-
+
+
{{ 'APP.OIDC.RESPONSETYPE' | translate }}
-
- [
+
+ [
{{ 'APP.OIDC.RESPONSE.' + element | translate }}
- {{ i < oidcAppRequest.responseTypesList.length - 1 ? ', ' : '' }} ]
-
-
+
+
{{ 'APP.AUTHMETHOD' | translate }}
- {{ 'APP.OIDC.AUTHMETHOD.' + oidcAppRequest.authMethodType | translate }}
+ {{ 'APP.OIDC.AUTHMETHOD.' + oidcAppRequest.toObject().authMethodType | translate }}
-
-
+
+
{{ 'APP.OIDC.REDIRECT' | translate }}
-
- [
+
+ [
{{ redirect }}
- {{ i < oidcAppRequest.redirectUrisList.length - 1 ? ', ' : '' }} ]
-
-
+
+
{{ 'APP.OIDC.POSTLOGOUTREDIRECT' | translate }}
- [
+ [
{{ redirect }}
- {{ i < oidcAppRequest.postLogoutRedirectUrisList.length - 1 ? ', ' : '' }} ]
-
-
+
+
{{ 'APP.AUTHMETHOD' | translate }}
- {{ 'APP.API.AUTHMETHOD.' + apiAppRequest.authMethodType | translate }}
+ {{ 'APP.API.AUTHMETHOD.' + authMethodType?.value | translate }}
+
+
+
+
+
+
+
+
+ {{ 'APP.SAML.METADATA' | translate }}
+
+
+
+ {{ metadataUrl?.value }}
+
+
+ {{ 'APP.SAML.METADATAFROMFILE' | translate }}
@@ -278,15 +374,56 @@
-
- {{ 'APP.AUTHMETHOD' | translate }}
-
-
- {{ 'APP.OIDC.AUTHMETHOD.' + type.type | translate }}
- {{ 'APP.API.AUTHMETHOD.' + type.type | translate }}
-
-
-
+
+
+ {{ 'APP.AUTHMETHOD' | translate }}
+
+
+ {{ 'APP.OIDC.AUTHMETHOD.' + type.type | translate }}
+ {{ 'APP.API.AUTHMETHOD.' + type.type | translate }}
+
+
+
+
+
+
+
+
+ {{ 'APP.SAML.URL' | translate }}
+
+
+
+
{{ 'APP.SAML.OR' | translate }}
+
+
+
+
+
+
+
+
@@ -294,22 +431,22 @@
diff --git a/console/src/app/pages/projects/apps/app-create/app-create.component.scss b/console/src/app/pages/projects/apps/app-create/app-create.component.scss
index a040ea3e50..9a5baa1ec5 100644
--- a/console/src/app/pages/projects/apps/app-create/app-create.component.scss
+++ b/console/src/app/pages/projects/apps/app-create/app-create.component.scss
@@ -61,6 +61,10 @@ p.desc {
}
}
+.cnsl-app-or {
+ margin-right: 1rem;
+}
+
.row {
display: flex;
justify-content: space-between;
@@ -72,10 +76,20 @@ p.desc {
}
}
+.saml-xml {
+ margin-top: 2rem;
+
+ &.disabled {
+ opacity: 0.5;
+ pointer-events: none;
+ }
+}
+
.app-create-actions {
- margin-top: 1rem;
+ margin-top: 2rem;
display: flex;
align-items: center;
+ justify-content: space-between;
.bck-button {
margin-right: 1rem;
@@ -102,6 +116,12 @@ p.desc {
flex-basis: 80%;
}
}
+
+ .saml {
+ display: block;
+ width: 100%;
+ margin: 0 0.5rem;
+ }
}
.continue-button {
diff --git a/console/src/app/pages/projects/apps/app-create/app-create.component.ts b/console/src/app/pages/projects/apps/app-create/app-create.component.ts
index 0d9d12cc18..caf0cefa49 100644
--- a/console/src/app/pages/projects/apps/app-create/app-create.component.ts
+++ b/console/src/app/pages/projects/apps/app-create/app-create.component.ts
@@ -5,6 +5,7 @@ import { Component, OnDestroy, OnInit } from '@angular/core';
import { AbstractControl, UntypedFormBuilder, UntypedFormControl, UntypedFormGroup, Validators } from '@angular/forms';
import { MatDialog } from '@angular/material/dialog';
import { ActivatedRoute, Params, Router } from '@angular/router';
+import { Buffer } from 'buffer';
import { Subject, Subscription } from 'rxjs';
import { debounceTime, takeUntil } from 'rxjs/operators';
import { RadioItemAuthType } from 'src/app/modules/app-radio/app-auth-method-radio/app-auth-method-radio.component';
@@ -14,12 +15,14 @@ import {
OIDCAuthMethodType,
OIDCGrantType,
OIDCResponseType,
+ SAMLConfig,
} from 'src/app/proto/generated/zitadel/app_pb';
import {
AddAPIAppRequest,
AddAPIAppResponse,
AddOIDCAppRequest,
AddOIDCAppResponse,
+ AddSAMLAppRequest,
} from 'src/app/proto/generated/zitadel/management_pb';
import { Breadcrumb, BreadcrumbService, BreadcrumbType } from 'src/app/services/breadcrumb.service';
import { ManagementService } from 'src/app/services/mgmt.service';
@@ -35,7 +38,9 @@ import {
PKCE_METHOD,
POST_METHOD,
} from '../authmethods';
-import { API_TYPE, AppCreateType, NATIVE_TYPE, RadioItemAppType, USER_AGENT_TYPE, WEB_TYPE } from '../authtypes';
+import { API_TYPE, AppCreateType, NATIVE_TYPE, RadioItemAppType, SAML_TYPE, USER_AGENT_TYPE, WEB_TYPE } from '../authtypes';
+
+const MAX_ALLOWED_SIZE = 1 * 1024 * 1024;
@Component({
selector: 'cnsl-app-create',
@@ -49,11 +54,11 @@ export class AppCreateComponent implements OnInit, OnDestroy {
public projectId: string = '';
public loading: boolean = false;
- public createSteps: number = 4;
public currentCreateStep: number = 1;
- public oidcAppRequest: AddOIDCAppRequest.AsObject = new AddOIDCAppRequest().toObject();
- public apiAppRequest: AddAPIAppRequest.AsObject = new AddAPIAppRequest().toObject();
+ public oidcAppRequest: AddOIDCAppRequest = new AddOIDCAppRequest();
+ public apiAppRequest: AddAPIAppRequest = new AddAPIAppRequest();
+ public samlAppRequest: AddSAMLAppRequest = new AddSAMLAppRequest();
public oidcResponseTypes: { type: OIDCResponseType; checked: boolean; disabled: boolean }[] = [
{ type: OIDCResponseType.OIDC_RESPONSE_TYPE_CODE, checked: false, disabled: false },
@@ -66,7 +71,7 @@ export class AppCreateComponent implements OnInit, OnDestroy {
OIDCAppType.OIDC_APP_TYPE_NATIVE,
OIDCAppType.OIDC_APP_TYPE_USER_AGENT,
];
- public appTypes: any = [WEB_TYPE, NATIVE_TYPE, USER_AGENT_TYPE, API_TYPE];
+ public appTypes: any = [WEB_TYPE, NATIVE_TYPE, USER_AGENT_TYPE, API_TYPE, SAML_TYPE];
public authMethods: RadioItemAuthType[] = [PKCE_METHOD, CODE_METHOD, PK_JWT_METHOD, POST_METHOD];
@@ -84,8 +89,12 @@ export class AppCreateComponent implements OnInit, OnDestroy {
];
// stepper
- firstFormGroup!: UntypedFormGroup;
- secondFormGroup!: UntypedFormGroup;
+ public firstFormGroup!: UntypedFormGroup;
+ public secondFormGroup!: UntypedFormGroup;
+ public samlConfigForm!: UntypedFormGroup;
+
+ public redirectUrisList: string[] = [];
+ public postLogoutRedirectUrisList: string[] = [];
// devmode
public form!: UntypedFormGroup;
@@ -121,10 +130,13 @@ export class AppCreateComponent implements OnInit, OnDestroy {
) {
this.form = this.fb.group({
name: ['', [Validators.required]],
- responseTypesList: ['', [Validators.required]],
- grantTypesList: ['', [Validators.required]],
appType: ['', [Validators.required]],
- authMethodType: ['', [Validators.required]],
+ // apptype OIDC
+ responseTypesList: ['', []],
+ grantTypesList: ['', []],
+ authMethodType: ['', []],
+ // apptype SAML
+ metadataUrl: ['', []],
});
this.initForm();
@@ -134,25 +146,30 @@ export class AppCreateComponent implements OnInit, OnDestroy {
appType: [WEB_TYPE, [Validators.required]],
});
+ this.samlConfigForm = this.fb.group({
+ metadataUrl: ['', []],
+ });
+
this.firstFormGroup.valueChanges.subscribe((value) => {
if (this.firstFormGroup.valid) {
- this.oidcAppRequest.name = this.name?.value;
- this.apiAppRequest.name = this.name?.value;
+ this.oidcAppRequest.setName(this.name?.value);
+ this.apiAppRequest.setName(this.name?.value);
+ this.samlAppRequest.setName(this.name?.value);
if (this.isStepperOIDC) {
const oidcAppType = (this.appType?.value as RadioItemAppType).oidcAppType;
if (oidcAppType !== undefined) {
- this.oidcAppRequest.appType = oidcAppType;
+ this.oidcAppRequest.setAppType(oidcAppType);
}
- switch (this.oidcAppRequest.appType) {
+ switch (this.appType?.value.oidcAppType) {
case OIDCAppType.OIDC_APP_TYPE_NATIVE:
this.authMethods = [PKCE_METHOD];
// automatically set to PKCE and skip step
- this.oidcAppRequest.responseTypesList = [OIDCResponseType.OIDC_RESPONSE_TYPE_CODE];
- this.oidcAppRequest.grantTypesList = [OIDCGrantType.OIDC_GRANT_TYPE_AUTHORIZATION_CODE];
- this.oidcAppRequest.authMethodType = OIDCAuthMethodType.OIDC_AUTH_METHOD_TYPE_NONE;
+ this.oidcAppRequest.setResponseTypesList([OIDCResponseType.OIDC_RESPONSE_TYPE_CODE]);
+ this.oidcAppRequest.setGrantTypesList([OIDCGrantType.OIDC_GRANT_TYPE_AUTHORIZATION_CODE]);
+ this.oidcAppRequest.setAuthMethodType(OIDCAuthMethodType.OIDC_AUTH_METHOD_TYPE_NONE);
break;
case OIDCAppType.OIDC_APP_TYPE_WEB:
@@ -179,19 +196,28 @@ export class AppCreateComponent implements OnInit, OnDestroy {
this.secondFormGroup = this.fb.group({
authMethod: [this.authMethods[0].key, [Validators.required]],
});
+
this.secondFormGroup.valueChanges.subscribe((form) => {
const partialConfig = getPartialConfigFromAuthMethod(form.authMethod);
if (this.isStepperOIDC && partialConfig && partialConfig.oidc) {
- this.oidcAppRequest.responseTypesList = partialConfig.oidc?.responseTypesList ?? [];
+ this.oidcAppRequest.setResponseTypesList(partialConfig.oidc?.responseTypesList ?? []);
- this.oidcAppRequest.grantTypesList = partialConfig.oidc?.grantTypesList ?? [];
+ this.oidcAppRequest.setGrantTypesList(partialConfig.oidc?.grantTypesList ?? []);
- this.oidcAppRequest.authMethodType =
- partialConfig.oidc?.authMethodType ?? OIDCAuthMethodType.OIDC_AUTH_METHOD_TYPE_NONE;
+ this.oidcAppRequest.setAuthMethodType(
+ partialConfig.oidc?.authMethodType ?? OIDCAuthMethodType.OIDC_AUTH_METHOD_TYPE_NONE,
+ );
} else if (this.isStepperAPI && partialConfig && partialConfig.api) {
- this.apiAppRequest.authMethodType =
- partialConfig.api?.authMethodType ?? APIAuthMethodType.API_AUTH_METHOD_TYPE_BASIC;
+ this.apiAppRequest.setAuthMethodType(
+ partialConfig.api?.authMethodType ?? APIAuthMethodType.API_AUTH_METHOD_TYPE_BASIC,
+ );
+ }
+ });
+
+ this.samlConfigForm.valueChanges.subscribe((form) => {
+ if (form.metadataUrl && form.metadataUrl.length > 0) {
+ this.samlAppRequest.setMetadataUrl(form.metadataUrl);
}
});
}
@@ -225,18 +251,23 @@ export class AppCreateComponent implements OnInit, OnDestroy {
public initForm(): void {
this.form.valueChanges.pipe(takeUntil(this.destroyed$), debounceTime(150)).subscribe(() => {
- this.oidcAppRequest.name = this.formname?.value;
- this.apiAppRequest.name = this.formname?.value;
+ this.oidcAppRequest.setName(this.formname?.value);
+ this.apiAppRequest.setName(this.formname?.value);
+ this.samlAppRequest.setName(this.formname?.value);
- this.oidcAppRequest.responseTypesList = this.formresponseTypesList?.value;
- this.oidcAppRequest.grantTypesList = this.formgrantTypesList?.value;
+ this.oidcAppRequest.setResponseTypesList(this.formresponseTypesList?.value);
+ this.oidcAppRequest.setGrantTypesList(this.grantTypesList?.value);
- this.oidcAppRequest.authMethodType = this.formauthMethodType?.value;
- this.apiAppRequest.authMethodType = this.formauthMethodType?.value;
+ this.oidcAppRequest.setAuthMethodType(this.authMethodType?.value);
+ this.apiAppRequest.setAuthMethodType(this.authMethodType?.value);
+
+ if (this.formMetadataUrl?.value) {
+ this.samlAppRequest.setMetadataUrl(this.formMetadataUrl?.value);
+ }
const oidcAppType = (this.formappType?.value as RadioItemAppType).oidcAppType;
if (oidcAppType !== undefined) {
- this.oidcAppRequest.appType = oidcAppType;
+ this.oidcAppRequest.setAppType(oidcAppType);
}
});
@@ -282,17 +313,41 @@ export class AppCreateComponent implements OnInit, OnDestroy {
private async getData({ projectid }: Params): Promise {
this.projectId = projectid;
- this.oidcAppRequest.projectId = projectid;
- this.apiAppRequest.projectId = projectid;
+ this.oidcAppRequest.setProjectId(projectid);
+ this.apiAppRequest.setProjectId(projectid);
+ this.samlAppRequest.setProjectId(projectid);
}
public close(): void {
this._location.back();
}
+ public onDropXML(filelist: FileList): void {
+ const file = filelist.item(0);
+ this.metadataUrl?.setValue('');
+ if (file) {
+ if (file.size > MAX_ALLOWED_SIZE) {
+ this.toast.showInfo('POLICY.PRIVATELABELING.MAXSIZEEXCEEDED', true);
+ } else {
+ const reader = new FileReader();
+ reader.onload = ((aXML) => {
+ return (e) => {
+ const xmlBase64 = e.target?.result;
+ if (xmlBase64 && typeof xmlBase64 === 'string') {
+ const cropped = xmlBase64.replace('data:text/xml;base64,', '');
+ this.samlAppRequest.setMetadataXml(cropped);
+ }
+ };
+ })(file);
+ reader.readAsDataURL(file);
+ }
+ }
+ }
+
public createApp(): void {
const appOIDCCheck = this.devmode ? this.isDevOIDC : this.isStepperOIDC;
const appAPICheck = this.devmode ? this.isDevAPI : this.isStepperAPI;
+ const appSAMLCheck = this.devmode ? this.isDevSAML : this.isStepperSAML;
if (appOIDCCheck) {
this.requestRedirectValuesSubject$.next();
@@ -331,6 +386,19 @@ export class AppCreateComponent implements OnInit, OnDestroy {
this.loading = false;
this.toast.showError(error);
});
+ } else if (appSAMLCheck) {
+ this.loading = true;
+ this.toast.showInfo('APP.TOAST.CREATED', true);
+ this.mgmtService
+ .addSAMLApp(this.samlAppRequest)
+ .then((resp) => {
+ this.loading = false;
+ this.router.navigate(['projects', this.projectId, 'apps', resp.appId]);
+ })
+ .catch((error) => {
+ this.loading = false;
+ this.toast.showError(error);
+ });
}
}
@@ -381,19 +449,27 @@ export class AppCreateComponent implements OnInit, OnDestroy {
get formname(): AbstractControl | null {
return this.form.get('name');
}
+
get formresponseTypesList(): AbstractControl | null {
return this.form.get('responseTypesList');
}
- get formgrantTypesList(): AbstractControl | null {
+
+ get grantTypesList(): AbstractControl | null {
return this.form.get('grantTypesList');
}
+
get formappType(): AbstractControl | null {
return this.form.get('appType');
}
+
+ get formMetadataUrl(): AbstractControl | null {
+ return this.form.get('metadataUrl');
+ }
// get formapplicationType(): AbstractControl | null {
// return this.form.get('applicationType');
// }
- get formauthMethodType(): AbstractControl | null {
+
+ get authMethodType(): AbstractControl | null {
return this.form.get('authMethodType');
}
@@ -409,7 +485,35 @@ export class AppCreateComponent implements OnInit, OnDestroy {
return (this.formappType?.value as RadioItemAppType).createType === AppCreateType.API;
}
+ get isDevSAML(): boolean {
+ return (this.formappType?.value as RadioItemAppType).createType === AppCreateType.SAML;
+ }
+
get isStepperAPI(): boolean {
return (this.appType?.value as RadioItemAppType).createType === AppCreateType.API;
}
+
+ get isStepperSAML(): boolean {
+ return (this.appType?.value as RadioItemAppType).createType === AppCreateType.SAML;
+ }
+
+ get decodedBase64(): string {
+ const samlReq = this.samlAppRequest.toObject();
+ if (samlReq && samlReq.metadataXml && typeof samlReq.metadataXml === 'string') {
+ return Buffer.from(samlReq.metadataXml, 'base64').toString('ascii');
+ } else {
+ return '';
+ }
+ }
+
+ set decodedBase64(xmlString) {
+ if (this.samlAppRequest) {
+ const base64 = Buffer.from(xmlString, 'ascii').toString('base64');
+ this.samlAppRequest.setMetadataXml(base64);
+ }
+ }
+
+ public get metadataUrl(): AbstractControl | null {
+ return this.samlConfigForm.get('metadataUrl');
+ }
}
diff --git a/console/src/app/pages/projects/apps/app-detail/app-detail.component.html b/console/src/app/pages/projects/apps/app-detail/app-detail.component.html
index 78688eed71..1feab1b10c 100644
--- a/console/src/app/pages/projects/apps/app-detail/app-detail.component.html
+++ b/console/src/app/pages/projects/apps/app-detail/app-detail.component.html
@@ -2,7 +2,7 @@
title="{{ app?.name }}"
[hasActions]="isZitadel === false && (['project.app.write:' + projectId, 'project.app.write'] | hasRole | async)"
docLink="https://docs.zitadel.com/docs/guides/basics/projects"
- [sub]="app?.oidcConfig ? ('APP.OIDC.APPTYPE.' + app?.oidcConfig?.appType | translate) : 'API'"
+ [sub]="app?.oidcConfig ? ('APP.OIDC.APPTYPE.' + app?.oidcConfig?.appType | translate) : app?.apiConfig ? 'API' : 'SAML'"
[isActive]="app?.state === AppState.APP_STATE_ACTIVE"
[isInactive]="app?.state === AppState.APP_STATE_INACTIVE"
stateTooltip="{{ 'APP.PAGES.DETAIL.STATE.' + app?.state | translate }}"
@@ -156,6 +156,60 @@
+ {{ 'APP.SAML.OR' | translate }}
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/console/src/app/pages/projects/apps/app-detail/app-detail.component.scss b/console/src/app/pages/projects/apps/app-detail/app-detail.component.scss
index dde560bcd3..93c2523962 100644
--- a/console/src/app/pages/projects/apps/app-detail/app-detail.component.scss
+++ b/console/src/app/pages/projects/apps/app-detail/app-detail.component.scss
@@ -158,6 +158,24 @@
margin-left: 1rem;
}
}
+
+ .cnsl-saml-config-line {
+ display: flex;
+ align-items: center;
+
+ .cnsl-app-or {
+ margin-right: 1rem;
+ }
+ }
+
+ .saml-xml {
+ margin-top: 2rem;
+
+ &.disabled {
+ opacity: 0.5;
+ pointer-events: none;
+ }
+ }
}
}
diff --git a/console/src/app/pages/projects/apps/app-detail/app-detail.component.ts b/console/src/app/pages/projects/apps/app-detail/app-detail.component.ts
index 367cc55c4f..7a3248e4b2 100644
--- a/console/src/app/pages/projects/apps/app-detail/app-detail.component.ts
+++ b/console/src/app/pages/projects/apps/app-detail/app-detail.component.ts
@@ -7,6 +7,7 @@ import { MatCheckboxChange } from '@angular/material/checkbox';
import { MatDialog } from '@angular/material/dialog';
import { ActivatedRoute, Router } from '@angular/router';
import { TranslateService } from '@ngx-translate/core';
+import { Buffer } from 'buffer';
import { Duration } from 'google-protobuf/google/protobuf/duration_pb';
import { Subject, Subscription } from 'rxjs';
import { take } from 'rxjs/operators';
@@ -27,11 +28,13 @@ import {
OIDCGrantType,
OIDCResponseType,
OIDCTokenType,
+ SAMLConfig,
} from 'src/app/proto/generated/zitadel/app_pb';
import {
GetOIDCInformationResponse,
UpdateAPIAppConfigRequest,
UpdateOIDCAppConfigRequest,
+ UpdateSAMLAppConfigRequest,
} from 'src/app/proto/generated/zitadel/management_pb';
import { Breadcrumb, BreadcrumbService, BreadcrumbType } from 'src/app/services/breadcrumb.service';
import { GrpcAuthService } from 'src/app/services/grpc-auth.service';
@@ -52,6 +55,8 @@ import {
} from '../authmethods';
import { AuthMethodDialogComponent } from './auth-method-dialog/auth-method-dialog.component';
+const MAX_ALLOWED_SIZE = 1 * 1024 * 1024;
+
@Component({
selector: 'cnsl-app-detail',
templateUrl: './app-detail.component.html',
@@ -104,6 +109,7 @@ export class AppDetailComponent implements OnInit, OnDestroy {
public oidcForm!: UntypedFormGroup;
public oidcTokenForm!: UntypedFormGroup;
public apiForm!: UntypedFormGroup;
+ public samlForm!: UntypedFormGroup;
public redirectUrisList: string[] = [];
public postLogoutRedirectUrisList: string[] = [];
@@ -162,6 +168,11 @@ export class AppDetailComponent implements OnInit, OnDestroy {
authMethodType: [{ value: '', disabled: true }],
});
+ this.samlForm = this.fb.group({
+ metadataUrl: [{ value: '', disabled: true }],
+ metadataXml: [{ value: '', disabled: true }],
+ });
+
this.http.get('./assets/environment.json').subscribe((env: any) => {
this.environmentMap = {
issuer: env.issuer,
@@ -290,12 +301,15 @@ export class AppDetailComponent implements OnInit, OnDestroy {
} else {
this.authMethods = this.authMethods.filter((element) => element !== CUSTOM_METHOD);
}
+ } else if (this.app.samlConfig) {
+ this.settingsList = [{ id: 'configuration', i18nKey: 'APP.CONFIGURATION' }];
}
if (allowed) {
this.oidcForm.enable();
this.oidcTokenForm.enable();
this.apiForm.enable();
+ this.samlForm.enable();
}
if (this.app.oidcConfig?.redirectUrisList) {
@@ -370,6 +384,30 @@ export class AppDetailComponent implements OnInit, OnDestroy {
}
}
+ public onDropXML(filelist: FileList): void {
+ const file = filelist.item(0);
+ if (file) {
+ if (file.size > MAX_ALLOWED_SIZE) {
+ this.toast.showInfo('POLICY.PRIVATELABELING.MAXSIZEEXCEEDED', true);
+ } else {
+ this.metadataUrl?.setValue('');
+ const reader = new FileReader();
+ reader.onload = ((aXML) => {
+ return (e) => {
+ const xmlBase64 = e.target?.result;
+ if (xmlBase64 && typeof xmlBase64 === 'string' && this.app?.samlConfig) {
+ const samlConfig = new SAMLConfig();
+ const cropped = xmlBase64.replace('data:text/xml;base64,', '');
+ samlConfig.setMetadataXml(cropped);
+ this.app.samlConfig.metadataXml = cropped;
+ }
+ };
+ })(file);
+ reader.readAsDataURL(file);
+ }
+ }
+ }
+
public authMethodFromPartialConfig(config: { oidc?: OIDCConfig.AsObject; api?: APIConfig.AsObject }): string {
const key = getAuthMethodFromPartialConfig(config);
return key;
@@ -581,6 +619,28 @@ export class AppDetailComponent implements OnInit, OnDestroy {
}
}
+ public saveSAMLApp(): void {
+ if (this.samlForm.valid && this.app?.samlConfig) {
+ const req = new UpdateSAMLAppConfigRequest();
+ req.setProjectId(this.projectId);
+ req.setAppId(this.app.id);
+
+ if (this.app.samlConfig) {
+ req.setMetadataUrl(this.app.samlConfig?.metadataUrl);
+ req.setMetadataXml(this.app.samlConfig?.metadataXml);
+ }
+
+ this.mgmtService
+ .updateSAMLAppConfig(req)
+ .then(() => {
+ this.toast.showInfo('APP.TOAST.APIUPDATED', true);
+ })
+ .catch((error) => {
+ this.toast.showError(error);
+ });
+ }
+ }
+
public regenerateOIDCClientSecret(): void {
if (this.app) {
this.mgmtService
@@ -693,4 +753,31 @@ export class AppDetailComponent implements OnInit, OnDestroy {
public get clockSkewSeconds(): AbstractControl | null {
return this.oidcTokenForm.get('clockSkewSeconds');
}
+
+ public get metadataUrl(): AbstractControl | null {
+ return this.samlForm.get('metadataUrl');
+ }
+
+ get decodedBase64(): string {
+ if (
+ this.app &&
+ this.app.samlConfig &&
+ this.app.samlConfig.metadataXml &&
+ typeof this.app.samlConfig.metadataXml === 'string'
+ ) {
+ return Buffer.from(this.app?.samlConfig.metadataXml, 'base64').toString('ascii');
+ } else {
+ return '';
+ }
+ }
+
+ set decodedBase64(xmlString: string) {
+ if (this.app && this.app.samlConfig && this.app.samlConfig.metadataXml) {
+ const base64 = Buffer.from(xmlString, 'ascii').toString('base64');
+
+ if (this.app.samlConfig) {
+ this.app.samlConfig.metadataXml = base64;
+ }
+ }
+ }
}
diff --git a/console/src/app/pages/projects/apps/apps.module.ts b/console/src/app/pages/projects/apps/apps.module.ts
index f891021603..51c7cf193e 100644
--- a/console/src/app/pages/projects/apps/apps.module.ts
+++ b/console/src/app/pages/projects/apps/apps.module.ts
@@ -16,6 +16,7 @@ import { MatSlideToggleModule } from '@angular/material/slide-toggle';
import { MatSliderModule } from '@angular/material/slider';
import { MatStepperModule } from '@angular/material/stepper';
import { MatTooltipModule } from '@angular/material/tooltip';
+import { CodemirrorModule } from '@ctrl/ngx-codemirror';
import { TranslateModule } from '@ngx-translate/core';
import { CopyToClipboardModule } from 'src/app/directives/copy-to-clipboard/copy-to-clipboard.module';
import { HasRoleModule } from 'src/app/directives/has-role/has-role.module';
@@ -89,6 +90,7 @@ import { RedirectUrisComponent } from './redirect-uris/redirect-uris.component';
InputModule,
MetaLayoutModule,
MatSliderModule,
+ CodemirrorModule,
ChangesModule,
InfoSectionModule,
],
diff --git a/console/src/app/pages/projects/apps/authtypes.ts b/console/src/app/pages/projects/apps/authtypes.ts
index acaf5d13ec..a6fd8a33c9 100644
--- a/console/src/app/pages/projects/apps/authtypes.ts
+++ b/console/src/app/pages/projects/apps/authtypes.ts
@@ -10,6 +10,7 @@ import { OIDCAppType } from 'src/app/proto/generated/zitadel/app_pb';
export enum AppCreateType {
API = 'API',
OIDC = 'OIDC',
