feat: Identity brokering (#730)

* feat: add/ remove external idps * feat: external idp add /remove * fix: auth proto * fix: handle login * feat: loginpolicy on authrequest * feat: idp providers on login * feat: link external idp * fix: check login policy on check username * feat: add mapping fields for idp config * feat: use user org id if existing * feat: use user org id if existing * feat: register external user * feat: register external user * feat: user linking * feat: user linking * feat: design external login * feat: design external login * fix: tests * fix: regenerate login design * feat: next step test linking process * feat: next step test linking process * feat: cascade remove external idps on user * fix: tests * fix: tests * feat: external idp requsts on users * fix: generate protos * feat: login styles * feat: login styles * fix: link user * fix: register user on specifig org * fix: user linking * fix: register external, linking auto * fix: remove unnecessary request from proto * fix: tests * fix: new oidc package * fix: migration version * fix: policy permissions * Update internal/ui/login/static/i18n/en.yaml Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/static/i18n/en.yaml Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/handler/renderer.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/ui/login/handler/renderer.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: pr requests * Update internal/ui/login/handler/link_users_handler.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix: pr requests * fix: pr requests * fix: pr requests * fix: login name size * fix: profile image light * fix: colors * fix: pr requests * fix: remove redirect uri validator * fix: remove redirect uri validator Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2025-08-12 11:07:32 +00:00 · 2020-09-18 13:26:28 +02:00
parent 1d542a0c57
commit 320ddfa46d
141 changed files with 30057 additions and 12535 deletions
--- a/internal/user/repository/view/external_idp_view.go
+++ b/internal/user/repository/view/external_idp_view.go
@@ -0,0 +1,117 @@
+package view
+
+import (
+	"github.com/caos/zitadel/internal/view/repository"
+
+	"github.com/jinzhu/gorm"
+
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	global_model "github.com/caos/zitadel/internal/model"
+	usr_model "github.com/caos/zitadel/internal/user/model"
+	"github.com/caos/zitadel/internal/user/repository/view/model"
+)
+
+func ExternalIDPByExternalUserIDAndIDPConfigID(db *gorm.DB, table, externalUserID, idpConfigID string) (*model.ExternalIDPView, error) {
+	user := new(model.ExternalIDPView)
+	userIDQuery := &model.ExternalIDPSearchQuery{
+		Key:    usr_model.ExternalIDPSearchKeyExternalUserID,
+		Method: global_model.SearchMethodEquals,
+		Value:  externalUserID,
+	}
+	idpConfigIDQuery := &model.ExternalIDPSearchQuery{
+		Key:    usr_model.ExternalIDPSearchKeyIdpConfigID,
+		Method: global_model.SearchMethodEquals,
+		Value:  idpConfigID,
+	}
+	query := repository.PrepareGetByQuery(table, userIDQuery, idpConfigIDQuery)
