs[len(u.ExternalIDPs)-1]
+		u.ExternalIDPs[len(u.ExternalIDPs)-1] = nil
+		u.ExternalIDPs = u.ExternalIDPs[:len(u.ExternalIDPs)-1]
+	}
+	return nil
+}
+
+func (pw *ExternalIDP) setData(event *es_models.Event) error {
+	pw.ObjectRoot.AppendEvent(event)
+	if err := json.Unmarshal(event.Data, pw); err != nil {
+		logging.Log("EVEN-Msi9d").WithError(err).Error("could not unmarshal event data")
+		return caos_errs.ThrowInternal(err, "MODEL-A9osf", "could not unmarshal event")
+	}
+	return nil
+}
--- a/internal/user/repository/eventsourcing/model/external_idp_test.go
+++ b/internal/user/repository/eventsourcing/model/external_idp_test.go
@@ -0,0 +1,89 @@
+package model
+
+import (
+	"encoding/json"
+	es_models "github.com/caos/zitadel/internal/eventstore/models"
+	"testing"
+)
+
+func TestAppendExternalIDPAddedEvent(t *testing.T) {
+	type args struct {
+		user        *Human
+		externalIDP *ExternalIDP
+		event       *es_models.Event
+	}
+	tests := []struct {
+		name   string
+		args   args
+		result *Human
+	}{
+		{
+			name: "append external idp added event",
+			args: args{
+				user:        &Human{},
+				externalIDP: &ExternalIDP{IDPConfigID: "IDPConfigID", UserID: "UserID", DisplayName: "DisplayName"},
+				event:       &es_models.Event{},
+			},
+			result: &Human{ExternalIDPs: []*ExternalIDP{{IDPConfigID: "IDPConfigID", UserID: "UserID", DisplayName: "DisplayName"}}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.args.externalIDP != nil {
+				data, _ := json.Marshal(tt.args.externalIDP)
+				tt.args.event.Data = data
+			}
+			tt.args.user.appendExternalIDPAddedEvent(tt.args.event)
+			if len(tt.args.user.ExternalIDPs) == 0 {
+				t.Error("got wrong result expected external idps on user ")
+			}
+			if tt.args.user.ExternalIDPs[0].UserID != tt.result.ExternalIDPs[0].UserID {
+				t.Errorf("got wrong result: expected: %v, actual: %v ", tt.result.ExternalIDPs[0].UserID, tt.args.user.ExternalIDPs[0].UserID)
+			}
+			if tt.args.user.ExternalIDPs[0].IDPConfigID != tt.result.ExternalIDPs[0].IDPConfigID {
+				t.Errorf("got wrong result: expected: %v, actual: %v ", tt.result.ExternalIDPs[0].IDPConfigID, tt.args.user.ExternalIDPs[0].IDPConfigID)
+			}
+			if tt.args.user.ExternalIDPs[0].DisplayName != tt.result.ExternalIDPs[0].DisplayName {
+				t.Errorf("got wrong result: expected: %v, actual: %v ", tt.result.ExternalIDPs[0].DisplayName, tt.args.user.ExternalIDPs[0].IDPConfigID)
+			}
+		})
+	}
+}
+
+func TestAppendExternalIDPRemovedEvent(t *testing.T) {
+	type args struct {
+		user        *Human
+		externalIDP *ExternalIDP
+		event       *es_models.Event
+	}
+	tests := []struct {
+		name   string
+		args   args
+		result *Human
+	}{
+		{
+			name: "append external idp removed event",
+			args: args{
+				user: &Human{
+					ExternalIDPs: []*ExternalIDP{
+						{IDPConfigID: "IDPConfigID", UserID: "UserID", DisplayName: "DisplayName"},
+					}},
+				externalIDP: &ExternalIDP{UserID: "UserID"},
+				event:       &es_models.Event{},
+			},
+			result: &Human{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.args.externalIDP != nil {
+				data, _ := json.Marshal(tt.args.externalIDP)
+				tt.args.event.Data = data
+			}
+			tt.args.user.appendExternalIDPRemovedEvent(tt.args.event)
+			if len(tt.args.user.ExternalIDPs) != 0 {
+				t.Error("got wrong result expected 0 external idps on user ")
+			}
+		})
+	}
+}
--- a/internal/user/repository/eventsourcing/model/types.go
+++ b/internal/user/repository/eventsourcing/model/types.go
@@ -4,8 +4,9 @@ import "github.com/caos/zitadel/internal/eventstore/models"