+ SAML = 'SAML',
}
export interface RadioItemAppType {
@@ -20,6 +21,7 @@ export interface RadioItemAppType {
descI18nKey: string;
prefix: string;
background: string;
+ protocol: 'OIDC' | 'SAML';
}
export const WEB_TYPE: RadioItemAppType = {
@@ -30,6 +32,7 @@ export const WEB_TYPE: RadioItemAppType = {
oidcAppType: OIDCAppType.OIDC_APP_TYPE_WEB,
prefix: 'WEB',
background: 'linear-gradient(40deg, #059669 30%, #047857)',
+ protocol: 'OIDC',
};
export const USER_AGENT_TYPE: RadioItemAppType = {
@@ -40,6 +43,7 @@ export const USER_AGENT_TYPE: RadioItemAppType = {
oidcAppType: OIDCAppType.OIDC_APP_TYPE_USER_AGENT,
prefix: 'UA',
background: 'linear-gradient(40deg, #dc2626 30%, #db2777)',
+ protocol: 'OIDC',
};
export const NATIVE_TYPE: RadioItemAppType = {
@@ -50,6 +54,7 @@ export const NATIVE_TYPE: RadioItemAppType = {
oidcAppType: OIDCAppType.OIDC_APP_TYPE_NATIVE,
prefix: 'N',
background: 'linear-gradient(40deg, #306ccc 30%, #4f46e5)',
+ protocol: 'OIDC',
};
export const API_TYPE: RadioItemAppType = {
@@ -59,4 +64,14 @@ export const API_TYPE: RadioItemAppType = {
createType: AppCreateType.API,
prefix: 'API',
background: 'linear-gradient(40deg, #1f2937, #111827)',
+ protocol: 'OIDC',
+};
+
+export const SAML_TYPE: RadioItemAppType = {
+ titleI18nKey: 'APP.SAML.SELECTION.TITLE',
+ descI18nKey: 'APP.SAML.SELECTION.DESCRIPTION',
+ createType: AppCreateType.SAML,
+ prefix: 'SAML',
+ background: 'linear-gradient(40deg,rgb(110, 56, 124), rgb(88, 37, 103))',
+ protocol: 'SAML',
};
diff --git a/console/src/app/pages/projects/owned-projects/owned-project-detail/application-grid/application-grid.component.html b/console/src/app/pages/projects/owned-projects/owned-project-detail/application-grid/application-grid.component.html
index f5d043c4d4..19ceec9f8b 100644
--- a/console/src/app/pages/projects/owned-projects/owned-project-detail/application-grid/application-grid.component.html
+++ b/console/src/app/pages/projects/owned-projects/owned-project-detail/application-grid/application-grid.component.html
@@ -17,20 +17,27 @@
*ngFor="let app of appsSubject | async"
matTooltip="{{ 'ACTIONS.EDIT' | translate }}"
>
-
+
{{ app.name.charAt(0) }}
-
-
-
+
+
+
+ SAML
{{ app.name }}
{{ 'APP.OIDC.APPTYPE.' + app.oidcConfig?.appType | translate }}
API
+ SAML
|
-| hide_login_name_suffix | bool | hides the org suffix on the login form if the scope \"urn:zitadel:iam:org:domain:primary:{domainname}\" is set. Details about this [scope in](../openidoauth/scopes) | |
+| hide_login_name_suffix | bool | hides the org suffix on the login form if the scope \"urn:zitadel:iam:org:domain:primary:{domainname}\" is set. Details about this scope in https://docs.zitadel.com/concepts#Reserved_Scopes | |
| warn_color | string | - | string.max_len: 50
|
| background_color | string | - | string.max_len: 50
|
| font_color | string | - | string.max_len: 50
|
@@ -3670,6 +3695,32 @@ This is an empty request
+### AddSAMLAppRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| project_id | string | - | string.min_len: 1
string.max_len: 200
|
+| name | string | - | string.min_len: 1
string.max_len: 200
|
+| [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) metadata.metadata_xml | bytes | - | bytes.max_len: 500000
|
+| [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) metadata.metadata_url | string | - | string.max_len: 200
|
+
+
+
+
+### AddSAMLAppResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| app_id | string | - | |
+| details | zitadel.v1.ObjectDetails | - | |
+
+
+
+
### AddSecondFactorToLoginPolicyRequest
@@ -8309,6 +8360,31 @@ This is an empty request
+### UpdateSAMLAppConfigRequest
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| project_id | string | - | string.min_len: 1
string.max_len: 200
|
+| app_id | string | - | string.min_len: 1
string.max_len: 200
|
+| [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) metadata.metadata_xml | bytes | - | bytes.max_len: 500000
|
+| [**oneof**](https://developers.google.com/protocol-buffers/docs/proto3#oneof) metadata.metadata_url | string | - | string.max_len: 200
|
+
+
+
+
+### UpdateSAMLAppConfigResponse
+
+
+
+| Field | Type | Description | Validation |
+| ----- | ---- | ----------- | ----------- |
+| details | zitadel.v1.ObjectDetails | - | |
+
+
+
+
### UpdateUserGrantRequest
diff --git a/docs/docs/apis/proto/policy.md b/docs/docs/apis/proto/policy.md
index aca3a0d755..026836f72f 100644
--- a/docs/docs/apis/proto/policy.md
+++ b/docs/docs/apis/proto/policy.md
@@ -33,7 +33,7 @@ title: zitadel/policy.proto
| details | zitadel.v1.ObjectDetails | - | |
| primary_color | string | hex value for primary color | |
| is_default | bool | defines if the organisation's admin changed the policy | |
-| hide_login_name_suffix | bool | hides the org suffix on the login form if the scope \"urn:zitadel:iam:org:domain:primary:{domainname}\" is set. Details about this [scope in](../openidoauth/scopes) | |
+| hide_login_name_suffix | bool | hides the org suffix on the login form if the scope \"urn:zitadel:iam:org:domain:primary:{domainname}\" is set. Details about this scope in https://docs.zitadel.com/concepts#Reserved_Scopes | |
| warn_color | string | hex value for secondary color | |
| background_color | string | hex value for background color | |
| font_color | string | hex value for font color | |
diff --git a/docs/docs/apis/saml/endpoints.md b/docs/docs/apis/saml/endpoints.md
new file mode 100644
index 0000000000..4cd186510c
--- /dev/null
+++ b/docs/docs/apis/saml/endpoints.md
@@ -0,0 +1,60 @@
+---
+title: Endpoints
+---
+
+## SAML 2.0 Metadata
+
+The SAML Metadata is located within the issuer domain. This would give us {your_domain}/saml/v2/metadata.
+
+This metadata contains all the information defined in the spec.
+
+**Link to
+spec.** [Metadata for the OASIS Security Assertion Markup Language (SAML) V2.0 – Errata Composite](https://www.oasis-open.org/committees/download.php/35391/sstc-saml-metadata-errata-2.0-wd-04-diff.pdf)
+
+## Certificate Endpoint
+
+{your_domain}/saml/v2/certificate
+
+The certificate endpoint provides the certificate which is used to sign the responses for download, for easier use with
+different service providers which want the certificate separately instead of inside the metadata.
+
+## SSO Endpoint
+
+{your_domain}/saml/v2/SSO
+
+The SSO endpoint is the starting point for all initial user authentications. The user agent (browser) will be redirected
+to this endpoint to authenticate the user.
+
+Supported on this endpoint or currently `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect`
+or `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST` bindings.
+
+**Link to
+spec.** [Bindings for the OASIS Security Assertion Markup Language (SAML) V2.0 – Errata Composite](https://www.oasis-open.org/committees/download.php/35387/sstc-saml-bindings-errata-2.0-wd-05-diff.pdf)
+
+### Required request parameters
+
+| Parameter | Description |
+|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| RelayState | ID to associate the exchange with the original request. |
+| SAMLRequest | The request made to the SAML IDP. (base64 encoded) |
+| SigAlg | Algorithm used to sign the request, only if binding is 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' as signature has to be provided es separate parameter. (base64 encoded) |
+| Signature | Signature of the request as parameter with 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' binding. (base64 encoded) |
+
+### Successful Response
+
+Depending on the content of the request the response comes back in the requested binding, but the content is the same.
+
+| Parameter | Description |
+|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| RelayState | ID to associate the exchange with the original request. |
+| SAMLResponse | The response form the SAML IDP. (base64 encoded) |
+| SigAlg | Algorithm used to sign the response, only if binding is 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' as signature has to be provided es separate parameter. (base64 encoded) |
+| Signature | Signature of the response as parameter with 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' binding. (base64 encoded) |
+
+### Error Response
+
+Regardless of the error, the used http error code will be '200', which represents a successful request. Whereas the
+response will contain a StatusCode include a message which provides more information if an error occurred.
+
+**Link to
+spec** [Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0 – Errata Composite](https://www.oasis-open.org/committees/download.php/35711/sstc-saml-core-errata-2.0-wd-06-diff.pdf)
\ No newline at end of file
diff --git a/docs/docs/concepts/architecture/software.md b/docs/docs/concepts/architecture/software.md
index 85a762e0f7..cd9c03b01f 100644
--- a/docs/docs/concepts/architecture/software.md
+++ b/docs/docs/concepts/architecture/software.md
@@ -40,6 +40,7 @@ All APIs of ZITADEL are always available as gRCP, gRPC-web and REST service.
The only exception is the [OpenID Connect & OAuth](/docs/apis/openidoauth/endpoints) and [Asset API](/docs/apis/introduction#assets) due their unique nature.
- [OpenID Connect & OAuth](/docs/apis/openidoauth/endpoints) - allows to request authentication and authorization of ZITADEL
+- [SAML](/docs/apis/saml/endpoints) - allows to request authentication and authorization of ZITADEL through the SAML standard
- [Authentication API](/docs/apis/introduction#authentication) - allow a user to do operation in its own context
- [Management API](/docs/apis/introduction#management) - allows an admin or machine to manage the ZITADEL resources on an organization level
- [Administration API](/docs/apis/introduction#administration) - allows an admin or machine to manage the ZITADEL resources on an instance level
diff --git a/docs/docs/guides/integrate/atlassian-saml.md b/docs/docs/guides/integrate/atlassian-saml.md
new file mode 100644
index 0000000000..894ea717a8
--- /dev/null
+++ b/docs/docs/guides/integrate/atlassian-saml.md
@@ -0,0 +1,96 @@
+---
+title: Connect with Atlassian through SAML 2.0
+---
+
+This guide shows how to enable login with ZITADEL on Atlassian.
+
+It covers how to:
+
+- create and configure the application in your project
+- create and configure the connection in Atlassian Access
+
+Prerequisites:
+
+- existing ZITADEL Instance, if not present follow [this guide](../../guides/start/quickstart)
+- existing ZITADEL Organization, if not present follow [this guide](../../guides/manage/console/organizations)
+- existing ZITADEL project, if not present follow the first 3 steps [here](../../guides/manage/console/projects)
+- existing Atlassian Access setup, including verified domain
+
+> We have to switch between ZITADEL and Atlassian. If the headings begin with "ZITADEL" switch to the ZITADEL
+> Console and
+> if the headings start with "Atlassian" please switch to the Atlassian Admin GUI.
+
+## **Atlassian**: Create a new external identity provider
+
+Please follow the instructions on [Atlassian's support page](https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-with-an-identity-provider/) to configure a SAML identity provider for SSO.
+The following instructions give you a quick overview of the most important steps.
+
+Login to Atlassian's security center and select Identity providers.
+Select the option to Set up SAML single sign-on.
+
+
+For Identity Provider select "Other provider" and enter a Directory Name.
+
+
+Follow the wizard.
+Fill in the following information:
+
+- `Identity provider Entity ID`: {your_instance_domain}/saml/v2/metadata
+- `Identity provider SSO URL`: {your_instance_domain}/saml/v2/SSO
+- `Public x509 certificate`: You need to download and paste the value of the certificate from {your_instance_domain}/saml/v2/certificate
+
+
+
+Create a new .xml file with the following minimal SAML metadata contents:
+
+```xml
+
+
+
+
+
+
+```
+
+Set or replace the variables with the values from the next screen as follows:
+
+- `${ENTITYID}`: Copy the value from "Service provider entity URL"
+- `${ACSURL}`: Copy the value from "Service provider assertion consumer service URL"
+
+
+
+## **ZITADEL**: Create the application
+
+In your existing project:
+
+Press the "+"-button to add an application
+
+
+Fill in a name for the application and chose the SAML type, then click "Continue".
+
+
+Either fill in the URL where ZITADEL can read the metadata from, or upload the metadata XML directly, then click "Continue".
+
+
+Check your application, if everything is correct, press "Create".
+
+
+## **Atlassian**: Setup authentication policies
+
+Under Authentication policies, select "Edit" on the directory that you have created.
+Then check the box "Enforce single sign-on" and confirm by clicking "Update".
+
+
+Add members to your policy.
+
+
+## Verify configuration
+
+Now you should be all set to verify your setup:
+
+- Create an user in ZITADEL with the same email address as a member in your authentication policy.
+- In a new browser session go to https://id.atlassian.com
+- Enter the user's email address
+- You should be redirected to ZITADEL's Login screen
+- Enter the email address and password
+- Continue and you should be redirected back to Atlassian
diff --git a/docs/docs/guides/integrate/auth0.md b/docs/docs/guides/integrate/auth0-oidc.md
similarity index 95%
rename from docs/docs/guides/integrate/auth0.md
rename to docs/docs/guides/integrate/auth0-oidc.md
index 7d0a1fe42c..54d3173d5b 100644
--- a/docs/docs/guides/integrate/auth0.md
+++ b/docs/docs/guides/integrate/auth0-oidc.md
@@ -1,5 +1,5 @@
---
-title: Connect with Auth0
+title: Connect with Auth0 through OIDC
---
This guide shows how to enable login with ZITADEL on Auth0.
@@ -16,7 +16,7 @@ Prerequisites:
- existing ZITADEL project, if not present follow the first 3 steps [here](../../guides/manage/console/projects)
- existing Auth0 tenant as described [here](https://auth0.com/docs/get-started/auth0-overview/create-tenants)
-> We have to switch between ZITADEL and a Auth0. If the headings begin with "ZITADEL" switch to the ZITADEL Console and if the headings start with Auth0 please switch to the Auth0 GUI.
+> We have to switch between ZITADEL and a Auth0. If the headings begin with "ZITADEL" switch to the ZITADEL Console and if the headings start with "Auth0" please switch to the Auth0 GUI.
## **Auth0**: Create a new connection
diff --git a/docs/docs/guides/integrate/auth0-saml.md b/docs/docs/guides/integrate/auth0-saml.md
new file mode 100644
index 0000000000..610db0a6bb
--- /dev/null
+++ b/docs/docs/guides/integrate/auth0-saml.md
@@ -0,0 +1,78 @@
+---
+title: Connect with Auth0 through SAML 2.0
+---
+
+This guide shows how to enable login with ZITADEL on Auth0.
+
+It covers how to:
+
+- create and configure the application in your project
+- create and configure the connection in your Auth0 tenant
+
+Prerequisites:
+
+- existing ZITADEL Instance, if not present follow [this guide](../../guides/start/quickstart)
+- existing ZITADEL Organization, if not present follow [this guide](../../guides/manage/console/organizations)
+- existing ZITADEL project, if not present follow the first 3 steps [here](../../guides/manage/console/projects)
+- existing Auth0 tenant as described [here](https://auth0.com/docs/get-started/auth0-overview/create-tenants)
+
+> We have to switch between ZITADEL and a Auth0. If the headings begin with "ZITADEL" switch to the ZITADEL Console and
+> if the headings start with "Auth0" please switch to the Auth0 GUI.
+
+## **Auth0**: Create a new connection
+
+In Authentication -> Enterprise
+
+
+1. Press the "+" button right to "SAML"
+ 
+2. Fill out the fields as follows in the SAML Connection:
+ 
+
+This includes:
+
+- a unique "Connection name"
+- the "Sign In URL"
+- the "Sign Out URL"
+- used "User ID Attribute"
+- the definition how the request should be signed
+- which binding should be used to call ZITADEL
+
+All the information is filled out as an example, and to connect with any other environment you only have to change the
+used domain, for example "example.com" with "zitadel.cloud".
+Lastly, upload the certificate used to sign the reponses, provided for you under the
+URL {your_instance_domain}/saml/v2/certificate.
+
+Then just press the button "Create" and the connection on Auth0 is configured.
+
+## **ZITADEL**: Create the application
+
+You need to upload the SAML metadata to ZITADEL for it to recognize this newly created connection.
+[Under this link](https://auth0.com/docs/authenticate/protocols/saml/saml-identity-provider-configuration-settings) are
+all necessary information to correctly fill out the metadata or download the metadata-file directly under the
+URL https://YOUR_AUTH0_DOMAIN/samlp/metadata?connection=YOUR_CONNECTION_NAME, which in this example would
+be https://example.auth0.com/samlp/metadata?connection=SAML-ZITADEL.
+
+In your existing project:
+
+1. Press the "+"-button to add an application
+ 
+2. Fill in a name for the application and chose the SAML type, then click "Continue".
+ 
+3. Either fill in the URL where ZITADEL can read the metadata from, or upload the metadata XML directly, then click "
+ Continue".
+ 
+4. Check your application, if everything is correct, press "Create".
+ 
+
+Everything on the side of ZITADEL is done if the application is correctly created.
+
+## **Auth0**: Try the connection
+
+To then test the connection you only have to press "Try" on the created connection in the Authentication -> Enterprise
+screen.
+
+
+
+To further customize the requests you can also customize the SAML communication as
+described [here](https://auth0.com/docs/authenticate/protocols/saml/saml-configuration/customize-saml-assertions)
diff --git a/docs/docs/guides/integrate/aws-saml.md b/docs/docs/guides/integrate/aws-saml.md
new file mode 100644
index 0000000000..08219e734b
--- /dev/null
+++ b/docs/docs/guides/integrate/aws-saml.md
@@ -0,0 +1,78 @@
+---
+title: Connect with AWS through SAML 2.0
+---
+
+This guide shows how to enable login with ZITADEL on AWS SSO.
+
+It covers how to:
+
+- create and configure the application in your project
+- create and configure the connection in your AWS SSO external IDP
+
+Prerequisites:
+
+- existing ZITADEL Instance, if not present follow [this guide](../../guides/start/quickstart)
+- existing ZITADEL Organization, if not present follow [this guide](../../guides/manage/console/organizations)
+- existing ZITADEL project, if not present follow the first 3 steps [here](../../guides/manage/console/projects)
+- prerequisites on AWS side [here](https://docs.aws.amazon.com/singlesignon/latest/userguide/prereqs.html).
+- enabled AWS SSO [here](https://docs.aws.amazon.com/singlesignon/latest/userguide/step1.html?icmpid=docs_sso_console)
+
+> We have to switch between ZITADEL and a AWS. If the headings begin with "ZITADEL" switch to the ZITADEL Console and if
+> the headings start with "AWS" please switch to the AWS GUI.
+
+## **AWS**: Change to external identity provider ZITADEL
+
+As you have activated SSO you still have the possibility to use AWS itself to manage the users, but you can also use a
+Microsoft AD or an external IDP.
+
+Described [here](https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-idp.html) how you
+can connect to ZITADEL as a SAML2 IDP.
+
+1. Chose the External identity provider:
+ 
+
+2. Download the metadata file, to provide ZITADEL with all the information it needs, and save the AWS SSO Sign-in URL,
+ which you use to login afterwards.
+
+3. Fill out the fields as follows, to provide AWS with all the information it needs:
+ 
+
+ To connect to another environment, change the domains, for example if you would use ZITADEL under the domain "
+ example.com" you would have the URLs "https://accounts.example.com/saml/SSO"
+ and "https://accounts.exmaple.com/saml/metadata".
+
+4. Download the ZITADEL-used certificate to sign the responses, so that AWS can validation the signature.
+
+ You can download the certificate from following
+ URL: {your_instance_domain}/saml/v2/certificate
+
+5. Then upload the ".crt"-file to AWS and click "next".
+
+6. Lastly, accept to confirm the change and ZITADEL is used as the external identity provider for AWS SSO to provide
+ connectivity to your AWS Accounts.
+
+As for how the SSO users are then connected to the AWS accounts, you can find more information in the AWS documentation,
+for example [here](https://docs.aws.amazon.com/singlesignon/latest/userguide/useraccess.html).
+
+## **ZITADEL**: Create the application
+
+The metadata used in this part is from "Change to external identity provider ZITADEL" step 2.
+
+In your existing project:
+
+1. Press the "+"-button to add an application
+ 
+2. Fill in a name for the application and chose the SAML type, then click "Continue".
+ 
+3. Either fill in the URL where ZITADEL can read the metadata from, or upload the metadata XML directly, then click "
+ Continue".
+ 
+4. Check your application, if everything is correct, press "Create".
+ 
+
+Everything on the side of ZITADEL is done if the application is correctly created.
+
+## **AWS**: Test the connection
+
+The result, you can now login to you AWS account through your ZITADEL-login with the AWS SSO Sign-in URL, which you
+should have saved in "Change to external identity provider ZITADEL" step 2.
\ No newline at end of file
diff --git a/docs/docs/guides/integrate/azuread.md b/docs/docs/guides/integrate/azuread-oidc.md
similarity index 98%
rename from docs/docs/guides/integrate/azuread.md
rename to docs/docs/guides/integrate/azuread-oidc.md
index 889bb5a3da..10f5eca73f 100644
--- a/docs/docs/guides/integrate/azuread.md
+++ b/docs/docs/guides/integrate/azuread-oidc.md
@@ -1,5 +1,5 @@
---
-title: Connect with AzureAD
+title: Connect with AzureAD through OIDC
---
## AzureAD Tenant as Identity Provider for ZITADEL
diff --git a/docs/docs/guides/integrate/gitlab-saml.md b/docs/docs/guides/integrate/gitlab-saml.md
new file mode 100644
index 0000000000..ebf54eaf2a
--- /dev/null
+++ b/docs/docs/guides/integrate/gitlab-saml.md
@@ -0,0 +1,67 @@
+---
+title: Connect with Gitlab through SAML 2.0
+---
+
+This guide shows how to enable login with ZITADEL on Gitlab.
+
+It covers how to:
+
+- create and configure the application in your project
+- create and configure the connection in Gitlab SaaS
+
+Prerequisites:
+
+- existing ZITADEL Instance, if not present follow [this guide](../../guides/start/quickstart)
+- existing ZITADEL Organization, if not present follow [this guide](../../guides/manage/console/organizations)
+- existing ZITADEL project, if not present follow the first 3 steps [here](../../guides/manage/console/projects)
+- existing Gitlab SaaS Setup in the premium tier
+
+> We have to switch between ZITADEL and Gitlab. If the headings begin with "ZITADEL" switch to the ZITADEL
+> Console and
+> if the headings start with "Gitlab" please switch to the Gitlab GUI.