+	err := query(db, user)
+	if caos_errs.IsNotFound(err) {
+		return nil, caos_errs.ThrowNotFound(nil, "VIEW-Mso9f", "Errors.ExternalIDP.NotFound")
+	}
+	return user, err
+}
+
+func ExternalIDPByExternalUserIDAndIDPConfigIDAndResourceOwner(db *gorm.DB, table, externalUserID, idpConfigID, resourceOwner string) (*model.ExternalIDPView, error) {
+	user := new(model.ExternalIDPView)
+	userIDQuery := &model.ExternalIDPSearchQuery{
+		Key:    usr_model.ExternalIDPSearchKeyExternalUserID,
+		Method: global_model.SearchMethodEquals,
+		Value:  externalUserID,
+	}
+	idpConfigIDQuery := &model.ExternalIDPSearchQuery{
+		Key:    usr_model.ExternalIDPSearchKeyIdpConfigID,
+		Method: global_model.SearchMethodEquals,
+		Value:  idpConfigID,
+	}
+	resourceOwnerQuery := &model.ExternalIDPSearchQuery{
+		Key:    usr_model.ExternalIDPSearchKeyResourceOwner,
+		Method: global_model.SearchMethodEquals,
+		Value:  resourceOwner,
+	}
+	query := repository.PrepareGetByQuery(table, userIDQuery, idpConfigIDQuery, resourceOwnerQuery)
+	err := query(db, user)
+	if caos_errs.IsNotFound(err) {
+		return nil, caos_errs.ThrowNotFound(nil, "VIEW-Sf8sd", "Errors.ExternalIDP.NotFound")
+	}
+	return user, err
+}
+
+func ExternalIDPsByIDPConfigID(db *gorm.DB, table, idpConfigID string) ([]*model.ExternalIDPView, error) {
+	externalIDPs := make([]*model.ExternalIDPView, 0)
+	orgIDQuery := &usr_model.ExternalIDPSearchQuery{
+		Key:    usr_model.ExternalIDPSearchKeyIdpConfigID,
+		Method: global_model.SearchMethodEquals,
+		Value:  idpConfigID,
+	}
+	query := repository.PrepareSearchQuery(table, model.ExternalIDPSearchRequest{
+		Queries: []*usr_model.ExternalIDPSearchQuery{orgIDQuery},
+	})
+	_, err := query(db, &externalIDPs)
+	return externalIDPs, err
+}
+
+func ExternalIDPsByUserID(db *gorm.DB, table, userID string) ([]*model.ExternalIDPView, error) {
+	externalIDPs := make([]*model.ExternalIDPView, 0)
+	orgIDQuery := &usr_model.ExternalIDPSearchQuery{
+		Key:    usr_model.ExternalIDPSearchKeyUserID,
+		Method: global_model.SearchMethodEquals,
+		Value:  userID,
+	}
+	query := repository.PrepareSearchQuery(table, model.ExternalIDPSearchRequest{
+		Queries: []*usr_model.ExternalIDPSearchQuery{orgIDQuery},
+	})
+	_, err := query(db, &externalIDPs)
+	return externalIDPs, err
+}
+
+func SearchExternalIDPs(db *gorm.DB, table string, req *usr_model.ExternalIDPSearchRequest) ([]*model.ExternalIDPView, uint64, error) {
+	externalIDPs := make([]*model.ExternalIDPView, 0)
+	query := repository.PrepareSearchQuery(table, model.ExternalIDPSearchRequest{Limit: req.Limit, Offset: req.Offset, Queries: req.Queries})
+	count, err := query(db, &externalIDPs)
+	if err != nil {
+		return nil, 0, err
+	}
+	return externalIDPs, count, nil
+}
+
+func PutExternalIDPs(db *gorm.DB, table string, externalIDPs ...*model.ExternalIDPView) error {
+	save := repository.PrepareBulkSave(table)
+	u := make([]interface{}, len(externalIDPs))
+	for i, idp := range externalIDPs {
+		u[i] = idp
+	}
+	return save(db, u...)