 //aggregates
 const (
-	UserAggregate         models.AggregateType = "user"
-	UserUserNameAggregate models.AggregateType = "user.username"
+	UserAggregate            models.AggregateType = "user"
+	UserUserNameAggregate    models.AggregateType = "user.username"
+	UserExternalIDPAggregate models.AggregateType = "user.human.externalidp"
 )

 // the following consts are for user v1 events
@@ -83,6 +84,13 @@ const (
 	HumanPasswordCheckSucceeded models.EventType = "user.human.password.check.succeeded"
 	HumanPasswordCheckFailed    models.EventType = "user.human.password.check.failed"

+	HumanExternalIDPReserved models.EventType = "user.human.externalidp.reserved"
+	HumanExternalIDPReleased models.EventType = "user.human.externalidp.released"
+
+	HumanExternalIDPAdded          models.EventType = "user.human.externalidp.added"
+	HumanExternalIDPRemoved        models.EventType = "user.human.externalidp.removed"
+	HumanExternalIDPCascadeRemoved models.EventType = "user.human.externalidp.cascade.removed"
+
 	HumanEmailChanged            models.EventType = "user.human.email.changed"
 	HumanEmailVerified           models.EventType = "user.human.email.verified"
 	HumanEmailVerificationFailed models.EventType = "user.human.email.verification.failed"
--- a/internal/user/repository/eventsourcing/model/user_human.go
+++ b/internal/user/repository/eventsourcing/model/user_human.go
@@ -19,11 +19,12 @@ type Human struct {
 	*Email
 	*Phone
 	*Address
-	InitCode     *InitUserCode `json:"-"`
-	EmailCode    *EmailCode    `json:"-"`
-	PhoneCode    *PhoneCode    `json:"-"`
-	PasswordCode *PasswordCode `json:"-"`
-	OTP          *OTP          `json:"-"`
+	ExternalIDPs []*ExternalIDP `json:"-"`
+	InitCode     *InitUserCode  `json:"-"`
+	EmailCode    *EmailCode     `json:"-"`
+	PhoneCode    *PhoneCode     `json:"-"`
+	PasswordCode *PasswordCode  `json:"-"`
+	OTP          *OTP           `json:"-"`
 }

 type InitUserCode struct {
@@ -52,6 +53,9 @@ func HumanFromModel(user *model.Human) *Human {
 	if user.OTP != nil {
 		human.OTP = OTPFromModel(user.OTP)
 	}
+	if user.ExternalIDPs != nil {
+		human.ExternalIDPs = ExternalIDPsFromModel(user.ExternalIDPs)
+	}
 	return human
 }

@@ -72,6 +76,9 @@ func HumanToModel(user *Human) *model.Human {
 	if user.Address != nil {
 		human.Address = AddressToModel(user.Address)
 	}
+	if user.ExternalIDPs != nil {
+		human.ExternalIDPs = ExternalIDPsToModel(user.ExternalIDPs)
+	}
 	if user.InitCode != nil {
 		human.InitCode = InitCodeToModel(user.InitCode)
 	}
@@ -169,6 +176,10 @@ func (h *Human) AppendEvent(event *es_models.Event) (err error) {
 	case MFAOTPRemoved,
 		HumanMFAOTPRemoved:
 		h.appendOTPRemovedEvent()
+	case HumanExternalIDPAdded:
+		err = h.appendExternalIDPAddedEvent(event)
+	case HumanExternalIDPRemoved, HumanExternalIDPCascadeRemoved:
+		err = h.appendExternalIDPRemovedEvent(event)
 	}
 	if err != nil {
 		return err