+
+## **Gitlab**: Create a new external identity provider
+
+Please follow the instructions on [Gitlab docs](https://docs.gitlab.com/ee/user/group/saml_sso/index.html) to configure a SAML identity provider for SSO.
+The following instructions give you a quick overview of the most important steps.
+
+[Open the group](https://gitlab.com/dashboard/groups) to which you want to add the SSO configuration.
+Select on the menu Settings and then SAML SSO.
+Copy `GitLab metadata URL` for the next step.
+
+
+## **ZITADEL**: Create the application
+
+In your existing project:
+
+Press the "+"-button to add an application
+
+
+Fill in a name for the application and chose the SAML type, then click "Continue".
+
+
+Enter the URL from before, then click "Continue".
+
+
+Check your application, if everything is correct, press "Create".
+
+
+## **Gitlab**: Configuration
+
+Complete the configuration as follows:
+
+- `Identity provider single sign-on URL`: {your_instance_domain}/saml/v2/SSO
+- `Certificate fingerprint`: You need to download the certificate from {your_instance_domain}/saml/v2/certificate and create a SHA1 fingerprint
+
+Save the changes.
+
+
+
+## **Gitlab**: Verify SAML configuration
+
+Once you saved the changes, click on the button "Verify SAML configuration".
+
+You should be redirected to ZITADEL.
+Login with your user.
+After that you should be redirected back to GitLab and you can inspect the Response Output.
+
\ No newline at end of file
diff --git a/docs/docs/guides/integrate/pingidentity-saml.md b/docs/docs/guides/integrate/pingidentity-saml.md
new file mode 100644
index 0000000000..a7b420ad2d
--- /dev/null
+++ b/docs/docs/guides/integrate/pingidentity-saml.md
@@ -0,0 +1,84 @@
+---
+title: Connect with Ping Identity through SAML 2.0
+---
+
+This guide shows how to enable login with ZITADEL on Auth0.
+
+It covers how to:
+
+- create and configure the application in your project
+- create and configure the connection in your Ping Identity tenant
+
+Prerequisites:
+
+- existing ZITADEL Instance, if not present follow [this guide](../../guides/start/quickstart)
+- existing ZITADEL Organization, if not present follow [this guide](../../guides/manage/console/organizations)
+- existing ZITADEL project, if not present follow the first 3 steps [here](../../guides/manage/console/projects)
+- existing Pingidentity environment [here](https://docs.pingidentity.com/bundle/pingone/page/wqe1564020490538.html)
+
+> We have to switch between ZITADEL and Ping Identity. If the headings begin with "ZITADEL" switch to the ZITADEL
+> Console and
+> if the headings start with "Ping" please switch to the PingIdentity GUI.
+
+## **Ping**: Create a new external identity provider
+
+To add an
+additional [external identity provider](https://docs.pingidentity.com/bundle/pingone/page/jvz1567784210191.html), you
+can follow the instructions [here](https://docs.pingidentity.com/bundle/pingone/page/ovy1567784211297.html)
+
+1. As described you have to create a new provider, with a unique identifier:
+ 
+
+We recommend activating signing the auth request whenever possible:
+
+
+2. Manually enter the necessary information:
+
+- SSO Endpoint, for example https://accounts.example.com/saml/SSO
+- IDP EntityID, for example https://accounts.example.com/saml/metadata
+- Binding, which is a decision which you can take yourself, we recommend HTTP POST as it has fewer restrictions
+- Import certificate, provided from the certificate endpoint
+ 
+
+Everything you need to know about the attribute mapping you can find
+in [Ping Identity's documentation](https://docs.pingidentity.com/bundle/pingone/page/pwv1567784207915.html)
+
+3. With this you have defined to connection to ZITADEL as an external IDP, next is the policy to use ZITADEL as an IDP
+ to
+ connect to an application. The "How to" for that can be
+ found [here](https://docs.pingidentity.com/bundle/pingone/page/zqd1616600404402.html).
+
+## **ZITADEL**: Create the application
+
+To add the connection to ZITADEL you have to build the metadata, which should minimalistic look like this, the necessary
+information can be found on the External IDPs page under "P1Connection" and "IDP Configuration" :
+
+```xml
+ENTITYID="PINGONE (SP) ENTITY ID"
+ ACSURL="ACS ENDPOINT"
+
+
+
+
+
+
+```
+
+
+
+
+In your existing project:
+
+1. Press the "+"-button to add an application
+ 
+2. Fill in a name for the application and chose the SAML type, then click "Continue".
+ 
+3. Either fill in the URL where ZITADEL can read the metadata from, or upload the metadata XML directly, then click "
+ Continue".
+ 
+4. Check your application, if everything is correct, press "Create".
+ 
+
+Everything on the side of ZITADEL is done if the application is correctly created.
diff --git a/docs/sidebars.js b/docs/sidebars.js
index b2aa1fb0f3..a21138df66 100644
--- a/docs/sidebars.js
+++ b/docs/sidebars.js
@@ -115,17 +115,43 @@ module.exports = {
label: "Integrate",
collapsed: false,
items: [
- "guides/integrate/identity-brokering",
- "guides/integrate/access-zitadel-apis",
- "guides/integrate/access-zitadel-system-api",
- "guides/integrate/authenticated-mongodb-charts",
- "guides/integrate/auth0",
- "guides/integrate/azuread",
- "guides/integrate/gitlab-self-hosted",
"guides/integrate/login-users",
- "guides/integrate/serviceusers",
- "guides/integrate/oauth-recommended-flows",
- "guides/integrate/export-and-import"
+ "guides/integrate/identity-brokering",
+ {
+ type: "category",
+ label: "Access ZITADEL APIs",
+ collapsed: false,
+ items: [
+ "guides/integrate/serviceusers",
+ "guides/integrate/access-zitadel-apis",
+ "guides/integrate/access-zitadel-system-api",
+ "guides/integrate/export-and-import",
+ ],
+ },
+ {
+ type: "category",
+ label: "OpenID Connect 1.0 Clients",
+ collapsed: false,
+ items: [
+ "guides/integrate/oauth-recommended-flows",
+ "guides/integrate/auth0-oidc",
+ "guides/integrate/azuread-oidc",
+ "guides/integrate/authenticated-mongodb-charts",
+ "guides/integrate/gitlab-self-hosted",
+ ],
+ },
+ {
+ type: "category",
+ label: "SAML 2.0 Clients",
+ collapsed: false,
+ items: [
+ "guides/integrate/auth0-saml",
+ "guides/integrate/aws-saml",
+ "guides/integrate/pingidentity-saml",
+ "guides/integrate/atlassian-saml",
+ "guides/integrate/gitlab-saml",
+ ],
+ },
],
},
{
@@ -205,6 +231,14 @@ module.exports = {
"apis/openidoauth/grant-types",
],
},
+ {
+ type: "category",
+ label: "SAML",
+ collapsed: false,
+ items: [
+ "apis/saml/endpoints",
+ ],
+ },
{
type: "category",
label: "Rate Limits",
diff --git a/docs/static/img/saml/atlassian/atlassian-01.png b/docs/static/img/saml/atlassian/atlassian-01.png
new file mode 100644
index 0000000000..13ea629891
Binary files /dev/null and b/docs/static/img/saml/atlassian/atlassian-01.png differ
diff --git a/docs/static/img/saml/atlassian/atlassian-02.png b/docs/static/img/saml/atlassian/atlassian-02.png
new file mode 100644
index 0000000000..43c983a6de
Binary files /dev/null and b/docs/static/img/saml/atlassian/atlassian-02.png differ
diff --git a/docs/static/img/saml/atlassian/atlassian-03.png b/docs/static/img/saml/atlassian/atlassian-03.png
new file mode 100644
index 0000000000..ca4153b8c0
Binary files /dev/null and b/docs/static/img/saml/atlassian/atlassian-03.png differ
diff --git a/docs/static/img/saml/atlassian/atlassian-04.png b/docs/static/img/saml/atlassian/atlassian-04.png
new file mode 100644
index 0000000000..f99f2b81b4
Binary files /dev/null and b/docs/static/img/saml/atlassian/atlassian-04.png differ
diff --git a/docs/static/img/saml/atlassian/atlassian-05.png b/docs/static/img/saml/atlassian/atlassian-05.png
new file mode 100644
index 0000000000..bb535f0efb
Binary files /dev/null and b/docs/static/img/saml/atlassian/atlassian-05.png differ
diff --git a/docs/static/img/saml/atlassian/atlassian-06.png b/docs/static/img/saml/atlassian/atlassian-06.png
new file mode 100644
index 0000000000..4c7cb76c38
Binary files /dev/null and b/docs/static/img/saml/atlassian/atlassian-06.png differ
diff --git a/docs/static/img/saml/auth0/auth_enterprise.png b/docs/static/img/saml/auth0/auth_enterprise.png
new file mode 100644
index 0000000000..7e51c19e4d
Binary files /dev/null and b/docs/static/img/saml/auth0/auth_enterprise.png differ
diff --git a/docs/static/img/saml/auth0/auth_enterprise_try.png b/docs/static/img/saml/auth0/auth_enterprise_try.png
new file mode 100644
index 0000000000..f2f8560a68
Binary files /dev/null and b/docs/static/img/saml/auth0/auth_enterprise_try.png differ
diff --git a/docs/static/img/saml/auth0/connection.png b/docs/static/img/saml/auth0/connection.png
new file mode 100644
index 0000000000..0d55fc310e
Binary files /dev/null and b/docs/static/img/saml/auth0/connection.png differ
diff --git a/docs/static/img/saml/auth0/enterprise_connections.png b/docs/static/img/saml/auth0/enterprise_connections.png
new file mode 100644
index 0000000000..2b7b4616e2
Binary files /dev/null and b/docs/static/img/saml/auth0/enterprise_connections.png differ
diff --git a/docs/static/img/saml/aws/change_idp.png b/docs/static/img/saml/aws/change_idp.png
new file mode 100644
index 0000000000..d91b4e0782
Binary files /dev/null and b/docs/static/img/saml/aws/change_idp.png differ
diff --git a/docs/static/img/saml/aws/configure_idp.png b/docs/static/img/saml/aws/configure_idp.png
new file mode 100644
index 0000000000..a8c5c1d21b
Binary files /dev/null and b/docs/static/img/saml/aws/configure_idp.png differ
diff --git a/docs/static/img/saml/gitlab/gitlab-01.png b/docs/static/img/saml/gitlab/gitlab-01.png
new file mode 100644
index 0000000000..96d9ac2dd5
Binary files /dev/null and b/docs/static/img/saml/gitlab/gitlab-01.png differ
diff --git a/docs/static/img/saml/gitlab/gitlab-02.png b/docs/static/img/saml/gitlab/gitlab-02.png
new file mode 100644
index 0000000000..bef52d3566
Binary files /dev/null and b/docs/static/img/saml/gitlab/gitlab-02.png differ
diff --git a/docs/static/img/saml/gitlab/gitlab-03.png b/docs/static/img/saml/gitlab/gitlab-03.png
new file mode 100644
index 0000000000..5f3097071f
Binary files /dev/null and b/docs/static/img/saml/gitlab/gitlab-03.png differ
diff --git a/docs/static/img/saml/pingidentity/conf_connection.png b/docs/static/img/saml/pingidentity/conf_connection.png
new file mode 100644
index 0000000000..9d8db07217
Binary files /dev/null and b/docs/static/img/saml/pingidentity/conf_connection.png differ
diff --git a/docs/static/img/saml/pingidentity/conf_idp_connection.png b/docs/static/img/saml/pingidentity/conf_idp_connection.png
new file mode 100644
index 0000000000..c60fac7239
Binary files /dev/null and b/docs/static/img/saml/pingidentity/conf_idp_connection.png differ
diff --git a/docs/static/img/saml/pingidentity/create_idp_profile.png b/docs/static/img/saml/pingidentity/create_idp_profile.png
new file mode 100644
index 0000000000..90ad87a640
Binary files /dev/null and b/docs/static/img/saml/pingidentity/create_idp_profile.png differ
diff --git a/docs/static/img/saml/pingidentity/idp_idp_configuration.png b/docs/static/img/saml/pingidentity/idp_idp_configuration.png
new file mode 100644
index 0000000000..6b2a80090d
Binary files /dev/null and b/docs/static/img/saml/pingidentity/idp_idp_configuration.png differ
diff --git a/docs/static/img/saml/pingidentity/idp_p1_connection.png b/docs/static/img/saml/pingidentity/idp_p1_connection.png
new file mode 100644
index 0000000000..74691e1061
Binary files /dev/null and b/docs/static/img/saml/pingidentity/idp_p1_connection.png differ
diff --git a/docs/static/img/saml/zitadel/application_saml.png b/docs/static/img/saml/zitadel/application_saml.png
new file mode 100644
index 0000000000..e8617e4eeb
Binary files /dev/null and b/docs/static/img/saml/zitadel/application_saml.png differ
diff --git a/docs/static/img/saml/zitadel/application_saml_create.png b/docs/static/img/saml/zitadel/application_saml_create.png
new file mode 100644
index 0000000000..4f3c39bbd9
Binary files /dev/null and b/docs/static/img/saml/zitadel/application_saml_create.png differ
diff --git a/docs/static/img/saml/zitadel/application_saml_metadata.png b/docs/static/img/saml/zitadel/application_saml_metadata.png
new file mode 100644
index 0000000000..d231d03e6d
Binary files /dev/null and b/docs/static/img/saml/zitadel/application_saml_metadata.png differ
diff --git a/docs/static/img/saml/zitadel/project.png b/docs/static/img/saml/zitadel/project.png
new file mode 100644
index 0000000000..f2076887e5
Binary files /dev/null and b/docs/static/img/saml/zitadel/project.png differ
diff --git a/e2e/cypress/support/api/ensure.ts b/e2e/cypress/support/api/ensure.ts
index 579dd6bb7a..b08df296a7 100644
--- a/e2e/cypress/support/api/ensure.ts
+++ b/e2e/cypress/support/api/ensure.ts
@@ -26,7 +26,7 @@ export function ensureSomethingExists(api: apiCallProperties, searchPath: string
}
})
}).then((data) => {
- awaitDesired(30, (entity) => !!entity, data.initialSequence, api, searchPath, find)
+ awaitDesired(90, (entity) => !!entity, data.initialSequence, api, searchPath, find)
return cy.wrap(data.id)
})
}
@@ -49,7 +49,7 @@ export function ensureSomethingDoesntExist(api: apiCallProperties, searchPath: s
return sRes.sequence
})
}).then((initialSequence) => {
- awaitDesired(30, (entity) => !entity , initialSequence, api, searchPath, find)
+ awaitDesired(90, (entity) => !entity , initialSequence, api, searchPath, find)
return null
})
}
@@ -77,10 +77,13 @@ function searchSomething(api: apiCallProperties, searchPath: string, find: (enti
function awaitDesired(trials: number, expectEntity: (entity: any) => boolean, initialSequence: number, api: apiCallProperties, searchPath: string, find: (entity: any) => boolean) {
searchSomething(api, searchPath, find).then(resp => {
- if (!expectEntity(resp.entity) || resp.sequence <= initialSequence) {
+ const foundExpectedEntity = expectEntity(resp.entity)
+ const foundExpectedSequence = resp.sequence > initialSequence
+
+ if (!foundExpectedEntity || !foundExpectedSequence) {
expect(trials, `trying ${trials} more times`).to.be.greaterThan(0);
cy.wait(1000)
awaitDesired(trials - 1, expectEntity, initialSequence, api, searchPath, find)
- }
+ }
})
-}
\ No newline at end of file
+}
diff --git a/go.mod b/go.mod
index 52b32b3869..c05d2c333b 100644
--- a/go.mod
+++ b/go.mod
@@ -48,11 +48,12 @@ require (
github.com/sony/sonyflake v1.0.0
github.com/spf13/cobra v1.3.0
github.com/spf13/viper v1.10.1
- github.com/stretchr/testify v1.7.1
+ github.com/stretchr/testify v1.8.0
github.com/superseriousbusiness/exifremove v0.0.0-20210330092427-6acd27eac203
github.com/ttacon/libphonenumber v1.2.1
github.com/zitadel/logging v0.3.4
github.com/zitadel/oidc/v2 v2.0.0-dynamic-issuer.5
+ github.com/zitadel/saml v0.0.6
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.27.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.27.0
go.opentelemetry.io/otel v1.2.0
@@ -82,6 +83,8 @@ require (
cloud.google.com/go/trace v1.0.0 // indirect
github.com/Masterminds/goutils v1.1.1 // indirect
github.com/Masterminds/semver v1.5.0 // indirect
+ github.com/amdonov/xmlsig v0.1.0 // indirect
+ github.com/beevik/etree v1.1.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/cenkalti/backoff/v4 v4.1.2 // indirect
github.com/census-instrumentation/opencensus-proto v0.3.0 // indirect
@@ -135,6 +138,7 @@ require (
github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
github.com/jarcoal/jpath v0.0.0-20140328210829-f76b8b2dbf52
github.com/jinzhu/inflection v1.0.0 // indirect
+ github.com/jonboulle/clockwork v0.2.2 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/kevinburke/go-types v0.0.0-20210723172823-2deba1f80ba7 // indirect
github.com/kevinburke/rest v0.0.0-20210506044642-5611499aa33c // indirect
@@ -161,6 +165,7 @@ require (
github.com/prometheus/common v0.26.0 // indirect
github.com/prometheus/procfs v0.6.0 // indirect
github.com/rs/xid v1.2.1 // indirect
+ github.com/russellhaering/goxmldsig v1.2.0 // indirect
github.com/satori/go.uuid v1.2.0 // indirect
github.com/sirupsen/logrus v1.9.0 // indirect
github.com/spf13/afero v1.8.1 // indirect
@@ -184,7 +189,7 @@ require (
google.golang.org/appengine v1.6.7 // indirect
gopkg.in/ini.v1 v1.66.4 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
- gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
+ gopkg.in/yaml.v3 v3.0.1 // indirect
nhooyr.io/websocket v1.8.7 // indirect
)
diff --git a/go.sum b/go.sum
index ec4c141298..6a7e07e1f3 100644
--- a/go.sum
+++ b/go.sum
@@ -95,6 +95,8 @@ github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk5
github.com/allegro/bigcache v1.2.1-0.20190218064605-e24eb225f156/go.mod h1:Cb/ax3seSYIx7SuZdm2G2xzfwmv3TPSk2ucNfQESPXM=
github.com/allegro/bigcache v1.2.1 h1:hg1sY1raCwic3Vnsvje6TT7/pnZba83LeFck5NrFKSc=
github.com/allegro/bigcache v1.2.1/go.mod h1:Cb/ax3seSYIx7SuZdm2G2xzfwmv3TPSk2ucNfQESPXM=
+github.com/amdonov/xmlsig v0.1.0 h1:i0iQ3neKLmUhcfIRgiiR3eRPKgXZj+n5lAfqnfKoeXI=
+github.com/amdonov/xmlsig v0.1.0/go.mod h1:jTR/jO0E8fSl/cLvMesP+RjxyV4Ux4WL1Ip64ZnQpA0=
github.com/andybalholm/cascadia v1.1.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
@@ -108,6 +110,8 @@ github.com/aryann/difflib v0.0.0-20170710044230-e206f873d14a/go.mod h1:DAHtR1m6l
github.com/aws/aws-lambda-go v1.13.3/go.mod h1:4UKl9IzQMoD+QF79YdCuzCwp8VbmG4VAQwij/eHl5CU=
github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
+github.com/beevik/etree v1.1.0 h1:T0xke/WvNtMoCqgzPhkX2r4rjY3GDZFi+FjpRZY2Jbs=
+github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
github.com/benbjohnson/clock v1.2.0 h1:9Re3G2TWxkE06LdMWMpcY6KV81GLXMGiYpPYUPkFAws=
github.com/benbjohnson/clock v1.2.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -560,6 +564,8 @@ github.com/jinzhu/now v1.1.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/
github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
github.com/jmoiron/sqlx v1.3.1/go.mod h1:2BljVx/86SuTyjE+aPYlHCTNvZrnJXghYGpNiXLBMCQ=
github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
+github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ=
+github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
@@ -600,8 +606,9 @@ github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
@@ -735,6 +742,7 @@ github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCko
github.com/performancecopilot/speed v3.0.0+incompatible/go.mod h1:/CLtqpZ5gBg1M9iaPbIdPPGyKcA8hKdoy6hAWba7Yac=
github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -785,6 +793,9 @@ github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqn
github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8=
+github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
github.com/rs/cors v1.8.0 h1:P2KMzcFwrPoSjkF1WLRPsp3UMLyql8L4v9hQpVeK5so=
github.com/rs/cors v1.8.0/go.mod h1:EBwu+T5AvHOcXwvZIkQFjUN6s8Czyqw12GL/Y0tUyRM=
@@ -792,6 +803,8 @@ github.com/rs/xid v1.2.1 h1:mhH9Nq+C1fY2l1XIpgxIiUOfNpRBYH1kKcr+qfKgjRc=
github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
+github.com/russellhaering/goxmldsig v1.2.0 h1:Y6GTTc9Un5hCxSzVz4UIWQ/zuVwDvzJk80guqzwx6Vg=
+github.com/russellhaering/goxmldsig v1.2.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
@@ -845,14 +858,16 @@ github.com/streadway/handy v0.0.0-20190108123426-d5acb3125c2a/go.mod h1:qNTQ5P5J
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1 h1:5TQK59W5E3v0r2duFAb7P95B6hEeOyEnHRa8MjYSMTY=
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
github.com/superseriousbusiness/exifremove v0.0.0-20210330092427-6acd27eac203 h1:1SWXcTphBQjYGWRRxLFIAR1LVtQEj4eR7xPtyeOVM/c=
@@ -886,6 +901,12 @@ github.com/zitadel/logging v0.3.4 h1:9hZsTjMMTE3X2LUi0xcF9Q9EdLo+FAezeu52ireBbHM
github.com/zitadel/logging v0.3.4/go.mod h1:aPpLQhE+v6ocNK0TWrBrd363hZ95KcI17Q1ixAQwZF0=
github.com/zitadel/oidc/v2 v2.0.0-dynamic-issuer.5 h1:dP+6SheVtpF4T/oql6mJoqou8jlW3J/9NCTYnEpKgpM=
github.com/zitadel/oidc/v2 v2.0.0-dynamic-issuer.5/go.mod h1:uoJw5Xc6HXfnQbNZiLbld9dED0/8UMu0M4gOipTRZBA=
+github.com/zitadel/saml v0.0.4 h1:xz97KyKD3mrQcIEKi0aUPyNX834xm3p1ToO9HK/vVeY=
+github.com/zitadel/saml v0.0.4/go.mod h1:DIy/ln32rNYv/bIBA8uOB6Y2JmxjZldDYBeMNn7YyeQ=
+github.com/zitadel/saml v0.0.5 h1:ufLE0MeWe2SLGGkSWbY3J20xxYtAL57IddeDsyMqCuM=
+github.com/zitadel/saml v0.0.5/go.mod h1:DIy/ln32rNYv/bIBA8uOB6Y2JmxjZldDYBeMNn7YyeQ=
+github.com/zitadel/saml v0.0.6 h1:avcOanSNd0x4jkn/+MsXIGQpJOvwqkk+slGJVIhqk84=
+github.com/zitadel/saml v0.0.6/go.mod h1:DIy/ln32rNYv/bIBA8uOB6Y2JmxjZldDYBeMNn7YyeQ=
go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
go.etcd.io/etcd v0.0.0-20191023171146-3cf2f69b5738/go.mod h1:dnLIgRNXwCJa5e+c6mIZCrds/GIG4ncV9HhK5PX7jPg=
go.etcd.io/etcd/api/v3 v3.5.1/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
@@ -1479,8 +1500,9 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gorm.io/driver/postgres v1.0.8/go.mod h1:4eOzrI1MUfm6ObJU/UcmbXyiHSs8jSwH95G5P5dxcAg=
gorm.io/gorm v1.20.12/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
gorm.io/gorm v1.21.4/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
diff --git a/internal/api/grpc/management/project_application.go b/internal/api/grpc/management/project_application.go
index 233417bdfa..1290d96681 100644
--- a/internal/api/grpc/management/project_application.go
+++ b/internal/api/grpc/management/project_application.go
@@ -67,6 +67,16 @@ func (s *Server) AddOIDCApp(ctx context.Context, req *mgmt_pb.AddOIDCAppRequest)
ComplianceProblems: project_grpc.ComplianceProblemsToLocalizedMessages(app.Compliance.Problems),
}, nil
}
+func (s *Server) AddSAMLApp(ctx context.Context, req *mgmt_pb.AddSAMLAppRequest) (*mgmt_pb.AddSAMLAppResponse, error) {
+ app, err := s.command.AddSAMLApplication(ctx, AddSAMLAppRequestToDomain(req), authz.GetCtxData(ctx).OrgID)
+ if err != nil {
+ return nil, err
+ }
+ return &mgmt_pb.AddSAMLAppResponse{
+ AppId: app.AppID,
+ Details: object_grpc.AddToDetailsPb(app.Sequence, app.ChangeDate, app.ResourceOwner),
+ }, nil
+}
func (s *Server) AddAPIApp(ctx context.Context, req *mgmt_pb.AddAPIAppRequest) (*mgmt_pb.AddAPIAppResponse, error) {
appSecretGenerator, err := s.query.InitHashGenerator(ctx, domain.SecretGeneratorTypeAppSecret, s.passwordHashAlg)
@@ -109,6 +119,20 @@ func (s *Server) UpdateOIDCAppConfig(ctx context.Context, req *mgmt_pb.UpdateOID
}, nil
}
+func (s *Server) UpdateSAMLAppConfig(ctx context.Context, req *mgmt_pb.UpdateSAMLAppConfigRequest) (*mgmt_pb.UpdateSAMLAppConfigResponse, error) {
+ config, err := s.command.ChangeSAMLApplication(ctx, UpdateSAMLAppConfigRequestToDomain(req), authz.GetCtxData(ctx).OrgID)
+ if err != nil {
+ return nil, err
+ }
+ return &mgmt_pb.UpdateSAMLAppConfigResponse{
+ Details: object_grpc.ChangeToDetailsPb(
+ config.Sequence,
+ config.ChangeDate,
+ config.ResourceOwner,
+ ),
+ }, nil
+}
+
func (s *Server) UpdateAPIAppConfig(ctx context.Context, req *mgmt_pb.UpdateAPIAppConfigRequest) (*mgmt_pb.UpdateAPIAppConfigResponse, error) {
config, err := s.command.ChangeAPIApplication(ctx, UpdateAPIAppConfigRequestToDomain(req), authz.GetCtxData(ctx).OrgID)
if err != nil {
diff --git a/internal/api/grpc/management/project_application_converter.go b/internal/api/grpc/management/project_application_converter.go
index f4c03b91dc..a56c30b403 100644
--- a/internal/api/grpc/management/project_application_converter.go
+++ b/internal/api/grpc/management/project_application_converter.go
@@ -59,6 +59,17 @@ func AddOIDCAppRequestToDomain(req *mgmt_pb.AddOIDCAppRequest) *domain.OIDCApp {
}
}
+func AddSAMLAppRequestToDomain(req *mgmt_pb.AddSAMLAppRequest) *domain.SAMLApp {
+ return &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: req.ProjectId,
+ },
+ AppName: req.Name,