+}
+
+func PutExternalIDP(db *gorm.DB, table string, idp *model.ExternalIDPView) error {
+	save := repository.PrepareSave(table)
+	return save(db, idp)
+}
+
+func DeleteExternalIDP(db *gorm.DB, table, externalUserID, idpConfigID string) error {
+	delete := repository.PrepareDeleteByKeys(table,
+		repository.Key{Key: model.ExternalIDPSearchKey(usr_model.ExternalIDPSearchKeyExternalUserID), Value: externalUserID},
+		repository.Key{Key: model.ExternalIDPSearchKey(usr_model.ExternalIDPSearchKeyIdpConfigID), Value: idpConfigID},
+	)
+	return delete(db)
+}
--- a/internal/user/repository/view/model/external_idp_query.go
+++ b/internal/user/repository/view/model/external_idp_query.go
@@ -0,0 +1,65 @@
+package model
+
+import (
+	global_model "github.com/caos/zitadel/internal/model"
+	usr_model "github.com/caos/zitadel/internal/user/model"
+	"github.com/caos/zitadel/internal/view/repository"
+)
+
+type ExternalIDPSearchRequest usr_model.ExternalIDPSearchRequest
+type ExternalIDPSearchQuery usr_model.ExternalIDPSearchQuery
+type ExternalIDPSearchKey usr_model.ExternalIDPSearchKey
+
+func (req ExternalIDPSearchRequest) GetLimit() uint64 {
+	return req.Limit
+}
+
+func (req ExternalIDPSearchRequest) GetOffset() uint64 {
+	return req.Offset
+}
+
+func (req ExternalIDPSearchRequest) GetSortingColumn() repository.ColumnKey {
+	if req.SortingColumn == usr_model.ExternalIDPSearchKeyUnspecified {
+		return nil
+	}
+	return ExternalIDPSearchKey(req.SortingColumn)
+}
+
+func (req ExternalIDPSearchRequest) GetAsc() bool {
+	return req.Asc
+}
+
+func (req ExternalIDPSearchRequest) GetQueries() []repository.SearchQuery {
+	result := make([]repository.SearchQuery, len(req.Queries))
+	for i, q := range req.Queries {
+		result[i] = ExternalIDPSearchQuery{Key: q.Key, Value: q.Value, Method: q.Method}
+	}
+	return result
+}
+
+func (req ExternalIDPSearchQuery) GetKey() repository.ColumnKey {
+	return ExternalIDPSearchKey(req.Key)
+}
+
+func (req ExternalIDPSearchQuery) GetMethod() global_model.SearchMethod {
+	return req.Method
+}
+
+func (req ExternalIDPSearchQuery) GetValue() interface{} {
+	return req.Value
+}
+
+func (key ExternalIDPSearchKey) ToColumnName() string {
+	switch usr_model.ExternalIDPSearchKey(key) {
+	case usr_model.ExternalIDPSearchKeyExternalUserID:
+		return ExternalIDPKeyExternalUserID
+	case usr_model.ExternalIDPSearchKeyUserID:
+		return ExternalIDPKeyUserID
+	case usr_model.ExternalIDPSearchKeyIdpConfigID:
+		return ExternalIDPKeyIDPConfigID
+	case usr_model.ExternalIDPSearchKeyResourceOwner:
+		return ExternalIDPKeyResourceOwner
+	default:
+		return ""
+	}
+}
--- a/internal/user/repository/view/model/external_idps.go
+++ b/internal/user/repository/view/model/external_idps.go
@@ -0,0 +1,91 @@
+package model
+
+import (
+	"encoding/json"
+	"github.com/caos/logging"
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/user/model"
+	es_model "github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
+	"time"
+)
+
+const (
+	ExternalIDPKeyExternalUserID = "external_user_id"
+	ExternalIDPKeyUserID         = "user_id"
+	ExternalIDPKeyIDPConfigID    = "idp_config_id"
+	ExternalIDPKeyResourceOwner  = "resource_owner"
+)
+
+type ExternalIDPView struct {
+	ExternalUserID  string    `json:"userID" gorm:"column:external_user_id;primary_key"`
+	IDPConfigID     string    `json:"idpConfigID" gorm:"column:idp_config_id;primary_key"`
+	UserID          string    `json:"-" gorm:"column:user_id"`
+	IDPName         string    `json:"-" gorm:"column:idp_name"`