+ Metadata: req.GetMetadataXml(),
+ MetadataURL: req.GetMetadataUrl(),
+ }
+}
+
func AddAPIAppRequestToDomain(app *mgmt_pb.AddAPIAppRequest) *domain.APIApp {
return &domain.APIApp{
ObjectRoot: models.ObjectRoot{
@@ -98,6 +109,17 @@ func UpdateOIDCAppConfigRequestToDomain(app *mgmt_pb.UpdateOIDCAppConfigRequest)
}
}
+func UpdateSAMLAppConfigRequestToDomain(app *mgmt_pb.UpdateSAMLAppConfigRequest) *domain.SAMLApp {
+ return &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: app.ProjectId,
+ },
+ AppID: app.AppId,
+ Metadata: app.GetMetadataXml(),
+ MetadataURL: app.GetMetadataUrl(),
+ }
+}
+
func UpdateAPIAppConfigRequestToDomain(app *mgmt_pb.UpdateAPIAppConfigRequest) *domain.APIApp {
return &domain.APIApp{
ObjectRoot: models.ObjectRoot{
diff --git a/internal/api/grpc/project/application.go b/internal/api/grpc/project/application.go
index fb6ad90819..a523c001c1 100644
--- a/internal/api/grpc/project/application.go
+++ b/internal/api/grpc/project/application.go
@@ -33,6 +33,9 @@ func AppConfigToPb(app *query.App) app_pb.AppConfig {
if app.OIDCConfig != nil {
return AppOIDCConfigToPb(app.OIDCConfig)
}
+ if app.SAMLConfig != nil {
+ return AppSAMLConfigToPb(app.SAMLConfig)
+ }
return AppAPIConfigToPb(app.APIConfig)
}
@@ -61,6 +64,14 @@ func AppOIDCConfigToPb(app *query.OIDCApp) *app_pb.App_OidcConfig {
}
}
+func AppSAMLConfigToPb(app *query.SAMLApp) app_pb.AppConfig {
+ return &app_pb.App_SamlConfig{
+ SamlConfig: &app_pb.SAMLConfig{
+ Metadata: &app_pb.SAMLConfig_MetadataXml{MetadataXml: app.Metadata},
+ },
+ }
+}
+
func AppAPIConfigToPb(app *query.APIApp) app_pb.AppConfig {
return &app_pb.App_ApiConfig{
ApiConfig: &app_pb.APIConfig{
diff --git a/internal/api/saml/auth_request_converter.go b/internal/api/saml/auth_request_converter.go
new file mode 100644
index 0000000000..a19fed0920
--- /dev/null
+++ b/internal/api/saml/auth_request_converter.go
@@ -0,0 +1,99 @@
+package saml
+
+import (
+ "context"
+ "time"
+
+ "github.com/zitadel/saml/pkg/provider/models"
+ "github.com/zitadel/saml/pkg/provider/xml/samlp"
+
+ "github.com/zitadel/zitadel/internal/api/authz"
+ "github.com/zitadel/zitadel/internal/domain"
+ "github.com/zitadel/zitadel/internal/errors"
+)
+
+var _ models.AuthRequestInt = &AuthRequest{}
+
+type AuthRequest struct {
+ *domain.AuthRequest
+}
+
+func (a *AuthRequest) GetApplicationID() string {
+ return a.ApplicationID
+}
+
+func (a *AuthRequest) GetID() string {
+ return a.ID
+}
+func (a *AuthRequest) GetRelayState() string {
+ return a.TransferState
+}
+func (a *AuthRequest) GetAccessConsumerServiceURL() string {
+ return a.CallbackURI
+}
+
+func (a *AuthRequest) GetNameID() string {
+ return a.UserName
+}
+
+func (a *AuthRequest) saml() *domain.AuthRequestSAML {
+ return a.Request.(*domain.AuthRequestSAML)
+}
+func (a *AuthRequest) GetAuthRequestID() string {
+ return a.saml().ID
+}
+func (a *AuthRequest) GetBindingType() string {
+ return a.saml().BindingType
+}
+func (a *AuthRequest) GetIssuer() string {
+ return a.saml().Issuer
+}
+func (a *AuthRequest) GetIssuerName() string {
+ return a.saml().IssuerName
+}
+func (a *AuthRequest) GetDestination() string {
+ return a.saml().Destination
+}
+func (a *AuthRequest) GetCode() string {
+ return a.saml().Code
+}
+func (a *AuthRequest) GetUserID() string {
+ return a.UserID
+}
+func (a *AuthRequest) GetUserName() string {
+ return a.UserName
+}
+func (a *AuthRequest) Done() bool {
+ for _, step := range a.PossibleSteps {
+ if step.Type() == domain.NextStepRedirectToCallback {
+ return true
+ }
+ }
+ return false
+}
+
+func AuthRequestFromBusiness(authReq *domain.AuthRequest) (_ models.AuthRequestInt, err error) {
+ if _, ok := authReq.Request.(*domain.AuthRequestSAML); !ok {
+ return nil, errors.ThrowInvalidArgument(nil, "SAML-Hbz7A", "auth request is not of type saml")
+ }
+ return &AuthRequest{authReq}, nil
+}
+
+func CreateAuthRequestToBusiness(ctx context.Context, authReq *samlp.AuthnRequestType, acsUrl, protocolBinding, applicationID, relayState, userAgentID string) *domain.AuthRequest {
+ return &domain.AuthRequest{
+ CreationDate: time.Now(),
+ AgentID: userAgentID,
+ ApplicationID: applicationID,
+ CallbackURI: acsUrl,
+ TransferState: relayState,
+ InstanceID: authz.GetInstance(ctx).InstanceID(),
+ Request: &domain.AuthRequestSAML{
+ ID: authReq.Id,
+ BindingType: protocolBinding,
+ Code: "",
+ Issuer: authReq.Issuer.Text,
+ IssuerName: authReq.Issuer.SPProvidedID,
+ Destination: authReq.Destination,
+ },
+ }
+}
diff --git a/internal/api/saml/certificate.go b/internal/api/saml/certificate.go
new file mode 100644
index 0000000000..432fcd9e5a
--- /dev/null
+++ b/internal/api/saml/certificate.go
@@ -0,0 +1,202 @@
+package saml
+
+import (
+ "context"
+ "fmt"
+ "time"
+
+ "github.com/zitadel/logging"
+ "github.com/zitadel/saml/pkg/provider/key"
+ "gopkg.in/square/go-jose.v2"
+
+ "github.com/zitadel/zitadel/internal/api/authz"
+ "github.com/zitadel/zitadel/internal/crypto"
+ "github.com/zitadel/zitadel/internal/domain"
+ "github.com/zitadel/zitadel/internal/errors"
+ "github.com/zitadel/zitadel/internal/eventstore"
+ "github.com/zitadel/zitadel/internal/query"
+ "github.com/zitadel/zitadel/internal/repository/keypair"
+)
+
+const (
+ locksTable = "projections.locks"
+ signingKey = "signing_key"
+ samlUser = "SAML"
+
+ retryBackoff = 500 * time.Millisecond
+ retryCount = 3
+ lockDuration = retryCount * retryBackoff * 5
+ gracefulPeriod = 10 * time.Minute
+)
+
+type CertificateAndKey struct {
+ algorithm jose.SignatureAlgorithm
+ id string
+ key interface{}
+ certificate interface{}
+}
+
+func (c *CertificateAndKey) SignatureAlgorithm() jose.SignatureAlgorithm {
+ return c.algorithm
+}
+
+func (c *CertificateAndKey) Key() interface{} {
+ return c.key
+}
+
+func (c *CertificateAndKey) Certificate() interface{} {
+ return c.certificate
+}
+
+func (c *CertificateAndKey) ID() string {
+ return c.id
+}
+
+func (p *Storage) GetCertificateAndKey(ctx context.Context, usage domain.KeyUsage) (certAndKey *key.CertificateAndKey, err error) {
+ err = retry(func() error {
+ certAndKey, err = p.getCertificateAndKey(ctx, usage)
+ if err != nil {
+ return err
+ }
+ if certAndKey == nil {
+ return errors.ThrowInternal(err, "SAML-8u01nks", "no certificate found")
+ }
+ return nil
+ })
+ return certAndKey, err
+}
+
+func (p *Storage) getCertificateAndKey(ctx context.Context, usage domain.KeyUsage) (*key.CertificateAndKey, error) {
+ certs, err := p.query.ActiveCertificates(ctx, time.Now().Add(gracefulPeriod), usage)
+ if err != nil {
+ return nil, err
+ }
+
+ if len(certs.Certificates) > 0 {
+ return p.certificateToCertificateAndKey(selectCertificate(certs.Certificates))
+ }
+
+ var sequence uint64
+ if certs.LatestSequence != nil {
+ sequence = certs.LatestSequence.Sequence
+ }
+
+ return nil, p.refreshCertificate(ctx, usage, sequence)
+}
+
+func (p *Storage) refreshCertificate(
+ ctx context.Context,
+ usage domain.KeyUsage,
+ sequence uint64,
+) error {
+ ok, err := p.ensureIsLatestCertificate(ctx, sequence)
+ if err != nil {
+ logging.WithError(err).Error("could not ensure latest key")
+ return err
+ }
+ if !ok {
+ logging.Warn("view not up to date, retrying later")
+ return err
+ }
+ err = p.lockAndGenerateCertificateAndKey(ctx, usage, sequence)
+ logging.OnError(err).Warn("could not create signing key")
+ return nil
+}
+
+func (p *Storage) ensureIsLatestCertificate(ctx context.Context, sequence uint64) (bool, error) {
+ maxSequence, err := p.getMaxKeySequence(ctx)
+ if err != nil {
+ return false, fmt.Errorf("error retrieving new events: %w", err)
+ }
+ return sequence == maxSequence, nil
+}
+
+func (p *Storage) lockAndGenerateCertificateAndKey(ctx context.Context, usage domain.KeyUsage, sequence uint64) error {
+ ctx, cancel := context.WithCancel(ctx)
+ defer cancel()
+ ctx = setSAMLCtx(ctx)
+
+ errs := p.locker.Lock(ctx, lockDuration, authz.GetInstance(ctx).InstanceID())
+ err, ok := <-errs
+ if err != nil || !ok {
+ if errors.IsErrorAlreadyExists(err) {
+ return nil
+ }
+ logging.OnError(err).Warn("initial lock failed")
+ return err
+ }
+
+ switch usage {
+ case domain.KeyUsageSAMLMetadataSigning, domain.KeyUsageSAMLResponseSinging:
+ certAndKey, err := p.GetCertificateAndKey(ctx, domain.KeyUsageSAMLCA)
+ if err != nil {
+ return fmt.Errorf("error while reading ca certificate: %w", err)
+ }
+ if certAndKey.Key == nil || certAndKey.Certificate == nil {
+ return fmt.Errorf("has no ca certificate")
+ }
+
+ switch usage {
+ case domain.KeyUsageSAMLMetadataSigning:
+ return p.command.GenerateSAMLMetadataCertificate(setSAMLCtx(ctx), p.certificateAlgorithm, certAndKey.Key, certAndKey.Certificate)
+ case domain.KeyUsageSAMLResponseSinging:
+ return p.command.GenerateSAMLResponseCertificate(setSAMLCtx(ctx), p.certificateAlgorithm, certAndKey.Key, certAndKey.Certificate)
+ default:
+ return fmt.Errorf("unknown usage")
+ }
+ case domain.KeyUsageSAMLCA:
+ return p.command.GenerateSAMLCACertificate(setSAMLCtx(ctx), p.certificateAlgorithm)
+ default:
+ return fmt.Errorf("unknown certificate usage")
+ }
+}
+
+func (p *Storage) getMaxKeySequence(ctx context.Context) (uint64, error) {
+ return p.eventstore.LatestSequence(ctx,
+ eventstore.NewSearchQueryBuilder(eventstore.ColumnsMaxSequence).
+ ResourceOwner(authz.GetInstance(ctx).InstanceID()).
+ AddQuery().
+ AggregateTypes(keypair.AggregateType).
+ Builder(),
+ )
+}
+
+func (p *Storage) certificateToCertificateAndKey(certificate query.Certificate) (_ *key.CertificateAndKey, err error) {
+ keyData, err := crypto.Decrypt(certificate.Key(), p.encAlg)
+ if err != nil {
+ return nil, err
+ }
+ privateKey, err := crypto.BytesToPrivateKey(keyData)
+ if err != nil {
+ return nil, err
+ }
+
+ cert, err := crypto.BytesToCertificate(certificate.Certificate())
+ if err != nil {
+ return nil, err
+ }
+
+ return &key.CertificateAndKey{
+ Key: privateKey,
+ Certificate: cert,
+ }, nil
+}
+
+func selectCertificate(certs []query.Certificate) query.Certificate {
+ return certs[len(certs)-1]
+}
+
+func setSAMLCtx(ctx context.Context) context.Context {
+ return authz.SetCtxData(ctx, authz.CtxData{UserID: samlUser, OrgID: authz.GetInstance(ctx).InstanceID()})
+}
+
+func retry(retryable func() error) (err error) {
+ for i := 0; i < retryCount; i++ {
+ err = retryable()
+ if err == nil {
+ return nil
+ }
+ time.Sleep(retryBackoff)
+ }
+ return err
+}
diff --git a/internal/api/saml/provider.go b/internal/api/saml/provider.go
new file mode 100644
index 0000000000..aec8f0e8f3
--- /dev/null
+++ b/internal/api/saml/provider.go
@@ -0,0 +1,102 @@
+package saml
+
+import (
+ "context"
+ "database/sql"
+ "fmt"
+ "net/http"
+
+ "github.com/zitadel/saml/pkg/provider"
+
+ http_utils "github.com/zitadel/zitadel/internal/api/http"
+ "github.com/zitadel/zitadel/internal/api/http/middleware"
+ "github.com/zitadel/zitadel/internal/api/ui/login"
+ "github.com/zitadel/zitadel/internal/auth/repository"
+ "github.com/zitadel/zitadel/internal/command"
+ "github.com/zitadel/zitadel/internal/crypto"
+ "github.com/zitadel/zitadel/internal/eventstore"
+ "github.com/zitadel/zitadel/internal/eventstore/handler/crdb"
+ "github.com/zitadel/zitadel/internal/query"
+ "github.com/zitadel/zitadel/internal/telemetry/metrics"
+)
+
+const (
+ HandlerPrefix = "/saml/v2"
+)
+
+type Config struct {
+ ProviderConfig *provider.Config
+}
+
+func NewProvider(
+ ctx context.Context,
+ conf Config,
+ externalSecure bool,
+ command *command.Commands,
+ query *query.Queries,
+ repo repository.Repository,
+ encAlg crypto.EncryptionAlgorithm,
+ certEncAlg crypto.EncryptionAlgorithm,
+ es *eventstore.Eventstore,
+ projections *sql.DB,
+ instanceHandler,
+ userAgentCookie func(http.Handler) http.Handler,
+) (*provider.Provider, error) {
+ metricTypes := []metrics.MetricType{metrics.MetricTypeRequestCount, metrics.MetricTypeStatusCode, metrics.MetricTypeTotalCount}
+
+ provStorage, err := newStorage(
+ command,
+ query,
+ repo,
+ encAlg,
+ certEncAlg,
+ es,
+ projections,
+ )
+ if err != nil {
+ return nil, err
+ }
+
+ options := []provider.Option{
+ provider.WithHttpInterceptors(
+ middleware.MetricsHandler(metricTypes),
+ middleware.TelemetryHandler(),
+ middleware.NoCacheInterceptor().Handler,
+ instanceHandler,
+ userAgentCookie,
+ http_utils.CopyHeadersToContext,
+ ),
+ }
+ if !externalSecure {
+ options = append(options, provider.WithAllowInsecure())
+ }
+
+ return provider.NewProvider(
+ ctx,
+ provStorage,
+ HandlerPrefix,
+ conf.ProviderConfig,
+ options...,
+ )
+}
+
+func newStorage(
+ command *command.Commands,
+ query *query.Queries,
+ repo repository.Repository,
+ encAlg crypto.EncryptionAlgorithm,
+ certEncAlg crypto.EncryptionAlgorithm,
+ es *eventstore.Eventstore,
+ projections *sql.DB,
+) (*Storage, error) {
+ return &Storage{
+ encAlg: encAlg,
+ certEncAlg: certEncAlg,
+ locker: crdb.NewLocker(projections, locksTable, signingKey),
+ eventstore: es,
+ repo: repo,
+ command: command,
+ query: query,
+ defaultLoginURL: fmt.Sprintf("%s%s?%s=", login.HandlerPrefix, login.EndpointLogin, login.QueryAuthRequestID),
+ }, nil
+}
diff --git a/internal/api/saml/storage.go b/internal/api/saml/storage.go
new file mode 100644
index 0000000000..4632ec9db8
--- /dev/null
+++ b/internal/api/saml/storage.go
@@ -0,0 +1,187 @@
+package saml
+
+import (
+ "context"
+ "time"
+
+ "github.com/zitadel/saml/pkg/provider"
+ "github.com/zitadel/saml/pkg/provider/key"
+ "github.com/zitadel/saml/pkg/provider/models"
+ "github.com/zitadel/saml/pkg/provider/serviceprovider"
+ "github.com/zitadel/saml/pkg/provider/xml/samlp"
+
+ "github.com/zitadel/zitadel/internal/api/http/middleware"
+ "github.com/zitadel/zitadel/internal/auth/repository"
+ "github.com/zitadel/zitadel/internal/command"
+ "github.com/zitadel/zitadel/internal/crypto"
+ "github.com/zitadel/zitadel/internal/domain"
+ "github.com/zitadel/zitadel/internal/errors"
+ "github.com/zitadel/zitadel/internal/eventstore"
+ "github.com/zitadel/zitadel/internal/eventstore/handler/crdb"
+ "github.com/zitadel/zitadel/internal/query"
+ "github.com/zitadel/zitadel/internal/telemetry/tracing"
+)
+
+var _ provider.EntityStorage = &Storage{}
+var _ provider.IdentityProviderStorage = &Storage{}
+var _ provider.AuthStorage = &Storage{}
+var _ provider.UserStorage = &Storage{}
+
+type Storage struct {
+ certChan <-chan interface{}
+ defaultCertificateLifetime time.Duration
+
+ currentCACertificate query.Certificate
+ currentMetadataCertificate query.Certificate
+ currentResponseCertificate query.Certificate
+
+ locker crdb.Locker
+ certificateAlgorithm string
+ encAlg crypto.EncryptionAlgorithm
+ certEncAlg crypto.EncryptionAlgorithm
+
+ eventstore *eventstore.Eventstore
+ repo repository.Repository
+ command *command.Commands
+ query *query.Queries
+
+ defaultLoginURL string
+}
+
+func (p *Storage) GetEntityByID(ctx context.Context, entityID string) (*serviceprovider.ServiceProvider, error) {
+ app, err := p.query.AppBySAMLEntityID(ctx, entityID)
+ if err != nil {
+ return nil, err
+ }
+ return serviceprovider.NewServiceProvider(
+ app.ID,
+ &serviceprovider.Config{
+ Metadata: app.SAMLConfig.Metadata,
+ },
+ p.defaultLoginURL,
+ )
+}
+
+func (p *Storage) GetEntityIDByAppID(ctx context.Context, appID string) (string, error) {
+ app, err := p.query.AppByID(ctx, appID)
+ if err != nil {
+ return "", err
+ }
+ return app.SAMLConfig.EntityID, nil
+}
+
+func (p *Storage) Health(context.Context) error {
+ return nil
+}
+
+func (p *Storage) GetCA(ctx context.Context) (*key.CertificateAndKey, error) {
+ return p.GetCertificateAndKey(ctx, domain.KeyUsageSAMLCA)
+}
+
+func (p *Storage) GetMetadataSigningKey(ctx context.Context) (*key.CertificateAndKey, error) {
+ return p.GetCertificateAndKey(ctx, domain.KeyUsageSAMLMetadataSigning)
+}
+
+func (p *Storage) GetResponseSigningKey(ctx context.Context) (*key.CertificateAndKey, error) {
+ return p.GetCertificateAndKey(ctx, domain.KeyUsageSAMLResponseSinging)
+}
+
+func (p *Storage) CreateAuthRequest(ctx context.Context, req *samlp.AuthnRequestType, acsUrl, protocolBinding, relayState, applicationID string) (_ models.AuthRequestInt, err error) {
+ ctx, span := tracing.NewSpan(ctx)
+ defer func() { span.EndWithError(err) }()
+ userAgentID, ok := middleware.UserAgentIDFromCtx(ctx)
+ if !ok {
+ return nil, errors.ThrowPreconditionFailed(nil, "SAML-sd436", "no user agent id")
+ }
+
+ authRequest := CreateAuthRequestToBusiness(ctx, req, acsUrl, protocolBinding, applicationID, relayState, userAgentID)
+
+ resp, err := p.repo.CreateAuthRequest(ctx, authRequest)
+ if err != nil {
+ return nil, err
+ }
+
+ return AuthRequestFromBusiness(resp)
+}
+
+func (p *Storage) AuthRequestByID(ctx context.Context, id string) (_ models.AuthRequestInt, err error) {
+ ctx, span := tracing.NewSpan(ctx)
+ defer func() { span.EndWithError(err) }()
+ userAgentID, ok := middleware.UserAgentIDFromCtx(ctx)
+ if !ok {
+ return nil, errors.ThrowPreconditionFailed(nil, "SAML-D3g21", "no user agent id")
+ }
+ resp, err := p.repo.AuthRequestByIDCheckLoggedIn(ctx, id, userAgentID)
+ if err != nil {
+ return nil, err
+ }
+ return AuthRequestFromBusiness(resp)
+}
+
+func (p *Storage) SetUserinfoWithUserID(ctx context.Context, userinfo models.AttributeSetter, userID string, attributes []int) (err error) {
+ ctx, span := tracing.NewSpan(ctx)
+ defer func() { span.EndWithError(err) }()
+ user, err := p.query.GetUserByID(ctx, true, userID)
+ if err != nil {
+ return err
+ }
+
+ setUserinfo(user, userinfo, attributes)
+ return nil
+}
+
+func (p *Storage) SetUserinfoWithLoginName(ctx context.Context, userinfo models.AttributeSetter, loginName string, attributes []int) (err error) {
+ ctx, span := tracing.NewSpan(ctx)
+ defer func() { span.EndWithError(err) }()
+
+ loginNameSQ, err := query.NewUserLoginNamesSearchQuery(loginName)
+ if err != nil {
+ return err
+ }
+ user, err := p.query.GetUser(ctx, true, loginNameSQ)
+ if err != nil {
+ return err
+ }
+
+ setUserinfo(user, userinfo, attributes)
+ return nil
+}
+
+func setUserinfo(user *query.User, userinfo models.AttributeSetter, attributes []int) {
+ if len(attributes) == 0 {
+ userinfo.SetUsername(user.PreferredLoginName)
+ userinfo.SetUserID(user.ID)
+ if user.Human == nil {
+ return
+ }
+ userinfo.SetEmail(user.Human.Email)
+ userinfo.SetSurname(user.Human.LastName)
+ userinfo.SetGivenName(user.Human.FirstName)
+ userinfo.SetFullName(user.Human.DisplayName)
+ return
+ }
+ for _, attribute := range attributes {
+ switch attribute {
+ case provider.AttributeEmail:
+ if user.Human != nil {
+ userinfo.SetEmail(user.Human.Email)
+ }
+ case provider.AttributeSurname:
+ if user.Human != nil {
+ userinfo.SetSurname(user.Human.LastName)
+ }
+ case provider.AttributeFullName:
+ if user.Human != nil {
+ userinfo.SetFullName(user.Human.DisplayName)
+ }
+ case provider.AttributeGivenName:
+ if user.Human != nil {
+ userinfo.SetGivenName(user.Human.FirstName)
+ }
+ case provider.AttributeUsername:
+ userinfo.SetUsername(user.PreferredLoginName)
+ case provider.AttributeUserID:
+ userinfo.SetUserID(user.ID)
+ }
+ }
+}
diff --git a/internal/api/ui/login/external_login_handler.go b/internal/api/ui/login/external_login_handler.go
index 35cf0710d3..eeab767545 100644
--- a/internal/api/ui/login/external_login_handler.go
+++ b/internal/api/ui/login/external_login_handler.go
@@ -374,7 +374,7 @@ func (l *Login) handleAutoRegister(w http.ResponseWriter, r *http.Request, authR
return
}
linkingUser = l.mapExternalNotFoundOptionFormDataToLoginUser(data)
- }
+ }
user, externalIDP, metadata := l.mapExternalUserToLoginUser(orgIamPolicy, linkingUser, idpConfig)
diff --git a/internal/api/ui/login/login.go b/internal/api/ui/login/login.go
index 19964a1a39..79e7bdaa97 100644
--- a/internal/api/ui/login/login.go
+++ b/internal/api/ui/login/login.go
@@ -37,6 +37,7 @@ type Login struct {
externalSecure bool
consolePath string
oidcAuthCallbackURL func(context.Context, string) string
+ samlAuthCallbackURL func(context.Context, string) string
idpConfigAlg crypto.EncryptionAlgorithm
userCodeAlg crypto.EncryptionAlgorithm
}
@@ -61,10 +62,12 @@ func CreateLogin(config Config,
staticStorage static.Storage,
consolePath string,
oidcAuthCallbackURL func(context.Context, string) string,
+ samlAuthCallbackURL func(context.Context, string) string,
externalSecure bool,
userAgentCookie,
issuerInterceptor,
- instanceHandler,
+ oidcInstanceHandler,
+ samlInstanceHandler mux.MiddlewareFunc,
assetCache mux.MiddlewareFunc,
userCodeAlg crypto.EncryptionAlgorithm,
idpConfigAlg crypto.EncryptionAlgorithm,
@@ -73,6 +76,7 @@ func CreateLogin(config Config,
login := &Login{
oidcAuthCallbackURL: oidcAuthCallbackURL,
+ samlAuthCallbackURL: samlAuthCallbackURL,
externalSecure: externalSecure,
consolePath: consolePath,
command: command,
@@ -91,7 +95,7 @@ func CreateLogin(config Config,
cacheInterceptor := createCacheInterceptor(config.Cache.MaxAge, config.Cache.SharedMaxAge, assetCache)
security := middleware.SecurityHeaders(csp(), login.cspErrorHandler)
- login.router = CreateRouter(login, statikFS, middleware.TelemetryHandler(IgnoreInstanceEndpoints...), instanceHandler, csrfInterceptor, cacheInterceptor, security, userAgentCookie, issuerInterceptor)
+ login.router = CreateRouter(login, statikFS, middleware.TelemetryHandler(IgnoreInstanceEndpoints...), oidcInstanceHandler, samlInstanceHandler, csrfInterceptor, cacheInterceptor, security, userAgentCookie, issuerInterceptor)
login.renderer = CreateRenderer(HandlerPrefix, statikFS, staticStorage, config.LanguageCookieName)
login.parser = form.NewParser()
return login, nil
diff --git a/internal/api/ui/login/login_success_handler.go b/internal/api/ui/login/login_success_handler.go
index 3d9e7dabf1..b97fb058a7 100644
--- a/internal/api/ui/login/login_success_handler.go
+++ b/internal/api/ui/login/login_success_handler.go
@@ -4,6 +4,7 @@ import (
"net/http"
"github.com/zitadel/zitadel/internal/domain"
+ caos_errs "github.com/zitadel/zitadel/internal/errors"
)
const (
@@ -43,11 +44,26 @@ func (l *Login) renderSuccessAndCallback(w http.ResponseWriter, r *http.Request,
userData: l.getUserData(r, authReq, "Login Successful", errID, errMessage),
}
if authReq != nil {
- data.RedirectURI = l.oidcAuthCallbackURL(r.Context(), "") //the id will be set via the html (maybe change this with the login refactoring)
+ //the id will be set via the html (maybe change this with the login refactoring)
+ if _, ok := authReq.Request.(*domain.AuthRequestOIDC); ok {
+ data.RedirectURI = l.oidcAuthCallbackURL(r.Context(), "")
+ } else if _, ok := authReq.Request.(*domain.AuthRequestSAML); ok {
+ data.RedirectURI = l.samlAuthCallbackURL(r.Context(), "")
+ }
}
l.renderer.RenderTemplate(w, r, l.getTranslator(r.Context(), authReq), l.renderer.Templates[tmplLoginSuccess], data, nil)
}
func (l *Login) redirectToCallback(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest) {
- http.Redirect(w, r, l.oidcAuthCallbackURL(r.Context(), authReq.ID), http.StatusFound)
+ var callback string
+ switch authReq.Request.(type) {
+ case *domain.AuthRequestOIDC:
+ callback = l.oidcAuthCallbackURL(r.Context(), authReq.ID)
+ case *domain.AuthRequestSAML:
+ callback = l.samlAuthCallbackURL(r.Context(), authReq.ID)
+ default:
+ l.renderInternalError(w, r, authReq, caos_errs.ThrowInternal(nil, "LOGIN-rhjQF", "Errors.AuthRequest.RequestTypeNotSupported"))
+ return
+ }
+ http.Redirect(w, r, callback, http.StatusFound)
}
diff --git a/internal/auth/repository/eventsourcing/eventstore/auth_request.go b/internal/auth/repository/eventsourcing/eventstore/auth_request.go
index 568fac2a09..2d4eb9366f 100644
--- a/internal/auth/repository/eventsourcing/eventstore/auth_request.go
+++ b/internal/auth/repository/eventsourcing/eventstore/auth_request.go
@@ -97,12 +97,12 @@ type orgViewProvider interface {
}
type userGrantProvider interface {
- ProjectByOIDCClientID(context.Context, string) (*query.Project, error)
+ ProjectByClientID(context.Context, string) (*query.Project, error)
UserGrantsByProjectAndUserID(context.Context, string, string) ([]*query.UserGrant, error)
}
type projectProvider interface {
- ProjectByOIDCClientID(context.Context, string) (*query.Project, error)
+ ProjectByClientID(context.Context, string) (*query.Project, error)
OrgProjectMappingByIDs(orgID, projectID, instanceID string) (*project_view_model.OrgProjectMapping, error)
}
@@ -122,7 +122,7 @@ func (repo *AuthRequestRepo) CreateAuthRequest(ctx context.Context, request *dom
return nil, err
}
request.ID = reqID
- project, err := repo.ProjectProvider.ProjectByOIDCClientID(ctx, request.ApplicationID)
+ project, err := repo.ProjectProvider.ProjectByClientID(ctx, request.ApplicationID)
if err != nil {
return nil, err
}
@@ -1048,6 +1048,9 @@ func (repo *AuthRequestRepo) getLoginTexts(ctx context.Context, aggregateID stri
}
func (repo *AuthRequestRepo) hasSucceededPage(ctx context.Context, request *domain.AuthRequest, provider applicationProvider) (bool, error) {
+ if _, ok := request.Request.(*domain.AuthRequestOIDC); !ok {
+ return false, nil
+ }
app, err := provider.AppByOIDCClientID(ctx, request.ApplicationID)
if err != nil {
return false, err
@@ -1257,8 +1260,8 @@ func linkingIDPConfigExistingInAllowedIDPs(linkingUsers []*domain.ExternalUser,
func userGrantRequired(ctx context.Context, request *domain.AuthRequest, user *user_model.UserView, userGrantProvider userGrantProvider) (_ bool, err error) {
var project *query.Project
switch request.Request.Type() {
- case domain.AuthRequestTypeOIDC:
- project, err = userGrantProvider.ProjectByOIDCClientID(ctx, request.ApplicationID)
+ case domain.AuthRequestTypeOIDC, domain.AuthRequestTypeSAML:
+ project, err = userGrantProvider.ProjectByClientID(ctx, request.ApplicationID)
if err != nil {
return false, err
}
@@ -1278,8 +1281,8 @@ func userGrantRequired(ctx context.Context, request *domain.AuthRequest, user *u
func projectRequired(ctx context.Context, request *domain.AuthRequest, projectProvider projectProvider) (_ bool, err error) {
var project *query.Project
switch request.Request.Type() {
- case domain.AuthRequestTypeOIDC:
- project, err = projectProvider.ProjectByOIDCClientID(ctx, request.ApplicationID)
+ case domain.AuthRequestTypeOIDC, domain.AuthRequestTypeSAML:
+ project, err = projectProvider.ProjectByClientID(ctx, request.ApplicationID)
if err != nil {
return false, err
}
diff --git a/internal/auth/repository/eventsourcing/eventstore/auth_request_test.go b/internal/auth/repository/eventsourcing/eventstore/auth_request_test.go
index 33ce88439f..09aa65716c 100644
--- a/internal/auth/repository/eventsourcing/eventstore/auth_request_test.go
+++ b/internal/auth/repository/eventsourcing/eventstore/auth_request_test.go
@@ -22,6 +22,10 @@ import (
user_view_model "github.com/zitadel/zitadel/internal/user/repository/view/model"
)
+var (
+ testNow = time.Now()
+)
+
type mockViewNoUserSession struct{}
func (m *mockViewNoUserSession) UserSessionByIDs(string, string, string) (*user_view_model.UserSessionView, error) {
@@ -191,7 +195,7 @@ type mockUserGrants struct {
userGrants int
}
-func (m *mockUserGrants) ProjectByOIDCClientID(ctx context.Context, s string) (*query.Project, error) {
+func (m *mockUserGrants) ProjectByClientID(ctx context.Context, s string) (*query.Project, error) {
return &query.Project{ProjectRoleCheck: m.roleCheck}, nil
}
@@ -208,7 +212,7 @@ type mockProject struct {
projectCheck bool
}
-func (m *mockProject) ProjectByOIDCClientID(ctx context.Context, s string) (*query.Project, error) {
+func (m *mockProject) ProjectByClientID(ctx context.Context, s string) (*query.Project, error) {
return &query.Project{HasProjectCheck: m.projectCheck}, nil
}
@@ -615,8 +619,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"passwordless verified, email not verified, email verification step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordlessVerification: time.Now().Add(-5 * time.Minute),
- MultiFactorVerification: time.Now().Add(-5 * time.Minute),
+ PasswordlessVerification: testNow.Add(-5 * time.Minute),
+ MultiFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -667,7 +671,7 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"external user (no external verification), external login step",
fields{
userSessionViewProvider: &mockViewUserSession{
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
IsEmailVerified: true,
@@ -699,8 +703,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"external user (external verification set), callback",
fields{
userSessionViewProvider: &mockViewUserSession{
- ExternalLoginVerification: time.Now().UTC().Add(-5 * time.Minute),
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ ExternalLoginVerification: testNow.Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
IsEmailVerified: true,
@@ -759,8 +763,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"external user (no password check needed), callback",
fields{
userSessionViewProvider: &mockViewUserSession{
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
- ExternalLoginVerification: time.Now().UTC().Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
+ ExternalLoginVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -795,7 +799,7 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"password verified, passwordless set up, mfa not verified, mfa check step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -829,7 +833,7 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"mfa not verified, mfa check step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -862,8 +866,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"external user, mfa not verified, mfa check step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
- ExternalLoginVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
+ ExternalLoginVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -898,8 +902,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"password change required and email verified, password change step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -931,8 +935,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"email not verified and no password change required, mail verification step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -961,8 +965,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"email not verified and password change required, mail verification step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -992,8 +996,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"email verified and no password change required, redirect to callback step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -1027,8 +1031,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"prompt none, checkLoggedIn true and authenticated, redirect to callback step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -1063,8 +1067,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"prompt none, checkLoggedIn true, authenticated and native, login succeeded step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -1099,8 +1103,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"prompt none, checkLoggedIn true, authenticated and required user grants missing, grant required step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -1137,8 +1141,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"prompt none, checkLoggedIn true, authenticated and required user grants exist, redirect to callback step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -1176,8 +1180,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"prompt none, checkLoggedIn true, authenticated and required project missing, project required step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -1214,8 +1218,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"prompt none, checkLoggedIn true, authenticated and required project exist, redirect to callback step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -1253,7 +1257,7 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"linking users, password step",
fields{
userSessionViewProvider: &mockViewUserSession{
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -1287,8 +1291,8 @@ func TestAuthRequestRepo_nextSteps(t *testing.T) {
"linking users, linking step",
fields{
userSessionViewProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Add(-5 * time.Minute),
- SecondFactorVerification: time.Now().UTC().Add(-5 * time.Minute),
+ PasswordVerification: testNow.Add(-5 * time.Minute),
+ SecondFactorVerification: testNow.Add(-5 * time.Minute),
},
userViewProvider: &mockViewUser{
PasswordSet: true,
@@ -1463,7 +1467,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) {
user: &user_model.UserView{
HumanView: &user_model.HumanView{
MFAMaxSetUp: domain.MFALevelNotSetUp,
- MFAInitSkipped: time.Now().UTC(),
+ MFAInitSkipped: testNow,
},
},
},
@@ -1486,7 +1490,7 @@ func TestAuthRequestRepo_mfaChecked(t *testing.T) {
OTPState: user_model.MFAStateReady,
},
},
- userSession: &user_model.UserSessionView{SecondFactorVerification: time.Now().UTC().Add(-5 * time.Hour)},
+ userSession: &user_model.UserSessionView{SecondFactorVerification: testNow.Add(-5 * time.Hour)},
},
nil,
true,
@@ -1569,7 +1573,7 @@ func TestAuthRequestRepo_mfaSkippedOrSetUp(t *testing.T) {
user: &user_model.UserView{
HumanView: &user_model.HumanView{
MFAMaxSetUp: -1,
- MFAInitSkipped: time.Now().UTC().Add(-10 * time.Hour),
+ MFAInitSkipped: testNow.Add(-10 * time.Hour),
},
},
request: &domain.AuthRequest{
@@ -1587,7 +1591,7 @@ func TestAuthRequestRepo_mfaSkippedOrSetUp(t *testing.T) {
user: &user_model.UserView{
HumanView: &user_model.HumanView{
MFAMaxSetUp: -1,
- MFAInitSkipped: time.Now().UTC().Add(-40 * 24 * time.Hour),
+ MFAInitSkipped: testNow.Add(-40 * 24 * time.Hour),
},
},
request: &domain.AuthRequest{
@@ -1645,13 +1649,13 @@ func Test_userSessionByIDs(t *testing.T) {
"error user events, old view model state",
args{
userProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Round(1 * time.Second),
+ PasswordVerification: testNow,
},
user: &user_model.UserView{ID: "id", HumanView: &user_model.HumanView{FirstName: "FirstName"}},
eventProvider: &mockEventErrUser{},
},
&user_model.UserSessionView{
- PasswordVerification: time.Now().UTC().Round(1 * time.Second),
+ PasswordVerification: testNow,
SecondFactorVerification: time.Time{},
MultiFactorVerification: time.Time{},
},
@@ -1661,7 +1665,7 @@ func Test_userSessionByIDs(t *testing.T) {
"new user events but error, old view model state",
args{
userProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Round(1 * time.Second),
+ PasswordVerification: testNow,
},
agentID: "agentID",
user: &user_model.UserView{ID: "id", HumanView: &user_model.HumanView{FirstName: "FirstName"}},
@@ -1669,12 +1673,12 @@ func Test_userSessionByIDs(t *testing.T) {
&es_models.Event{
AggregateType: user_repo.AggregateType,
Type: es_models.EventType(user_repo.UserV1MFAOTPCheckSucceededType),
- CreationDate: time.Now().UTC().Round(1 * time.Second),
+ CreationDate: testNow,
},
},
},
&user_model.UserSessionView{
- PasswordVerification: time.Now().UTC().Round(1 * time.Second),
+ PasswordVerification: testNow,
SecondFactorVerification: time.Time{},
MultiFactorVerification: time.Time{},
},
@@ -1684,7 +1688,7 @@ func Test_userSessionByIDs(t *testing.T) {
"new user events but other agentID, old view model state",
args{
userProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Round(1 * time.Second),
+ PasswordVerification: testNow,
},
agentID: "agentID",
user: &user_model.UserView{ID: "id"},
@@ -1692,7 +1696,7 @@ func Test_userSessionByIDs(t *testing.T) {
&es_models.Event{
AggregateType: user_repo.AggregateType,
Type: es_models.EventType(user_repo.UserV1MFAOTPCheckSucceededType),
- CreationDate: time.Now().UTC().Round(1 * time.Second),
+ CreationDate: testNow,
Data: func() []byte {
data, _ := json.Marshal(&user_es_model.AuthRequest{UserAgentID: "otherID"})
return data
@@ -1701,7 +1705,7 @@ func Test_userSessionByIDs(t *testing.T) {
},
},
&user_model.UserSessionView{
- PasswordVerification: time.Now().UTC().Round(1 * time.Second),
+ PasswordVerification: testNow,
SecondFactorVerification: time.Time{},
MultiFactorVerification: time.Time{},
},
@@ -1711,7 +1715,7 @@ func Test_userSessionByIDs(t *testing.T) {
"new user events, new view model state",
args{
userProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Round(1 * time.Second),
+ PasswordVerification: testNow,
},
agentID: "agentID",
user: &user_model.UserView{ID: "id", HumanView: &user_model.HumanView{FirstName: "FirstName"}},
@@ -1719,7 +1723,7 @@ func Test_userSessionByIDs(t *testing.T) {
&es_models.Event{
AggregateType: user_repo.AggregateType,
Type: es_models.EventType(user_repo.UserV1MFAOTPCheckSucceededType),
- CreationDate: time.Now().UTC().Round(1 * time.Second),
+ CreationDate: testNow,
Data: func() []byte {
data, _ := json.Marshal(&user_es_model.AuthRequest{UserAgentID: "agentID"})
return data
@@ -1728,9 +1732,9 @@ func Test_userSessionByIDs(t *testing.T) {
},
},
&user_model.UserSessionView{
- PasswordVerification: time.Now().UTC().Round(1 * time.Second),
- SecondFactorVerification: time.Now().UTC().Round(1 * time.Second),
- ChangeDate: time.Now().UTC().Round(1 * time.Second),
+ PasswordVerification: testNow,
+ SecondFactorVerification: testNow,
+ ChangeDate: testNow,
},
nil,
},
@@ -1738,7 +1742,7 @@ func Test_userSessionByIDs(t *testing.T) {
"new user events (user deleted), precondition failed error",
args{
userProvider: &mockViewUserSession{
- PasswordVerification: time.Now().UTC().Round(1 * time.Second),
+ PasswordVerification: testNow,
},
agentID: "agentID",
user: &user_model.UserView{ID: "id"},
@@ -1816,7 +1820,7 @@ func Test_userByID(t *testing.T) {
&es_models.Event{
AggregateType: user_repo.AggregateType,
Type: es_models.EventType(user_repo.UserV1PasswordChangedType),
- CreationDate: time.Now().UTC().Round(1 * time.Second),
+ CreationDate: testNow,
Data: nil,
},
},
@@ -1842,7 +1846,7 @@ func Test_userByID(t *testing.T) {
&es_models.Event{
AggregateType: user_repo.AggregateType,
Type: es_models.EventType(user_repo.UserV1PasswordChangedType),
- CreationDate: time.Now().UTC().Round(1 * time.Second),
+ CreationDate: testNow,
Data: func() []byte {
data, _ := json.Marshal(user_es_model.Password{ChangeRequired: false, Secret: &crypto.CryptoValue{}})
return data
@@ -1851,13 +1855,13 @@ func Test_userByID(t *testing.T) {
},
},
&user_model.UserView{
- ChangeDate: time.Now().UTC().Round(1 * time.Second),
+ ChangeDate: testNow,
State: user_model.UserStateActive,
UserName: "UserName",
HumanView: &user_model.HumanView{
PasswordSet: true,
PasswordChangeRequired: false,
- PasswordChanged: time.Now().UTC().Round(1 * time.Second),
+ PasswordChanged: testNow,
FirstName: "FirstName",
},
},
diff --git a/internal/command/command.go b/internal/command/command.go
index 983f5114ff..9ca70163f5 100644
--- a/internal/command/command.go
+++ b/internal/command/command.go
@@ -1,10 +1,11 @@
package command
import (
+ "net/http"
"time"
"github.com/zitadel/zitadel/internal/api/authz"
- "github.com/zitadel/zitadel/internal/api/http"
+ api_http "github.com/zitadel/zitadel/internal/api/http"
sd "github.com/zitadel/zitadel/internal/config/systemdefaults"
"github.com/zitadel/zitadel/internal/crypto"
"github.com/zitadel/zitadel/internal/domain"
@@ -23,6 +24,8 @@ import (
)
type Commands struct {
+ httpClient *http.Client
+
eventstore *eventstore.Eventstore
static static.Storage
idGenerator id.Generator
@@ -40,14 +43,17 @@ type Commands struct {
applicationKeySize int
domainVerificationAlg crypto.EncryptionAlgorithm
domainVerificationGenerator crypto.Generator
- domainVerificationValidator func(domain, token, verifier string, checkType http.CheckType) error
+ domainVerificationValidator func(domain, token, verifier string, checkType api_http.CheckType) error
- multifactors domain.MultifactorConfigs
- webauthnConfig *webauthn_helper.Config
- keySize int
- keyAlgorithm crypto.EncryptionAlgorithm
- privateKeyLifetime time.Duration
- publicKeyLifetime time.Duration
+ multifactors domain.MultifactorConfigs
+ webauthnConfig *webauthn_helper.Config
+ keySize int
+ keyAlgorithm crypto.EncryptionAlgorithm
+ certificateAlgorithm crypto.EncryptionAlgorithm
+ certKeySize int
+ privateKeyLifetime time.Duration
+ publicKeyLifetime time.Duration
+ certificateLifetime time.Duration
}
func StartCommands(es *eventstore.Eventstore,
@@ -64,7 +70,9 @@ func StartCommands(es *eventstore.Eventstore,
smsEncryption,
userEncryption,
domainVerificationEncryption,
- oidcEncryption crypto.EncryptionAlgorithm,
+ oidcEncryption,
+ samlEncryption crypto.EncryptionAlgorithm,
+ httpClient *http.Client,
) (repo *Commands, err error) {
if externalDomain == "" {
return nil, errors.ThrowInvalidArgument(nil, "COMMAND-Df21s", "no external domain specified")
@@ -78,15 +86,19 @@ func StartCommands(es *eventstore.Eventstore,
externalSecure: externalSecure,
externalPort: externalPort,
keySize: defaults.KeyConfig.Size,
+ certKeySize: defaults.KeyConfig.CertificateSize,
privateKeyLifetime: defaults.KeyConfig.PrivateKeyLifetime,
publicKeyLifetime: defaults.KeyConfig.PublicKeyLifetime,
+ certificateLifetime: defaults.KeyConfig.CertificateLifetime,
idpConfigEncryption: idpConfigEncryption,
smtpEncryption: smtpEncryption,
smsEncryption: smsEncryption,
userEncryption: userEncryption,
domainVerificationAlg: domainVerificationEncryption,
keyAlgorithm: oidcEncryption,
+ certificateAlgorithm: samlEncryption,
webauthnConfig: webAuthN,
+ httpClient: httpClient,
}
instance_repo.RegisterEventMappers(repo.eventstore)
@@ -109,7 +121,7 @@ func StartCommands(es *eventstore.Eventstore,
}
repo.domainVerificationGenerator = crypto.NewEncryptionGenerator(defaults.DomainVerification.VerificationGenerator, repo.domainVerificationAlg)
- repo.domainVerificationValidator = http.ValidateDomain
+ repo.domainVerificationValidator = api_http.ValidateDomain
return repo, nil
}
diff --git a/internal/command/key_pair.go b/internal/command/key_pair.go
index 6b07659987..ac379aa964 100644
--- a/internal/command/key_pair.go
+++ b/internal/command/key_pair.go
@@ -2,6 +2,10 @@ package command
import (
"context"
+ "crypto/rand"
+ "crypto/rsa"
+ "crypto/x509"
+ "math/big"
"time"
"github.com/zitadel/zitadel/internal/api/authz"
@@ -34,3 +38,138 @@ func (c *Commands) GenerateSigningKeyPair(ctx context.Context, algorithm string)
privateKeyExp, publicKeyExp))
return err
}
+
+func (c *Commands) GenerateSAMLCACertificate(ctx context.Context, algorithm string) error {
+ now := time.Now().UTC()
+ after := now.Add(c.certificateLifetime)
+ randInt, err := rand.Int(rand.Reader, big.NewInt(1000))
+ if err != nil {
+ return err
+ }
+
+ privateCrypto, publicCrypto, certificateCrypto, err := crypto.GenerateEncryptedKeyPairWithCACertificate(c.certKeySize, c.keyAlgorithm, c.certificateAlgorithm, &crypto.CertificateInformations{
+ SerialNumber: randInt,
+ Organisation: []string{"ZITADEL"},
+ CommonName: "ZITADEL SAML CA",
+ NotBefore: now,
+ NotAfter: after,
+ KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageCertSign,
+ })
+ if err != nil {
+ return err
+ }
+ keyID, err := c.idGenerator.Next()
+ if err != nil {
+ return err
+ }
+
+ keyPairWriteModel := NewKeyPairWriteModel(keyID, authz.GetInstance(ctx).InstanceID())
+ keyAgg := KeyPairAggregateFromWriteModel(&keyPairWriteModel.WriteModel)
+ _, err = c.eventstore.Push(ctx,
+ keypair.NewAddedEvent(
+ ctx,
+ keyAgg,
+ domain.KeyUsageSAMLCA,
+ algorithm,
+ privateCrypto, publicCrypto,
+ after, after,
+ ),
+ keypair.NewAddedCertificateEvent(
+ ctx,
+ keyAgg,
+ certificateCrypto,
+ after,
+ ),
+ )
+ return err
+}
+
+func (c *Commands) GenerateSAMLResponseCertificate(ctx context.Context, algorithm string, caPrivateKey *rsa.PrivateKey, caCertificate []byte) error {
+ now := time.Now().UTC()
+ after := now.Add(c.certificateLifetime)
+ randInt, err := rand.Int(rand.Reader, big.NewInt(1000))
+ if err != nil {
+ return err
+ }
+
+ privateCrypto, publicCrypto, certificateCrypto, err := crypto.GenerateEncryptedKeyPairWithCertificate(c.certKeySize, c.keyAlgorithm, c.certificateAlgorithm, caPrivateKey, caCertificate, &crypto.CertificateInformations{
+ SerialNumber: randInt,
+ Organisation: []string{"ZITADEL"},
+ CommonName: "ZITADEL SAML response",
+ NotBefore: now,
+ NotAfter: after,
+ ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+ KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+ })
+ if err != nil {
+ return err
+ }
+ keyID, err := c.idGenerator.Next()
+ if err != nil {
+ return err
+ }
+
+ keyPairWriteModel := NewKeyPairWriteModel(keyID, authz.GetInstance(ctx).InstanceID())
+ keyAgg := KeyPairAggregateFromWriteModel(&keyPairWriteModel.WriteModel)
+ _, err = c.eventstore.Push(ctx,
+ keypair.NewAddedEvent(
+ ctx,
+ keyAgg,
+ domain.KeyUsageSAMLResponseSinging,
+ algorithm,
+ privateCrypto, publicCrypto,
+ after, after,
+ ),
+ keypair.NewAddedCertificateEvent(
+ ctx,
+ keyAgg,
+ certificateCrypto,
+ after,
+ ),
+ )
+ return err
+}
+
+func (c *Commands) GenerateSAMLMetadataCertificate(ctx context.Context, algorithm string, caPrivateKey *rsa.PrivateKey, caCertificate []byte) error {
+ now := time.Now().UTC()
+ after := now.Add(c.certificateLifetime)
+ randInt, err := rand.Int(rand.Reader, big.NewInt(1000))
+ if err != nil {
+ return err
+ }
+ privateCrypto, publicCrypto, certificateCrypto, err := crypto.GenerateEncryptedKeyPairWithCertificate(c.certKeySize, c.keyAlgorithm, c.certificateAlgorithm, caPrivateKey, caCertificate, &crypto.CertificateInformations{
+ SerialNumber: randInt,
+ Organisation: []string{"ZITADEL"},
+ CommonName: "ZITADEL SAML metadata",
+ NotBefore: now,
+ NotAfter: after,
+ ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+ KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+ })
+ if err != nil {
+ return err
+ }
+ keyID, err := c.idGenerator.Next()
+ if err != nil {
+ return err
+ }
+
+ keyPairWriteModel := NewKeyPairWriteModel(keyID, authz.GetInstance(ctx).InstanceID())
+ keyAgg := KeyPairAggregateFromWriteModel(&keyPairWriteModel.WriteModel)
+ _, err = c.eventstore.Push(ctx,
+ keypair.NewAddedEvent(
+ ctx,
+ keyAgg,
+ domain.KeyUsageSAMLMetadataSigning,
+ algorithm,
+ privateCrypto, publicCrypto,
+ after, after),
+ keypair.NewAddedCertificateEvent(
+ ctx,
+ keyAgg,
+ certificateCrypto,
+ after,
+ ),
+ )
+ return err
+}
diff --git a/internal/command/key_pair_model.go b/internal/command/key_pair_model.go
index 7b3bb14f65..e3796f6c64 100644
--- a/internal/command/key_pair_model.go
+++ b/internal/command/key_pair_model.go
@@ -9,10 +9,11 @@ import (
type KeyPairWriteModel struct {
eventstore.WriteModel
- Usage domain.KeyUsage
- Algorithm string
- PrivateKey *domain.Key
- PublicKey *domain.Key
+ Usage domain.KeyUsage
+ Algorithm string
+ PrivateKey *domain.Key
+ PublicKey *domain.Key
+ Certificate *domain.Key
}
func NewKeyPairWriteModel(aggregateID, resourceOwner string) *KeyPairWriteModel {
@@ -42,6 +43,11 @@ func (wm *KeyPairWriteModel) Reduce() error {
Key: e.PublicKey.Key,
Expiry: e.PublicKey.Expiry,
}
+ case *keypair.AddedCertificateEvent:
+ wm.Certificate = &domain.Key{
+ Key: e.Certificate.Key,
+ Expiry: e.Certificate.Expiry,
+ }
}
}
return wm.WriteModel.Reduce()
@@ -53,11 +59,10 @@ func (wm *KeyPairWriteModel) Query() *eventstore.SearchQueryBuilder {
AddQuery().