+	UserDisplayName string    `json:"displayName" gorm:"column:user_display_name"`
+	CreationDate    time.Time `json:"-" gorm:"column:creation_date"`
+	ChangeDate      time.Time `json:"-" gorm:"column:change_date"`
+	ResourceOwner   string    `json:"-" gorm:"column:resource_owner"`
+	Sequence        uint64    `json:"-" gorm:"column:sequence"`
+}
+
+func ExternalIDPViewFromModel(externalIDP *model.ExternalIDPView) *ExternalIDPView {
+	return &ExternalIDPView{
+		UserID:          externalIDP.UserID,
+		IDPConfigID:     externalIDP.IDPConfigID,
+		ExternalUserID:  externalIDP.ExternalUserID,
+		IDPName:         externalIDP.IDPName,
+		UserDisplayName: externalIDP.UserDisplayName,
+		Sequence:        externalIDP.Sequence,
+		CreationDate:    externalIDP.CreationDate,
+		ChangeDate:      externalIDP.ChangeDate,
+		ResourceOwner:   externalIDP.ResourceOwner,
+	}
+}
+
+func ExternalIDPViewToModel(externalIDP *ExternalIDPView) *model.ExternalIDPView {
+	return &model.ExternalIDPView{
+		UserID:          externalIDP.UserID,
+		IDPConfigID:     externalIDP.IDPConfigID,
+		ExternalUserID:  externalIDP.ExternalUserID,
+		IDPName:         externalIDP.IDPName,
+		UserDisplayName: externalIDP.UserDisplayName,
+		Sequence:        externalIDP.Sequence,
+		CreationDate:    externalIDP.CreationDate,
+		ChangeDate:      externalIDP.ChangeDate,
+		ResourceOwner:   externalIDP.ResourceOwner,
+	}
+}
+
+func ExternalIDPViewsToModel(externalIDPs []*ExternalIDPView) []*model.ExternalIDPView {
+	result := make([]*model.ExternalIDPView, len(externalIDPs))
+	for i, r := range externalIDPs {
+		result[i] = ExternalIDPViewToModel(r)
+	}
+	return result
+}
+
+func (i *ExternalIDPView) AppendEvent(event *models.Event) (err error) {
+	i.Sequence = event.Sequence
+	i.ChangeDate = event.CreationDate
+	switch event.Type {
+	case es_model.HumanExternalIDPAdded:
+		i.setRootData(event)
+		i.CreationDate = event.CreationDate
+		err = i.SetData(event)
+	}
+	return err
+}
+
+func (r *ExternalIDPView) setRootData(event *models.Event) {
+	r.UserID = event.AggregateID
+	r.ResourceOwner = event.ResourceOwner
+}
+
+func (r *ExternalIDPView) SetData(event *models.Event) error {
+	if err := json.Unmarshal(event.Data, r); err != nil {
+		logging.Log("EVEN-48sfs").WithError(err).Error("could not unmarshal event data")
+		return caos_errs.ThrowInternal(err, "MODEL-Hs8uf", "Could not unmarshal data")
+	}
+	return nil
+}
--- a/internal/user/repository/view/user_view.go
+++ b/internal/user/repository/view/user_view.go
@@ -46,6 +46,26 @@ func UserByLoginName(db *gorm.DB, table, loginName string) (*model.UserView, err
 	return user, err
 }

+func UserByLoginNameAndResourceOwner(db *gorm.DB, table, loginName, resourceOwner string) (*model.UserView, error) {
+	user := new(model.UserView)
+	loginNameQuery := &model.UserSearchQuery{
+		Key:    usr_model.UserSearchKeyLoginNames,
+		Method: global_model.SearchMethodListContains,
+		Value:  loginName,
+	}
+	resourceOwnerQuery := &model.UserSearchQuery{
+		Key:    usr_model.UserSearchKeyResourceOwner,
+		Method: global_model.SearchMethodEquals,
+		Value:  resourceOwner,
+	}
+	query := repository.PrepareGetByQuery(table, loginNameQuery, resourceOwnerQuery)
+	err := query(db, user)
+	if caos_errs.IsNotFound(err) {
+		return nil, caos_errs.ThrowNotFound(nil, "VIEW-AD4qs", "Errors.User.NotFound")
+	}
+	return user, err
+}
+
 func UsersByOrgID(db *gorm.DB, table, orgID string) ([]*model.UserView, error) {
 	users := make([]*model.UserView, 0)
 	orgIDQuery := &usr_model.UserSearchQuery{