AggregateTypes(keypair.AggregateType).
AggregateIDs(wm.AggregateID).
- EventTypes(keypair.AddedEventType).
+ EventTypes(keypair.AddedEventType, keypair.AddedCertificateEventType).
Builder()
}
func KeyPairAggregateFromWriteModel(wm *eventstore.WriteModel) *eventstore.Aggregate {
return eventstore.AggregateFromWriteModel(wm, keypair.AggregateType, keypair.AggregateVersion)
-
}
diff --git a/internal/command/project.go b/internal/command/project.go
index 8b795ed07b..007d25701f 100644
--- a/internal/command/project.go
+++ b/internal/command/project.go
@@ -5,6 +5,7 @@ import (
"strings"
"github.com/zitadel/logging"
+
"github.com/zitadel/zitadel/internal/command/preparation"
"github.com/zitadel/zitadel/internal/domain"
"github.com/zitadel/zitadel/internal/errors"
@@ -276,9 +277,20 @@ func (c *Commands) RemoveProject(ctx context.Context, projectID, resourceOwner s
if existingProject.State == domain.ProjectStateUnspecified || existingProject.State == domain.ProjectStateRemoved {
return nil, caos_errs.ThrowNotFound(nil, "COMMAND-3M9sd", "Errors.Project.NotFound")
}
+
+ samlEntityIDsAgg, err := c.getSAMLEntityIdsWriteModelByProjectID(ctx, projectID, resourceOwner)
+ if err != nil {
+ return nil, err
+ }
+
+ uniqueConstraints := make([]*eventstore.EventUniqueConstraint, len(samlEntityIDsAgg.EntityIDs))
+ for i, entityID := range samlEntityIDsAgg.EntityIDs {
+ uniqueConstraints[i] = project.NewRemoveSAMLConfigEntityIDUniqueConstraint(entityID.EntityID)
+ }
+
projectAgg := ProjectAggregateFromWriteModel(&existingProject.WriteModel)
events := []eventstore.Command{
- project.NewProjectRemovedEvent(ctx, projectAgg, existingProject.Name),
+ project.NewProjectRemovedEvent(ctx, projectAgg, existingProject.Name, uniqueConstraints),
}
for _, grantID := range cascadingUserGrantIDs {
@@ -309,3 +321,12 @@ func (c *Commands) getProjectWriteModelByID(ctx context.Context, projectID, reso
}
return projectWriteModel, nil
}
+
+func (c *Commands) getSAMLEntityIdsWriteModelByProjectID(ctx context.Context, projectID, resourceOwner string) (*SAMLEntityIDsWriteModel, error) {
+ samlEntityIDsAgg := NewSAMLEntityIDsWriteModel(projectID, resourceOwner)
+ err := c.eventstore.FilterToQueryReducer(ctx, samlEntityIDsAgg)
+ if err != nil {
+ return nil, err
+ }
+ return samlEntityIDsAgg, nil
+}
diff --git a/internal/command/project_application.go b/internal/command/project_application.go
index 93421f7fbe..dfab284831 100644
--- a/internal/command/project_application.go
+++ b/internal/command/project_application.go
@@ -118,7 +118,13 @@ func (c *Commands) RemoveApplication(ctx context.Context, projectID, appID, reso
}
projectAgg := ProjectAggregateFromWriteModel(&existingApp.WriteModel)
- pushedEvents, err := c.eventstore.Push(ctx, project.NewApplicationRemovedEvent(ctx, projectAgg, appID, existingApp.Name))
+ entityID := ""
+ samlWriteModel, err := c.getSAMLAppWriteModel(ctx, projectID, appID, resourceOwner)
+ if err == nil && samlWriteModel.State != domain.AppStateUnspecified && samlWriteModel.State != domain.AppStateRemoved && samlWriteModel.saml {
+ entityID = samlWriteModel.EntityID
+ }
+
+ pushedEvents, err := c.eventstore.Push(ctx, project.NewApplicationRemovedEvent(ctx, projectAgg, appID, existingApp.Name, entityID))
if err != nil {
return nil, err
}
diff --git a/internal/command/project_application_saml.go b/internal/command/project_application_saml.go
new file mode 100644
index 0000000000..e28e9c635a
--- /dev/null
+++ b/internal/command/project_application_saml.go
@@ -0,0 +1,146 @@
+package command
+
+import (
+ "context"
+
+ "github.com/zitadel/saml/pkg/provider/xml"
+
+ "github.com/zitadel/zitadel/internal/domain"
+ caos_errs "github.com/zitadel/zitadel/internal/errors"
+ "github.com/zitadel/zitadel/internal/eventstore"
+ "github.com/zitadel/zitadel/internal/repository/project"
+)
+
+func (c *Commands) AddSAMLApplication(ctx context.Context, application *domain.SAMLApp, resourceOwner string) (_ *domain.SAMLApp, err error) {
+ if application == nil || application.AggregateID == "" {
+ return nil, caos_errs.ThrowInvalidArgument(nil, "PROJECT-35Fn0", "Errors.Project.App.Invalid")
+ }
+
+ _, err = c.getProjectByID(ctx, application.AggregateID, resourceOwner)
+ if err != nil {
+ return nil, caos_errs.ThrowPreconditionFailed(err, "PROJECT-3p9ss", "Errors.Project.NotFound")
+ }
+
+ addedApplication := NewSAMLApplicationWriteModel(application.AggregateID, resourceOwner)
+ projectAgg := ProjectAggregateFromWriteModel(&addedApplication.WriteModel)
+ events, err := c.addSAMLApplication(ctx, projectAgg, application)
+ if err != nil {
+ return nil, err
+ }
+ addedApplication.AppID = application.AppID
+ pushedEvents, err := c.eventstore.Push(ctx, events...)
+ if err != nil {
+ return nil, err
+ }
+ err = AppendAndReduce(addedApplication, pushedEvents...)
+ if err != nil {
+ return nil, err
+ }
+ result := samlWriteModelToSAMLConfig(addedApplication)
+ return result, nil
+}
+
+func (c *Commands) addSAMLApplication(ctx context.Context, projectAgg *eventstore.Aggregate, samlApp *domain.SAMLApp) (events []eventstore.Command, err error) {
+
+ if samlApp.AppName == "" || !samlApp.IsValid() {
+ return nil, caos_errs.ThrowInvalidArgument(nil, "PROJECT-1n9df", "Errors.Project.App.Invalid")
+ }
+
+ if samlApp.Metadata == nil && samlApp.MetadataURL == "" {
+ return nil, caos_errs.ThrowInvalidArgument(nil, "SAML-podix9", "Errors.Project.App.SAMLMetadataMissing")
+ }
+
+ if samlApp.MetadataURL != "" {
+ data, err := xml.ReadMetadataFromURL(c.httpClient, samlApp.MetadataURL)
+ if err != nil {
+ return nil, caos_errs.ThrowInvalidArgument(err, "SAML-wmqlo1", "Errors.Project.App.SAMLMetadataMissing")
+ }
+ samlApp.Metadata = data
+ }
+
+ entity, err := xml.ParseMetadataXmlIntoStruct(samlApp.Metadata)
+ if err != nil {
+ return nil, caos_errs.ThrowInvalidArgument(err, "SAML-bquso", "Errors.Project.App.SAMLMetadataFormat")
+ }
+
+ samlApp.AppID, err = c.idGenerator.Next()
+ if err != nil {
+ return nil, err
+ }
+
+ return []eventstore.Command{
+ project.NewApplicationAddedEvent(ctx, projectAgg, samlApp.AppID, samlApp.AppName),
+ project.NewSAMLConfigAddedEvent(ctx,
+ projectAgg,
+ samlApp.AppID,
+ string(entity.EntityID),
+ samlApp.Metadata,
+ samlApp.MetadataURL,
+ ),
+ }, nil
+}
+
+func (c *Commands) ChangeSAMLApplication(ctx context.Context, samlApp *domain.SAMLApp, resourceOwner string) (*domain.SAMLApp, error) {
+ if !samlApp.IsValid() || samlApp.AppID == "" || samlApp.AggregateID == "" {
+ return nil, caos_errs.ThrowInvalidArgument(nil, "COMMAND-5n9fs", "Errors.Project.App.SAMLConfigInvalid")
+ }
+
+ existingSAML, err := c.getSAMLAppWriteModel(ctx, samlApp.AggregateID, samlApp.AppID, resourceOwner)
+ if err != nil {
+ return nil, err
+ }
+ if existingSAML.State == domain.AppStateUnspecified || existingSAML.State == domain.AppStateRemoved {
+ return nil, caos_errs.ThrowNotFound(nil, "COMMAND-2n8uU", "Errors.Project.App.NotExisting")
+ }
+ if !existingSAML.IsSAML() {
+ return nil, caos_errs.ThrowInvalidArgument(nil, "COMMAND-GBr35", "Errors.Project.App.IsNotSAML")
+ }
+ projectAgg := ProjectAggregateFromWriteModel(&existingSAML.WriteModel)
+
+ if samlApp.MetadataURL != "" {
+ data, err := xml.ReadMetadataFromURL(c.httpClient, samlApp.MetadataURL)
+ if err != nil {
+ return nil, caos_errs.ThrowInvalidArgument(err, "SAML-J3kg3", "Errors.Project.App.SAMLMetadataMissing")
+ }
+ samlApp.Metadata = data
+ }
+
+ entity, err := xml.ParseMetadataXmlIntoStruct(samlApp.Metadata)
+ if err != nil {
+ return nil, caos_errs.ThrowInvalidArgument(err, "SAML-3fk2b", "Errors.Project.App.SAMLMetadataFormat")
+ }
+
+ changedEvent, hasChanged, err := existingSAML.NewChangedEvent(
+ ctx,
+ projectAgg,
+ samlApp.AppID,
+ string(entity.EntityID),
+ samlApp.Metadata,
+ samlApp.MetadataURL)
+ if err != nil {
+ return nil, err
+ }
+ if !hasChanged {
+ return nil, caos_errs.ThrowPreconditionFailed(nil, "COMMAND-1m88i", "Errors.NoChangesFound")
+ }
+
+ pushedEvents, err := c.eventstore.Push(ctx, changedEvent)
+ if err != nil {
+ return nil, err
+ }
+ err = AppendAndReduce(existingSAML, pushedEvents...)
+ if err != nil {
+ return nil, err
+ }
+
+ return samlWriteModelToSAMLConfig(existingSAML), nil
+}
+
+func (c *Commands) getSAMLAppWriteModel(ctx context.Context, projectID, appID, resourceOwner string) (*SAMLApplicationWriteModel, error) {
+ appWriteModel := NewSAMLApplicationWriteModelWithAppID(projectID, appID, resourceOwner)
+ err := c.eventstore.FilterToQueryReducer(ctx, appWriteModel)
+ if err != nil {
+ return nil, err
+ }
+ return appWriteModel, nil
+}
diff --git a/internal/command/project_application_saml_model.go b/internal/command/project_application_saml_model.go
new file mode 100644
index 0000000000..ee697a029e
--- /dev/null
+++ b/internal/command/project_application_saml_model.go
@@ -0,0 +1,268 @@
+package command
+
+import (
+ "context"
+ "reflect"
+
+ "github.com/zitadel/zitadel/internal/domain"
+ "github.com/zitadel/zitadel/internal/eventstore"
+ "github.com/zitadel/zitadel/internal/repository/project"
+)
+
+type SAMLApplicationWriteModel struct {
+ eventstore.WriteModel
+
+ AppID string
+ AppName string
+ EntityID string
+ Metadata []byte
+ MetadataURL string
+
+ State domain.AppState
+ saml bool
+}
+
+func NewSAMLApplicationWriteModelWithAppID(projectID, appID, resourceOwner string) *SAMLApplicationWriteModel {
+ return &SAMLApplicationWriteModel{
+ WriteModel: eventstore.WriteModel{
+ AggregateID: projectID,
+ ResourceOwner: resourceOwner,
+ },
+ AppID: appID,
+ }
+}
+
+func NewSAMLApplicationWriteModel(projectID, resourceOwner string) *SAMLApplicationWriteModel {
+ return &SAMLApplicationWriteModel{
+ WriteModel: eventstore.WriteModel{
+ AggregateID: projectID,
+ ResourceOwner: resourceOwner,
+ },
+ }
+}
+
+func (wm *SAMLApplicationWriteModel) AppendEvents(events ...eventstore.Event) {
+ for _, event := range events {
+ switch e := event.(type) {
+ case *project.ApplicationAddedEvent:
+ if e.AppID != wm.AppID {
+ continue
+ }
+ wm.WriteModel.AppendEvents(e)
+ case *project.ApplicationChangedEvent:
+ if e.AppID != wm.AppID {
+ continue
+ }
+ wm.WriteModel.AppendEvents(e)
+ case *project.ApplicationDeactivatedEvent:
+ if e.AppID != wm.AppID {
+ continue
+ }
+ wm.WriteModel.AppendEvents(e)
+ case *project.ApplicationReactivatedEvent:
+ if e.AppID != wm.AppID {
+ continue
+ }
+ wm.WriteModel.AppendEvents(e)
+ case *project.ApplicationRemovedEvent:
+ if e.AppID != wm.AppID {
+ continue
+ }
+ wm.WriteModel.AppendEvents(e)
+ case *project.SAMLConfigAddedEvent:
+ if e.AppID != wm.AppID {
+ continue
+ }
+ wm.WriteModel.AppendEvents(e)
+ case *project.SAMLConfigChangedEvent:
+ if e.AppID != wm.AppID {
+ continue
+ }
+ wm.WriteModel.AppendEvents(e)
+ case *project.ProjectRemovedEvent:
+ wm.WriteModel.AppendEvents(e)
+ }
+ }
+}
+
+func (wm *SAMLApplicationWriteModel) Reduce() error {
+ for _, event := range wm.Events {
+ switch e := event.(type) {
+ case *project.ApplicationAddedEvent:
+ wm.AppName = e.Name
+ wm.State = domain.AppStateActive
+ case *project.ApplicationChangedEvent:
+ wm.AppName = e.Name
+ case *project.ApplicationDeactivatedEvent:
+ if wm.State == domain.AppStateRemoved {
+ continue
+ }
+ wm.State = domain.AppStateInactive
+ case *project.ApplicationReactivatedEvent:
+ if wm.State == domain.AppStateRemoved {
+ continue
+ }
+ wm.State = domain.AppStateActive
+ case *project.ApplicationRemovedEvent:
+ wm.State = domain.AppStateRemoved
+ case *project.SAMLConfigAddedEvent:
+ wm.appendAddSAMLEvent(e)
+ case *project.SAMLConfigChangedEvent:
+ wm.appendChangeSAMLEvent(e)
+ case *project.ProjectRemovedEvent:
+ wm.State = domain.AppStateRemoved
+ }
+ }
+ return wm.WriteModel.Reduce()
+}
+
+func (wm *SAMLApplicationWriteModel) appendAddSAMLEvent(e *project.SAMLConfigAddedEvent) {
+ wm.saml = true
+ wm.Metadata = e.Metadata
+ wm.MetadataURL = e.MetadataURL
+ wm.EntityID = e.EntityID
+}
+
+func (wm *SAMLApplicationWriteModel) appendChangeSAMLEvent(e *project.SAMLConfigChangedEvent) {
+ wm.saml = true
+ if e.Metadata != nil {
+ wm.Metadata = e.Metadata
+ }
+ if e.MetadataURL != nil {
+ wm.MetadataURL = *e.MetadataURL
+ }
+ if e.EntityID != "" {
+ wm.EntityID = e.EntityID
+ }
+}
+
+func (wm *SAMLApplicationWriteModel) Query() *eventstore.SearchQueryBuilder {
+ return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
+ ResourceOwner(wm.ResourceOwner).
+ AddQuery().
+ AggregateTypes(project.AggregateType).
+ AggregateIDs(wm.AggregateID).
+ EventTypes(
+ project.ApplicationAddedType,
+ project.ApplicationChangedType,
+ project.ApplicationDeactivatedType,
+ project.ApplicationReactivatedType,
+ project.ApplicationRemovedType,
+ project.SAMLConfigAddedType,
+ project.SAMLConfigChangedType,
+ project.ProjectRemovedType).
+ Builder()
+}
+
+func (wm *SAMLApplicationWriteModel) NewChangedEvent(
+ ctx context.Context,
+ aggregate *eventstore.Aggregate,
+ appID string,
+ entityID string,
+ metadata []byte,
+ metadataURL string,
+) (*project.SAMLConfigChangedEvent, bool, error) {
+ changes := make([]project.SAMLConfigChanges, 0)
+ var err error
+ if !reflect.DeepEqual(wm.Metadata, metadata) {
+ changes = append(changes, project.ChangeMetadata(metadata))
+ }
+ if wm.MetadataURL != metadataURL {
+ changes = append(changes, project.ChangeMetadataURL(metadataURL))
+ }
+ if wm.EntityID != entityID {
+ changes = append(changes, project.ChangeEntityID(entityID))
+ }
+
+ if len(changes) == 0 {
+ return nil, false, nil
+ }
+ changeEvent, err := project.NewSAMLConfigChangedEvent(ctx, aggregate, appID, wm.EntityID, changes)
+ if err != nil {
+ return nil, false, err
+ }
+ return changeEvent, true, nil
+}
+
+func (wm *SAMLApplicationWriteModel) IsSAML() bool {
+ return wm.saml
+}
+
+type AppIDToEntityID struct {
+ AppID string
+ EntityID string
+}
+
+type SAMLEntityIDsWriteModel struct {
+ eventstore.WriteModel
+
+ EntityIDs []*AppIDToEntityID
+}
+
+func NewSAMLEntityIDsWriteModel(projectID, resourceOwner string) *SAMLEntityIDsWriteModel {
+ return &SAMLEntityIDsWriteModel{
+ WriteModel: eventstore.WriteModel{
+ AggregateID: projectID,
+ ResourceOwner: resourceOwner,
+ },
+ EntityIDs: []*AppIDToEntityID{},
+ }
+}
+
+func (wm *SAMLEntityIDsWriteModel) Query() *eventstore.SearchQueryBuilder {
+ return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
+ ResourceOwner(wm.ResourceOwner).
+ AddQuery().
+ AggregateTypes(project.AggregateType).
+ AggregateIDs(wm.AggregateID).
+ EventTypes(
+ project.ApplicationRemovedType,
+ project.SAMLConfigAddedType,
+ project.SAMLConfigChangedType).
+ Builder()
+}
+
+func (wm *SAMLEntityIDsWriteModel) AppendEvents(events ...eventstore.Event) {
+ for _, event := range events {
+ switch e := event.(type) {
+ case *project.ApplicationRemovedEvent:
+ wm.WriteModel.AppendEvents(e)
+ case *project.SAMLConfigAddedEvent:
+ wm.WriteModel.AppendEvents(e)
+ case *project.SAMLConfigChangedEvent:
+ if e.EntityID != "" {
+ wm.WriteModel.AppendEvents(e)
+ }
+ }
+ }
+}
+
+func (wm *SAMLEntityIDsWriteModel) Reduce() error {
+ for _, event := range wm.Events {
+ switch e := event.(type) {
+ case *project.ApplicationRemovedEvent:
+ removeAppIDFromEntityIDs(wm.EntityIDs, e.AppID)
+ case *project.SAMLConfigAddedEvent:
+ wm.EntityIDs = append(wm.EntityIDs, &AppIDToEntityID{AppID: e.AppID, EntityID: e.EntityID})
+ case *project.SAMLConfigChangedEvent:
+ for i := range wm.EntityIDs {
+ item := wm.EntityIDs[i]
+ if e.AppID == item.AppID && e.EntityID != "" {
+ item.EntityID = e.EntityID
+ }
+ }
+ }
+ }
+ return wm.WriteModel.Reduce()
+}
+
+func removeAppIDFromEntityIDs(items []*AppIDToEntityID, appID string) []*AppIDToEntityID {
+ for i := len(items) - 1; i >= 0; i-- {
+ if items[i].AppID == appID {
+ items[i] = items[len(items)-1]
+ items[len(items)-1] = nil
+ items = items[:len(items)-1]
+ }
+ }
+ return items
+}
diff --git a/internal/command/project_application_saml_test.go b/internal/command/project_application_saml_test.go
new file mode 100644
index 0000000000..e2ea8e9d16
--- /dev/null
+++ b/internal/command/project_application_saml_test.go
@@ -0,0 +1,776 @@
+package command
+
+import (
+ "bytes"
+ "context"
+ "io/ioutil"
+ "net/http"
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+
+ "github.com/zitadel/zitadel/internal/domain"
+ "github.com/zitadel/zitadel/internal/errors"
+ "github.com/zitadel/zitadel/internal/eventstore"
+ "github.com/zitadel/zitadel/internal/eventstore/repository"
+ "github.com/zitadel/zitadel/internal/eventstore/v1/models"
+ "github.com/zitadel/zitadel/internal/id"
+ id_mock "github.com/zitadel/zitadel/internal/id/mock"
+ "github.com/zitadel/zitadel/internal/repository/project"
+)
+
+var testMetadata = []byte(`
+
+
+ urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
+
+
+
+
+`)
+var testMetadataChangedEntityID = []byte(`
+
+
+ urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
+
+
+
+
+`)
+
+func TestCommandSide_AddSAMLApplication(t *testing.T) {
+ type fields struct {
+ eventstore *eventstore.Eventstore
+ idGenerator id.Generator
+ httpClient *http.Client
+ }
+ type args struct {
+ ctx context.Context
+ samlApp *domain.SAMLApp
+ resourceOwner string
+ }
+ type res struct {
+ want *domain.SAMLApp
+ err func(error) bool
+ }
+ tests := []struct {
+ name string
+ fields fields
+ args args
+ res res
+ }{
+ {
+ name: "no aggregate id, invalid argument error",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ ),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{},
+ resourceOwner: "org1",
+ },
+ res: res{
+ err: errors.IsErrorInvalidArgument,
+ },
+ },
+ {
+ name: "project not existing, not found error",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(),
+ ),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ },
+ AppID: "app1",
+ AppName: "app",
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ err: errors.IsPreconditionFailed,
+ },
+ },
+ {
+ name: "invalid app, invalid argument error",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(
+ eventFromEventPusher(
+ project.NewProjectAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "project", true, true, true,
+ domain.PrivateLabelingSettingUnspecified),
+ ),
+ ),
+ ),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ },
+ AppID: "app1",
+ AppName: "",
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ err: errors.IsErrorInvalidArgument,
+ },
+ },
+ {
+ name: "create saml app, metadata not parsable",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(
+ eventFromEventPusher(
+ project.NewProjectAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "project", true, true, true,
+ domain.PrivateLabelingSettingUnspecified),
+ ),
+ ),
+ ),
+ idGenerator: id_mock.NewIDGeneratorExpectIDs(t),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ },
+ AppName: "app",
+ EntityID: "https://test.com/saml/metadata",
+ Metadata: []byte("test metadata"),
+ MetadataURL: "",
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ err: errors.IsErrorInvalidArgument,
+ },
+ },
+ {
+ name: "create saml app, ok",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(
+ eventFromEventPusher(
+ project.NewProjectAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "project", true, true, true,
+ domain.PrivateLabelingSettingUnspecified),
+ ),
+ ),
+ expectPush(
+ []*repository.Event{
+ eventFromEventPusher(
+ project.NewApplicationAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "app",
+ ),
+ ),
+ eventFromEventPusher(
+ project.NewSAMLConfigAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "https://test.com/saml/metadata",
+ testMetadata,
+ "",
+ ),
+ ),
+ },
+ uniqueConstraintsFromEventConstraint(project.NewAddApplicationUniqueConstraint("app", "project1")),
+ uniqueConstraintsFromEventConstraint(project.NewAddSAMLConfigEntityIDUniqueConstraint("https://test.com/saml/metadata")),
+ ),
+ ),
+ idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "app1"),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ },
+ AppName: "app",
+ EntityID: "https://test.com/saml/metadata",
+ Metadata: testMetadata,
+ MetadataURL: "",
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ want: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ ResourceOwner: "org1",
+ },
+ AppID: "app1",
+ AppName: "app",
+ EntityID: "https://test.com/saml/metadata",
+ Metadata: testMetadata,
+ MetadataURL: "",
+ State: domain.AppStateActive,
+ },
+ },
+ },
+ {
+ name: "create saml app metadataURL, ok",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(
+ eventFromEventPusher(
+ project.NewProjectAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "project", true, true, true,
+ domain.PrivateLabelingSettingUnspecified),
+ ),
+ ),
+ expectPush(
+ []*repository.Event{
+ eventFromEventPusher(
+ project.NewApplicationAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "app",
+ ),
+ ),
+ eventFromEventPusher(
+ project.NewSAMLConfigAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "https://test.com/saml/metadata",
+ testMetadata,
+ "http://localhost:8080/saml/metadata",
+ ),
+ ),
+ },
+ uniqueConstraintsFromEventConstraint(project.NewAddApplicationUniqueConstraint("app", "project1")),
+ uniqueConstraintsFromEventConstraint(project.NewAddSAMLConfigEntityIDUniqueConstraint("https://test.com/saml/metadata")),
+ ),
+ ),
+ idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "app1"),
+ httpClient: newTestClient(200, testMetadata),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ },
+ AppName: "app",
+ EntityID: "https://test.com/saml/metadata",
+ Metadata: nil,
+ MetadataURL: "http://localhost:8080/saml/metadata",
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ want: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ ResourceOwner: "org1",
+ },
+ AppID: "app1",
+ AppName: "app",
+ EntityID: "https://test.com/saml/metadata",
+ Metadata: testMetadata,
+ MetadataURL: "http://localhost:8080/saml/metadata",
+ State: domain.AppStateActive,
+ },
+ },
+ },
+ {
+ name: "create saml app metadataURL, http error",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(
+ eventFromEventPusher(
+ project.NewProjectAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "project", true, true, true,
+ domain.PrivateLabelingSettingUnspecified),
+ ),
+ ),
+ ),
+ idGenerator: id_mock.NewIDGeneratorExpectIDs(t),
+ httpClient: newTestClient(http.StatusNotFound, nil),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ },
+ AppName: "app",
+ EntityID: "https://test.com/saml/metadata",
+ Metadata: nil,
+ MetadataURL: "http://localhost:8080/saml/metadata",
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ err: errors.IsErrorInvalidArgument,
+ },
+ },
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ r := &Commands{
+ eventstore: tt.fields.eventstore,
+ idGenerator: tt.fields.idGenerator,
+ httpClient: tt.fields.httpClient,
+ }
+
+ got, err := r.AddSAMLApplication(tt.args.ctx, tt.args.samlApp, tt.args.resourceOwner)
+ if tt.res.err == nil {
+ assert.NoError(t, err)
+ }
+ if tt.res.err != nil && !tt.res.err(err) {
+ t.Errorf("got wrong err: %v ", err)
+ }
+ if tt.res.err == nil {
+ assert.Equal(t, tt.res.want, got)
+ }
+ })
+ }
+}
+
+func TestCommandSide_ChangeSAMLApplication(t *testing.T) {
+ type fields struct {
+ eventstore *eventstore.Eventstore
+ httpClient *http.Client
+ }
+ type args struct {
+ ctx context.Context
+ samlApp *domain.SAMLApp
+ resourceOwner string
+ }
+ type res struct {
+ want *domain.SAMLApp
+ err func(error) bool
+ }
+ tests := []struct {
+ name string
+ fields fields
+ args args
+ res res
+ }{
+ {
+ name: "invalid app, invalid argument error",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ ),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ },
+ AppID: "app1",
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ err: errors.IsErrorInvalidArgument,
+ },
+ },
+ {
+ name: "missing appid, invalid argument error",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ ),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ },
+ AppID: "",
+ Metadata: []byte("just not empty"),
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ err: errors.IsErrorInvalidArgument,
+ },
+ },
+ {
+ name: "missing aggregateid, invalid argument error",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ ),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "",
+ },
+ AppID: "appid",
+ Metadata: []byte("just not empty"),
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ err: errors.IsErrorInvalidArgument,
+ },
+ },
+ {
+ name: "app not existing, not found error",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(),
+ ),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ },
+ AppID: "app1",
+ Metadata: []byte("just not empty"),
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ err: errors.IsNotFound,
+ },
+ },
+ {
+ name: "no changes, precondition error, metadataURL",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(
+ eventFromEventPusher(
+ project.NewApplicationAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "app",
+ ),
+ ),
+ eventFromEventPusher(
+ project.NewSAMLConfigAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "https://test.com/saml/metadata",
+ testMetadata,
+ "http://localhost:8080/saml/metadata",
+ ),
+ ),
+ ),
+ ),
+ httpClient: newTestClient(http.StatusOK, testMetadata),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ ResourceOwner: "org1",
+ },
+ AppName: "app",
+ AppID: "app1",
+ EntityID: "https://test.com/saml/metadata",
+ Metadata: nil,
+ MetadataURL: "http://localhost:8080/saml/metadata",
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ err: errors.IsPreconditionFailed,
+ },
+ },
+ {
+ name: "no changes, precondition error, metadata",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(
+ eventFromEventPusher(
+ project.NewApplicationAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "app",
+ ),
+ ),
+ eventFromEventPusher(
+ project.NewSAMLConfigAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "https://test.com/saml/metadata",
+ testMetadata,
+ "",
+ ),
+ ),
+ ),
+ ),
+ httpClient: nil,
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ ResourceOwner: "org1",
+ },
+ AppName: "app",
+ AppID: "app1",
+ EntityID: "https://test.com/saml/metadata",
+ Metadata: testMetadata,
+ MetadataURL: "",
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ err: errors.IsPreconditionFailed,
+ },
+ },
+ {
+ name: "change saml app, ok, metadataURL",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(
+ eventFromEventPusher(
+ project.NewApplicationAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "app",
+ ),
+ ),
+ eventFromEventPusher(
+ project.NewSAMLConfigAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "https://test.com/saml/metadata",
+ testMetadata,
+ "http://localhost:8080/saml/metadata",
+ ),
+ ),
+ ),
+ expectPush(
+ []*repository.Event{
+ eventFromEventPusher(
+ newSAMLAppChangedEventMetadataURL(context.Background(),
+ "app1",
+ "project1",
+ "org1",
+ "https://test.com/saml/metadata",
+ "https://test2.com/saml/metadata",
+ testMetadataChangedEntityID,
+ ),
+ ),
+ },
+ uniqueConstraintsFromEventConstraint(project.NewRemoveSAMLConfigEntityIDUniqueConstraint("https://test.com/saml/metadata")),
+ uniqueConstraintsFromEventConstraint(project.NewAddSAMLConfigEntityIDUniqueConstraint("https://test2.com/saml/metadata")),
+ ),
+ ),
+ httpClient: newTestClient(http.StatusOK, testMetadataChangedEntityID),
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ ResourceOwner: "org1",
+ },
+ AppID: "app1",
+ AppName: "app",
+ EntityID: "https://test2.com/saml/metadata",
+ Metadata: nil,
+ MetadataURL: "http://localhost:8080/saml/metadata",
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ want: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ ResourceOwner: "org1",
+ },
+ AppID: "app1",
+ AppName: "app",
+ EntityID: "https://test2.com/saml/metadata",
+ Metadata: testMetadataChangedEntityID,
+ MetadataURL: "http://localhost:8080/saml/metadata",
+ State: domain.AppStateActive,
+ },
+ },
+ },
+ {
+ name: "change saml app, ok, metadata",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(
+ eventFromEventPusher(
+ project.NewApplicationAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "app",
+ ),
+ ),
+ eventFromEventPusher(
+ project.NewSAMLConfigAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "https://test.com/saml/metadata",
+ testMetadata,
+ "",
+ ),
+ ),
+ ),
+ expectPush(
+ []*repository.Event{
+ eventFromEventPusher(
+ newSAMLAppChangedEventMetadata(context.Background(),
+ "app1",
+ "project1",
+ "org1",
+ "https://test.com/saml/metadata",
+ "https://test2.com/saml/metadata",
+ testMetadataChangedEntityID,
+ ),
+ ),
+ },
+ uniqueConstraintsFromEventConstraint(project.NewRemoveSAMLConfigEntityIDUniqueConstraint("https://test.com/saml/metadata")),
+ uniqueConstraintsFromEventConstraint(project.NewAddSAMLConfigEntityIDUniqueConstraint("https://test2.com/saml/metadata")),
+ ),
+ ),
+ httpClient: nil,
+ },
+ args: args{
+ ctx: context.Background(),
+ samlApp: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ ResourceOwner: "org1",
+ },
+ AppID: "app1",
+ AppName: "app",
+ EntityID: "https://test2.com/saml/metadata",
+ Metadata: testMetadataChangedEntityID,
+ MetadataURL: "",
+ },
+ resourceOwner: "org1",
+ },
+ res: res{
+ want: &domain.SAMLApp{
+ ObjectRoot: models.ObjectRoot{
+ AggregateID: "project1",
+ ResourceOwner: "org1",
+ },
+ AppID: "app1",
+ AppName: "app",
+ EntityID: "https://test2.com/saml/metadata",
+ Metadata: testMetadataChangedEntityID,
+ MetadataURL: "",
+ State: domain.AppStateActive,
+ },
+ },
+ },
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ r := &Commands{
+ eventstore: tt.fields.eventstore,
+ httpClient: tt.fields.httpClient,
+ }
+ got, err := r.ChangeSAMLApplication(tt.args.ctx, tt.args.samlApp, tt.args.resourceOwner)
+ if tt.res.err == nil {
+ assert.NoError(t, err)
+ }
+ if tt.res.err != nil && !tt.res.err(err) {
+ t.Errorf("got wrong err: %v ", err)
+ }
+ if tt.res.err == nil {
+ assert.Equal(t, tt.res.want, got)
+ }
+ })
+ }
+}
+
+func newSAMLAppChangedEventMetadata(ctx context.Context, appID, projectID, resourceOwner, oldEntityID, entityID string, metadata []byte) *project.SAMLConfigChangedEvent {
+ changes := []project.SAMLConfigChanges{
+ project.ChangeEntityID(entityID),
+ project.ChangeMetadata(metadata),
+ }
+ event, _ := project.NewSAMLConfigChangedEvent(ctx,
+ &project.NewAggregate(projectID, resourceOwner).Aggregate,
+ appID,
+ oldEntityID,
+ changes,
+ )
+ return event
+}
+
+func newSAMLAppChangedEventMetadataURL(ctx context.Context, appID, projectID, resourceOwner, oldEntityID, entityID string, metadata []byte) *project.SAMLConfigChangedEvent {
+ changes := []project.SAMLConfigChanges{
+ project.ChangeEntityID(entityID),
+ project.ChangeMetadata(metadata),
+ }
+ event, _ := project.NewSAMLConfigChangedEvent(ctx,
+ &project.NewAggregate(projectID, resourceOwner).Aggregate,
+ appID,
+ oldEntityID,
+ changes,
+ )
+ return event
+}
+
+type roundTripperFunc func(*http.Request) *http.Response
+
+// RoundTrip implements the http.RoundTripper interface.
+func (fn roundTripperFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+ return fn(req), nil
+}
+
+// NewTestClient returns *http.Client with Transport replaced to avoid making real calls
+func newTestClient(httpStatus int, metadata []byte) *http.Client {
+ fn := roundTripperFunc(func(req *http.Request) *http.Response {
+ return &http.Response{
+ StatusCode: httpStatus,
+ Body: ioutil.NopCloser(bytes.NewBuffer(metadata)),
+ Header: make(http.Header), //must be non-nil value
+ }
+ })
+ return &http.Client{
+ Transport: fn,
+ }
+}
diff --git a/internal/command/project_application_test.go b/internal/command/project_application_test.go
index 33b94f3d6c..1079006088 100644
--- a/internal/command/project_application_test.go
+++ b/internal/command/project_application_test.go
@@ -5,6 +5,7 @@ import (
"testing"
"github.com/stretchr/testify/assert"
+
"github.com/zitadel/zitadel/internal/domain"
caos_errs "github.com/zitadel/zitadel/internal/errors"
"github.com/zitadel/zitadel/internal/eventstore"
@@ -580,6 +581,58 @@ func TestCommandSide_RemoveApplication(t *testing.T) {
err: caos_errs.IsNotFound,
},
},
+ {
+ name: "app remove, entityID, ok",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(
+ eventFromEventPusher(project.NewApplicationAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "app",
+ )),
+ ),
+ expectFilter(
+ eventFromEventPusher(project.NewApplicationAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "app",
+ )),
+ eventFromEventPusher(project.NewSAMLConfigAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "https://test.com/saml/metadata",
+ []byte("\n\n \n urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n \n \n \n"),
+ "",
+ )),
+ ),
+ expectPush(
+ []*repository.Event{
+ eventFromEventPusher(project.NewApplicationRemovedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "app",
+ "https://test.com/saml/metadata",
+ )),
+ }, /**/
+ uniqueConstraintsFromEventConstraint(project.NewRemoveApplicationUniqueConstraint("app", "project1")),
+ uniqueConstraintsFromEventConstraint(project.NewRemoveSAMLConfigEntityIDUniqueConstraint("https://test.com/saml/metadata")),
+ ),
+ ),
+ },
+ args: args{
+ ctx: context.Background(),
+ projectID: "project1",
+ appID: "app1",
+ resourceOwner: "org1",
+ },
+ res: res{
+ want: &domain.ObjectDetails{
+ ResourceOwner: "org1",
+ },
+ },
+ },
{
name: "app remove, ok",
fields: fields{
@@ -592,12 +645,15 @@ func TestCommandSide_RemoveApplication(t *testing.T) {
"app",
)),
),
+ // app is not saml, or no saml config available
+ expectFilter(),
expectPush(
[]*repository.Event{
eventFromEventPusher(project.NewApplicationRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"app1",
"app",
+ "",
)),
},
uniqueConstraintsFromEventConstraint(project.NewRemoveApplicationUniqueConstraint("app", "project1")),
diff --git a/internal/command/project_converter.go b/internal/command/project_converter.go
index a31b483471..b3dc652709 100644
--- a/internal/command/project_converter.go
+++ b/internal/command/project_converter.go
@@ -57,6 +57,18 @@ func oidcWriteModelToOIDCConfig(writeModel *OIDCApplicationWriteModel) *domain.O
}
}
+func samlWriteModelToSAMLConfig(writeModel *SAMLApplicationWriteModel) *domain.SAMLApp {
+ return &domain.SAMLApp{
+ ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),
+ AppID: writeModel.AppID,
+ AppName: writeModel.AppName,
+ State: writeModel.State,
+ Metadata: writeModel.Metadata,
+ MetadataURL: writeModel.MetadataURL,
+ EntityID: writeModel.EntityID,
+ }
+}
+
func apiWriteModelToAPIConfig(writeModel *APIApplicationWriteModel) *domain.APIApp {
return &domain.APIApp{
ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),
diff --git a/internal/command/project_role_test.go b/internal/command/project_role_test.go
index 2e867f8017..e7b752fec6 100644
--- a/internal/command/project_role_test.go
+++ b/internal/command/project_role_test.go
@@ -5,6 +5,7 @@ import (
"testing"
"github.com/stretchr/testify/assert"
+
"github.com/zitadel/zitadel/internal/domain"
caos_errs "github.com/zitadel/zitadel/internal/errors"
"github.com/zitadel/zitadel/internal/eventstore"
@@ -50,6 +51,7 @@ func TestCommandSide_AddProjectRole(t *testing.T) {
project.NewProjectRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1",
+ nil,
),
),
),
@@ -253,6 +255,7 @@ func TestCommandSide_BulkAddProjectRole(t *testing.T) {
project.NewProjectRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1",
+ nil,
),
),
),
@@ -503,6 +506,7 @@ func TestCommandSide_ChangeProjectRole(t *testing.T) {
project.NewProjectRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1",
+ nil,
),
),
),
diff --git a/internal/command/project_test.go b/internal/command/project_test.go
index 94f540f91d..4dfe3054c7 100644
--- a/internal/command/project_test.go
+++ b/internal/command/project_test.go
@@ -269,7 +269,8 @@ func TestCommandSide_ChangeProject(t *testing.T) {
eventFromEventPusher(
project.NewProjectRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
- "project"),
+ "project",
+ nil),
),
),
),
@@ -542,7 +543,8 @@ func TestCommandSide_DeactivateProject(t *testing.T) {
eventFromEventPusher(
project.NewProjectRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
- "project"),
+ "project",
+ nil),
),
),
),
@@ -721,7 +723,8 @@ func TestCommandSide_ReactivateProject(t *testing.T) {
eventFromEventPusher(
project.NewProjectRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
- "project"),
+ "project",
+ nil),
),
),
),
@@ -900,7 +903,8 @@ func TestCommandSide_RemoveProject(t *testing.T) {
eventFromEventPusher(
project.NewProjectRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
- "project"),
+ "project",
+ nil),
),
),
),
@@ -915,7 +919,7 @@ func TestCommandSide_RemoveProject(t *testing.T) {
},
},
{
- name: "project remove, ok",
+ name: "project remove, without entityConstraints, ok",
fields: fields{
eventstore: eventstoreExpect(
t,
@@ -927,12 +931,15 @@ func TestCommandSide_RemoveProject(t *testing.T) {
domain.PrivateLabelingSettingAllowLoginUserResourceOwnerPolicy),
),
),
+ // no saml application events
+ expectFilter(),
expectPush(
[]*repository.Event{
eventFromEventPusher(
project.NewProjectRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
- "project"),
+ "project",
+ nil),
),
},
uniqueConstraintsFromEventConstraint(project.NewRemoveProjectNameUniqueConstraint("project", "org1")),
@@ -950,6 +957,150 @@ func TestCommandSide_RemoveProject(t *testing.T) {
},
},
},
+ {
+ name: "project remove, with entityConstraints, ok",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(
+ eventFromEventPusher(
+ project.NewProjectAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "project", true, true, true,
+ domain.PrivateLabelingSettingAllowLoginUserResourceOwnerPolicy),
+ ),
+ ),
+ expectFilter(
+ eventFromEventPusher(project.NewApplicationAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "app",
+ )),
+ eventFromEventPusher(
+ project.NewSAMLConfigAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "https://test.com/saml/metadata",
+ []byte("\n\n \n urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n \n \n \n"),
+ "http://localhost:8080/saml/metadata",
+ ),
+ ),
+ ),
+ expectPush(
+ []*repository.Event{
+ eventFromEventPusher(
+ project.NewProjectRemovedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "project",
+ []*eventstore.EventUniqueConstraint{
+ project.NewRemoveSAMLConfigEntityIDUniqueConstraint("https://test.com/saml/metadata"),
+ }),
+ ),
+ },
+ uniqueConstraintsFromEventConstraint(project.NewRemoveProjectNameUniqueConstraint("project", "org1")),
+ uniqueConstraintsFromEventConstraint(project.NewRemoveSAMLConfigEntityIDUniqueConstraint("https://test.com/saml/metadata")),
+ ),
+ ),
+ },
+ args: args{
+ ctx: context.Background(),
+ projectID: "project1",
+ resourceOwner: "org1",
+ },
+ res: res{
+ want: &domain.ObjectDetails{
+ ResourceOwner: "org1",
+ },
+ },
+ },
+ {
+ name: "project remove, with multiple entityConstraints, ok",
+ fields: fields{
+ eventstore: eventstoreExpect(
+ t,
+ expectFilter(
+ eventFromEventPusher(
+ project.NewProjectAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "project", true, true, true,
+ domain.PrivateLabelingSettingAllowLoginUserResourceOwnerPolicy),
+ ),
+ ),
+ expectFilter(
+ eventFromEventPusher(project.NewApplicationAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "app",
+ )),
+ eventFromEventPusher(
+ project.NewSAMLConfigAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app1",
+ "https://test1.com/saml/metadata",
+ []byte("\n\n \n urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n \n \n \n"),
+ "",
+ ),
+ ),
+ eventFromEventPusher(project.NewApplicationAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app2",
+ "app",
+ )),
+ eventFromEventPusher(
+ project.NewSAMLConfigAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app2",
+ "https://test2.com/saml/metadata",
+ []byte("\n\n \n urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n \n \n \n"),
+ "",
+ ),
+ ),
+ eventFromEventPusher(project.NewApplicationAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app3",
+ "app",
+ )),
+ eventFromEventPusher(
+ project.NewSAMLConfigAddedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "app3",
+ "https://test3.com/saml/metadata",
+ []byte("\n\n \n urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n \n \n \n"),
+ "",
+ ),
+ ),
+ ),
+ expectPush(
+ []*repository.Event{
+ eventFromEventPusher(
+ project.NewProjectRemovedEvent(context.Background(),
+ &project.NewAggregate("project1", "org1").Aggregate,
+ "project",
+ []*eventstore.EventUniqueConstraint{
+ project.NewRemoveSAMLConfigEntityIDUniqueConstraint("https://test1.com/saml/metadata"),
+ project.NewRemoveSAMLConfigEntityIDUniqueConstraint("https://test2.com/saml/metadata"),
+ project.NewRemoveSAMLConfigEntityIDUniqueConstraint("https://test3.com/saml/metadata"),
+ }),
+ ),
+ },
+ uniqueConstraintsFromEventConstraint(project.NewRemoveProjectNameUniqueConstraint("project", "org1")),
+ uniqueConstraintsFromEventConstraint(project.NewRemoveSAMLConfigEntityIDUniqueConstraint("https://test1.com/saml/metadata")),
+ uniqueConstraintsFromEventConstraint(project.NewRemoveSAMLConfigEntityIDUniqueConstraint("https://test2.com/saml/metadata")),
+ uniqueConstraintsFromEventConstraint(project.NewRemoveSAMLConfigEntityIDUniqueConstraint("https://test3.com/saml/metadata")),
+ ),
+ ),
+ },
+ args: args{
+ ctx: context.Background(),
+ projectID: "project1",
+ resourceOwner: "org1",
+ },
+ res: res{
+ want: &domain.ObjectDetails{
+ ResourceOwner: "org1",
+ },
+ },
+ },
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
diff --git a/internal/command/unique_constraints_model.go b/internal/command/unique_constraints_model.go
index f22a98046d..41cab4ca04 100644
--- a/internal/command/unique_constraints_model.go
+++ b/internal/command/unique_constraints_model.go
@@ -4,6 +4,7 @@ import (
"context"
"github.com/zitadel/logging"
+
"github.com/zitadel/zitadel/internal/domain"
"github.com/zitadel/zitadel/internal/eventstore"
"github.com/zitadel/zitadel/internal/repository/idpconfig"
@@ -92,6 +93,10 @@ func (rm *UniqueConstraintReadModel) Reduce() error {
rm.addUniqueConstraint(e.Aggregate().ID, e.AppID, project.NewAddApplicationUniqueConstraint(e.Name, e.Aggregate().ID))
case *project.ApplicationChangedEvent:
rm.changeUniqueConstraint(e.Aggregate().ID, e.AppID, project.NewAddApplicationUniqueConstraint(e.Name, e.Aggregate().ID))
+ case *project.SAMLConfigAddedEvent:
+ rm.addUniqueConstraint(e.Aggregate().ID, e.AppID, project.NewAddSAMLConfigEntityIDUniqueConstraint(e.EntityID))
+ case *project.SAMLConfigChangedEvent:
+ rm.addUniqueConstraint(e.Aggregate().ID, e.AppID, project.NewRemoveSAMLConfigEntityIDUniqueConstraint(e.EntityID))
case *project.ApplicationRemovedEvent:
rm.removeUniqueConstraint(e.Aggregate().ID, e.AppID, project.UniqueAppNameType)
case *project.GrantAddedEvent:
diff --git a/internal/command/user_grant_test.go b/internal/command/user_grant_test.go
index e11d423657..3a5259820e 100644
--- a/internal/command/user_grant_test.go
+++ b/internal/command/user_grant_test.go
@@ -133,6 +133,7 @@ func TestCommandSide_AddUserGrant(t *testing.T) {
project.NewProjectRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1",
+ nil,
),
),
),
@@ -819,6 +820,7 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
project.NewProjectRemovedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectname1",
+ nil,
),
),
),
diff --git a/internal/config/systemdefaults/system_defaults.go b/internal/config/systemdefaults/system_defaults.go
index 2606f20c57..7ca33b04b5 100644
--- a/internal/config/systemdefaults/system_defaults.go
+++ b/internal/config/systemdefaults/system_defaults.go
@@ -37,7 +37,9 @@ type Notifications struct {
}
type KeyConfig struct {
- Size int
- PrivateKeyLifetime time.Duration
- PublicKeyLifetime time.Duration
+ Size int
+ PrivateKeyLifetime time.Duration
+ PublicKeyLifetime time.Duration
+ CertificateSize int
+ CertificateLifetime time.Duration
}
diff --git a/internal/crypto/rsa.go b/internal/crypto/rsa.go
index 86b968a8f5..38d8e6a1bd 100644
--- a/internal/crypto/rsa.go
+++ b/internal/crypto/rsa.go
@@ -1,11 +1,16 @@
package crypto
import (
+ "bytes"
"crypto/rand"
"crypto/rsa"
"crypto/x509"
+ "crypto/x509/pkix"
"encoding/pem"
"errors"
+ "fmt"
+ "math/big"
+ "time"
)
func GenerateKeyPair(bits int) (*rsa.PrivateKey, *rsa.PublicKey, error) {
@@ -24,6 +29,104 @@ func GenerateEncryptedKeyPair(bits int, alg EncryptionAlgorithm) (*CryptoValue,
return EncryptKeys(privateKey, publicKey, alg)
}
+type CertificateInformations struct {
+ SerialNumber *big.Int
+ Organisation []string
+ CommonName string
+ NotBefore time.Time
+ NotAfter time.Time
+ KeyUsage x509.KeyUsage
+ ExtKeyUsage []x509.ExtKeyUsage
+}
+
+func GenerateEncryptedKeyPairWithCACertificate(bits int, keyAlg, certAlg EncryptionAlgorithm, informations *CertificateInformations) (*CryptoValue, *CryptoValue, *CryptoValue, error) {
+ privateKey, publicKey, cert, err := GenerateCACertificate(bits, informations)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ encryptPriv, encryptPub, encryptCaCert, err := EncryptKeysAndCert(privateKey, publicKey, cert, keyAlg, certAlg)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ return encryptPriv, encryptPub, encryptCaCert, nil
+}
+
+func GenerateEncryptedKeyPairWithCertificate(bits int, keyAlg, certAlg EncryptionAlgorithm, caPrivateKey *rsa.PrivateKey, caCertificate []byte, informations *CertificateInformations) (*CryptoValue, *CryptoValue, *CryptoValue, error) {
+ privateKey, publicKey, cert, err := GenerateCertificate(bits, caPrivateKey, caCertificate, informations)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ encryptPriv, encryptPub, encryptCaCert, err := EncryptKeysAndCert(privateKey, publicKey, cert, keyAlg, certAlg)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ return encryptPriv, encryptPub, encryptCaCert, nil
+}
+
+func GenerateCACertificate(bits int, informations *CertificateInformations) (*rsa.PrivateKey, *rsa.PublicKey, []byte, error) {
+ return generateCertificate(bits, nil, nil, informations)
+}
+
+func GenerateCertificate(bits int, caPrivateKey *rsa.PrivateKey, ca []byte, informations *CertificateInformations) (*rsa.PrivateKey, *rsa.PublicKey, []byte, error) {
+ return generateCertificate(bits, caPrivateKey, ca, informations)
+}
+
+func generateCertificate(bits int, caPrivateKey *rsa.PrivateKey, ca []byte, informations *CertificateInformations) (*rsa.PrivateKey, *rsa.PublicKey, []byte, error) {
+ notBefore := time.Now()
+ if !informations.NotBefore.IsZero() {
+ notBefore = informations.NotBefore
+ }
+ cert := &x509.Certificate{
+ SerialNumber: informations.SerialNumber,
+ Subject: pkix.Name{
+ CommonName: informations.CommonName,
+ Organization: informations.Organisation,
+ },
+ NotBefore: notBefore,
+ NotAfter: informations.NotAfter,
+ KeyUsage: informations.KeyUsage,
+ ExtKeyUsage: informations.ExtKeyUsage,
+ }
+
+ certPrivKey, err := rsa.GenerateKey(rand.Reader, bits)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+
+ certBytes := make([]byte, 0)
+ if ca == nil {
+ cert.IsCA = true
+ cert.BasicConstraintsValid = true
+
+ certBytes, err = x509.CreateCertificate(rand.Reader, cert, cert, &certPrivKey.PublicKey, certPrivKey)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ } else {
+ caCert, err := x509.ParseCertificate(ca)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+
+ certBytes, err = x509.CreateCertificate(rand.Reader, cert, caCert, &certPrivKey.PublicKey, caPrivateKey)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ }
+
+ x509Cert, err := x509.ParseCertificate(certBytes)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+
+ certPem, err := CertificateToBytes(x509Cert)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+
+ return certPrivKey, &certPrivKey.PublicKey, certPem, nil
+}
+
func PrivateKeyToBytes(priv *rsa.PrivateKey) []byte {
return pem.EncodeToMemory(
&pem.Block{
@@ -101,3 +204,34 @@ func EncryptKeys(privateKey *rsa.PrivateKey, publicKey *rsa.PublicKey, alg Encry
}
return encryptedPrivateKey, encryptedPublicKey, nil
}
+
+func CertificateToBytes(cert *x509.Certificate) ([]byte, error) {
+ certPem := new(bytes.Buffer)
+ if err := pem.Encode(certPem, &pem.Block{
+ Type: "CERTIFICATE",
+ Bytes: cert.Raw,
+ }); err != nil {
+ return nil, err
+ }
+ return certPem.Bytes(), nil
+}
+
+func BytesToCertificate(data []byte) ([]byte, error) {
+ block, _ := pem.Decode(data)
+ if block == nil || block.Type != "CERTIFICATE" {
+ return nil, fmt.Errorf("failed to decode PEM block containing public key")
+ }
+ return block.Bytes, nil
+}
+
+func EncryptKeysAndCert(privateKey *rsa.PrivateKey, publicKey *rsa.PublicKey, cert []byte, keyAlg, certAlg EncryptionAlgorithm) (*CryptoValue, *CryptoValue, *CryptoValue, error) {
+ encryptedPrivateKey, encryptedPublicKey, err := EncryptKeys(privateKey, publicKey, keyAlg)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ encryptedCertificate, err := Encrypt(cert, certAlg)
+ if err != nil {
+ return nil, nil, nil, err
+ }
+ return encryptedPrivateKey, encryptedPublicKey, encryptedCertificate, nil
+}
diff --git a/internal/domain/application_saml.go b/internal/domain/application_saml.go
new file mode 100644
index 0000000000..b00366df7e
--- /dev/null
+++ b/internal/domain/application_saml.go
@@ -0,0 +1,40 @@
+package domain
+
+import (
+ "github.com/zitadel/zitadel/internal/eventstore/v1/models"
+)
+
+type SAMLApp struct {
+ models.ObjectRoot
+
+ AppID string
+ AppName string
+ EntityID string
+ Metadata []byte
+ MetadataURL string
+
+ State AppState
+}
+
+func (a *SAMLApp) GetApplicationName() string {
+ return a.AppName
+}
+
+func (a *SAMLApp) GetState() AppState {
+ return a.State
+}
+
+func (a *SAMLApp) GetMetadata() []byte {
+ return a.Metadata
+}
+
+func (a *SAMLApp) GetMetadataURL() string {
+ return a.MetadataURL
+}
+
+func (a *SAMLApp) IsValid() bool {
+ if a.MetadataURL == "" && a.Metadata == nil {
+ return false
+ }
+ return true
+}
diff --git a/internal/domain/auth_request.go b/internal/domain/auth_request.go
index 518af1da7f..d3e5778430 100644
--- a/internal/domain/auth_request.go
+++ b/internal/domain/auth_request.go
@@ -119,6 +119,8 @@ func NewAuthRequestFromType(requestType AuthRequestType) (*AuthRequest, error) {
switch requestType {
case AuthRequestTypeOIDC:
return &AuthRequest{Request: &AuthRequestOIDC{}}, nil
+ case AuthRequestTypeSAML:
+ return &AuthRequest{Request: &AuthRequestSAML{}}, nil
}
return nil, errors.ThrowInvalidArgument(nil, "DOMAIN-ds2kl", "invalid request type")
}
diff --git a/internal/domain/key_pair.go b/internal/domain/key_pair.go
index ee1839bce8..ff0ec773f7 100644
--- a/internal/domain/key_pair.go
+++ b/internal/domain/key_pair.go
@@ -10,22 +10,32 @@ import (
type KeyPair struct {
es_models.ObjectRoot
- Usage KeyUsage
- Algorithm string
- PrivateKey *Key
- PublicKey *Key
+ Usage KeyUsage
+ Algorithm string
+ PrivateKey *Key
+ PublicKey *Key
+ Certificate *Key
}
type KeyUsage int32
const (
KeyUsageSigning KeyUsage = iota
+ KeyUsageSAMLMetadataSigning
+ KeyUsageSAMLResponseSinging
+ KeyUsageSAMLCA
)
func (u KeyUsage) String() string {
switch u {
case KeyUsageSigning:
return "sig"
+ case KeyUsageSAMLCA:
+ return "saml_ca"
+ case KeyUsageSAMLResponseSinging:
+ return "saml_response_sig"
+ case KeyUsageSAMLMetadataSigning:
+ return "saml_metadata_sig"
}
return ""
}
@@ -38,7 +48,8 @@ type Key struct {
func (k *KeyPair) IsValid() bool {
return k.Algorithm != "" &&
k.PrivateKey != nil && k.PrivateKey.IsValid() &&
- k.PublicKey != nil && k.PublicKey.IsValid()
+ k.PublicKey != nil && k.PublicKey.IsValid() &&
+ k.Certificate != nil && k.Certificate.IsValid()
}
func (k *Key) IsValid() bool {
diff --git a/internal/domain/request.go b/internal/domain/request.go
index 6c405cc513..69bace2573 100644
--- a/internal/domain/request.go
+++ b/internal/domain/request.go
@@ -39,6 +39,13 @@ func (a *AuthRequestOIDC) IsValid() bool {
}
type AuthRequestSAML struct {
+ ID string
+ RequestID string
+ BindingType string
+ Code string
+ Issuer string
+ IssuerName string
+ Destination string
}
func (a *AuthRequestSAML) Type() AuthRequestType {
diff --git a/internal/project/model/application.go b/internal/project/model/application.go
index 2925b0dc4a..f38263eb72 100644
--- a/internal/project/model/application.go
+++ b/internal/project/model/application.go
@@ -13,6 +13,7 @@ type Application struct {
Type AppType
OIDCConfig *OIDCConfig
APIConfig *APIConfig
+ SAMLConfig *SAMLConfig
}
type AppState int32
@@ -45,5 +46,8 @@ func (a *Application) IsValid(includeConfig bool) bool {
if a.Type == AppTypeAPI && !a.APIConfig.IsValid() {
return false
}
+ if a.Type == AppTypeSAML && !a.SAMLConfig.IsValid() {
+ return false
+ }
return true
}
diff --git a/internal/project/model/saml_config.go b/internal/project/model/saml_config.go
new file mode 100644
index 0000000000..2d0ca84697
--- /dev/null
+++ b/internal/project/model/saml_config.go
@@ -0,0 +1,16 @@
+package model
+
+import (
+ es_models "github.com/zitadel/zitadel/internal/eventstore/v1/models"
+)
+
+type SAMLConfig struct {
+ es_models.ObjectRoot
+ AppID string
+ Metadata []byte
+ MetadataURL string
+}
+
+func (c *SAMLConfig) IsValid() bool {
+ return !(c.Metadata == nil && c.MetadataURL == "")
+}
diff --git a/internal/project/repository/eventsourcing/model/application.go b/internal/project/repository/eventsourcing/model/application.go
index 392ac34dee..97990097aa 100644
--- a/internal/project/repository/eventsourcing/model/application.go
+++ b/internal/project/repository/eventsourcing/model/application.go
@@ -16,6 +16,7 @@ type Application struct {
Type int32 `json:"appType,omitempty"`
OIDCConfig *OIDCConfig `json:"-"`
APIConfig *APIConfig `json:"-"`
+ SAMLConfig *SAMLConfig `json:"-"`
}
type ApplicationID struct {
diff --git a/internal/project/repository/eventsourcing/model/saml_config.go b/internal/project/repository/eventsourcing/model/saml_config.go
new file mode 100644
index 0000000000..e8865f129d
--- /dev/null
+++ b/internal/project/repository/eventsourcing/model/saml_config.go
@@ -0,0 +1,25 @@
+package model
+
+import (
+ "encoding/json"
+
+ "github.com/zitadel/logging"
+
+ es_models "github.com/zitadel/zitadel/internal/eventstore/v1/models"
+)
+
+type SAMLConfig struct {
+ es_models.ObjectRoot
+ AppID string `json:"appId"`
+ Metadata []byte `json:"metadata,omitempty"`
+ MetadataURL string `json:"metadataUrl,omitempty"`
+}
+
+func (o *SAMLConfig) setData(event *es_models.Event) error {
+ o.ObjectRoot.AppendEvent(event)
+ if err := json.Unmarshal(event.Data, o); err != nil {
+ logging.Log("EVEN-d8e3s").WithError(err).Error("could not unmarshal event data")
+ return err
+ }
+ return nil
+}
diff --git a/internal/project/repository/view/model/application.go b/internal/project/repository/view/model/application.go
index 49933f8841..f7cfd3b289 100644
--- a/internal/project/repository/view/model/application.go
+++ b/internal/project/repository/view/model/application.go
@@ -57,6 +57,10 @@ type ApplicationView struct {
IDTokenUserinfoAssertion bool `json:"idTokenUserinfoAssertion" gorm:"column:id_token_userinfo_assertion"`
ClockSkew time.Duration `json:"clockSkew" gorm:"column:clock_skew"`
+ IsSAML bool `json:"-" gorm:"column:is_saml"`
+ Metadata []byte `json:"metadata" gorm:"column:metadata"`
+ MetadataURL string `json:"metadata_url" gorm:"column:metadata_url"`
+
Sequence uint64 `json:"-" gorm:"sequence"`
}
@@ -90,7 +94,9 @@ func (a *ApplicationView) AppendEventIfMyApp(event *models.Event) (err error) {
project.APIConfigAddedType,
project.APIConfigChangedType,
project.ApplicationDeactivatedType,
- project.ApplicationReactivatedType:
+ project.ApplicationReactivatedType,
+ project.SAMLConfigAddedType,
+ project.SAMLConfigChangedType:
err = view.SetData(event)
if err != nil {
return err
@@ -130,6 +136,9 @@ func (a *ApplicationView) AppendEvent(event *models.Event) (err error) {
}
a.setCompliance()
return a.setOriginAllowList()
+ case project.SAMLConfigAddedType:
+ a.IsSAML = true
+ return a.SetData(event)
case project.APIConfigAddedType:
a.IsOIDC = false
return a.SetData(event)
@@ -142,6 +151,8 @@ func (a *ApplicationView) AppendEvent(event *models.Event) (err error) {
}
a.setCompliance()
return a.setOriginAllowList()
+ case project.SAMLConfigChangedType:
+ return a.SetData(event)
case project.APIConfigChangedType:
return a.SetData(event)
case project.ProjectChangedType:
diff --git a/internal/query/app.go b/internal/query/app.go
index 6a405c8447..d09d7fd4f6 100644
--- a/internal/query/app.go
+++ b/internal/query/app.go
@@ -33,6 +33,7 @@ type App struct {
Name string
OIDCConfig *OIDCApp
+ SAMLConfig *SAMLApp
APIConfig *APIApp
}
@@ -56,6 +57,12 @@ type OIDCApp struct {
AllowedOrigins database.StringArray
}
+type SAMLApp struct {
+ Metadata []byte
+ MetadataURL string
+ EntityID string
+}
+
type APIApp struct {
ClientID string
AuthMethodType domain.APIAuthMethodType
@@ -116,6 +123,28 @@ var (
}
)
+var (
+ appSAMLConfigsTable = table{
+ name: projection.AppSAMLTable,
+ }
+ AppSAMLConfigColumnAppID = Column{
+ name: projection.AppSAMLConfigColumnAppID,
+ table: appSAMLConfigsTable,
+ }
+ AppSAMLConfigColumnEntityID = Column{
+ name: projection.AppSAMLConfigColumnEntityID,
+ table: appSAMLConfigsTable,
+ }
+ AppSAMLConfigColumnMetadata = Column{
+ name: projection.AppSAMLConfigColumnMetadata,
+ table: appSAMLConfigsTable,
+ }
+ AppSAMLConfigColumnMetadataURL = Column{
+ name: projection.AppSAMLConfigColumnMetadataURL,
+ table: appSAMLConfigsTable,
+ }
+)
+
var (
appAPIConfigsTable = table{
name: projection.AppAPITable,
@@ -225,6 +254,54 @@ func (q *Queries) AppByProjectAndAppID(ctx context.Context, shouldTriggerBulk bo
return scan(row)
}
+func (q *Queries) AppByID(ctx context.Context, appID string) (*App, error) {
+ stmt, scan := prepareAppQuery()
+ query, args, err := stmt.Where(
+ sq.Eq{
+ AppColumnID.identifier(): appID,
+ AppColumnInstanceID.identifier(): authz.GetInstance(ctx).InstanceID(),
+ },
+ ).ToSql()
+ if err != nil {
+ return nil, errors.ThrowInternal(err, "QUERY-immt9", "Errors.Query.SQLStatement")
+ }
+
+ row := q.client.QueryRowContext(ctx, query, args...)
+ return scan(row)
+}
+
+func (q *Queries) AppBySAMLEntityID(ctx context.Context, entityID string) (*App, error) {
+ stmt, scan := prepareAppQuery()
+ query, args, err := stmt.Where(
+ sq.Eq{
+ AppSAMLConfigColumnEntityID.identifier(): entityID,
+ },
+ ).ToSql()
+ if err != nil {
+ return nil, errors.ThrowInternal(err, "QUERY-JgUop", "Errors.Query.SQLStatement")
+ }
+
+ row := q.client.QueryRowContext(ctx, query, args...)
+ return scan(row)
+}
+
+func (q *Queries) ProjectByClientID(ctx context.Context, appID string) (*Project, error) {
+ stmt, scan := prepareProjectByAppQuery()
+ query, args, err := stmt.Where(
+ sq.Or{
+ sq.Eq{AppOIDCConfigColumnClientID.identifier(): appID},
+ sq.Eq{AppAPIConfigColumnClientID.identifier(): appID},
+ sq.Eq{AppSAMLConfigColumnAppID.identifier(): appID},
+ },
+ ).ToSql()
+ if err != nil {
+ return nil, errors.ThrowInternal(err, "QUERY-XhJi3", "Errors.Query.SQLStatement")
+ }
+
+ row := q.client.QueryRowContext(ctx, query, args...)
+ return scan(row)
+}
+
func (q *Queries) ProjectIDFromOIDCClientID(ctx context.Context, appID string) (string, error) {
stmt, scan := prepareProjectIDByAppQuery()
query, args, err := stmt.Where(
@@ -249,6 +326,7 @@ func (q *Queries) ProjectIDFromClientID(ctx context.Context, appID string) (stri
sq.Or{
sq.Eq{AppOIDCConfigColumnClientID.identifier(): appID},
sq.Eq{AppAPIConfigColumnClientID.identifier(): appID},
+ sq.Eq{AppSAMLConfigColumnAppID.identifier(): appID},
},
},
).ToSql()
@@ -389,15 +467,22 @@ func prepareAppQuery() (sq.SelectBuilder, func(*sql.Row) (*App, error)) {
AppOIDCConfigColumnIDTokenUserinfoAssertion.identifier(),
AppOIDCConfigColumnClockSkew.identifier(),
AppOIDCConfigColumnAdditionalOrigins.identifier(),
+
+ AppSAMLConfigColumnAppID.identifier(),
+ AppSAMLConfigColumnEntityID.identifier(),
+ AppSAMLConfigColumnMetadata.identifier(),
+ AppSAMLConfigColumnMetadataURL.identifier(),
).From(appsTable.identifier()).
LeftJoin(join(AppAPIConfigColumnAppID, AppColumnID)).
LeftJoin(join(AppOIDCConfigColumnAppID, AppColumnID)).
+ LeftJoin(join(AppSAMLConfigColumnAppID, AppColumnID)).
PlaceholderFormat(sq.Dollar), func(row *sql.Row) (*App, error) {
app := new(App)
var (
apiConfig = sqlAPIConfig{}
oidcConfig = sqlOIDCConfig{}
+ samlConfig = sqlSAMLConfig{}
)
err := row.Scan(
@@ -430,6 +515,11 @@ func prepareAppQuery() (sq.SelectBuilder, func(*sql.Row) (*App, error)) {
&oidcConfig.iDTokenUserinfoAssertion,
&oidcConfig.clockSkew,
&oidcConfig.additionalOrigins,
+
+ &samlConfig.appID,
+ &samlConfig.entityID,
+ &samlConfig.metadata,
+ &samlConfig.metadataURL,
)
if err != nil {
@@ -441,6 +531,7 @@ func prepareAppQuery() (sq.SelectBuilder, func(*sql.Row) (*App, error)) {
apiConfig.set(app)
oidcConfig.set(app)
+ samlConfig.set(app)
return app, nil
}
@@ -452,6 +543,7 @@ func prepareProjectIDByAppQuery() (sq.SelectBuilder, func(*sql.Row) (projectID s
).From(appsTable.identifier()).
LeftJoin(join(AppAPIConfigColumnAppID, AppColumnID)).
LeftJoin(join(AppOIDCConfigColumnAppID, AppColumnID)).
+ LeftJoin(join(AppSAMLConfigColumnAppID, AppColumnID)).
PlaceholderFormat(sq.Dollar), func(row *sql.Row) (projectID string, err error) {
err = row.Scan(
&projectID,
@@ -485,6 +577,7 @@ func prepareProjectByAppQuery() (sq.SelectBuilder, func(*sql.Row) (*Project, err
Join(join(AppColumnProjectID, ProjectColumnID)).
LeftJoin(join(AppAPIConfigColumnAppID, AppColumnID)).
LeftJoin(join(AppOIDCConfigColumnAppID, AppColumnID)).
+ LeftJoin(join(AppSAMLConfigColumnAppID, AppColumnID)).
PlaceholderFormat(sq.Dollar),
func(row *sql.Row) (*Project, error) {
p := new(Project)
@@ -542,10 +635,16 @@ func prepareAppsQuery() (sq.SelectBuilder, func(*sql.Rows) (*Apps, error)) {
AppOIDCConfigColumnIDTokenUserinfoAssertion.identifier(),
AppOIDCConfigColumnClockSkew.identifier(),
AppOIDCConfigColumnAdditionalOrigins.identifier(),
+
+ AppSAMLConfigColumnAppID.identifier(),
+ AppSAMLConfigColumnEntityID.identifier(),
+ AppSAMLConfigColumnMetadata.identifier(),
+ AppSAMLConfigColumnMetadataURL.identifier(),
countColumn.identifier(),
).From(appsTable.identifier()).
LeftJoin(join(AppAPIConfigColumnAppID, AppColumnID)).
LeftJoin(join(AppOIDCConfigColumnAppID, AppColumnID)).
+ LeftJoin(join(AppSAMLConfigColumnAppID, AppColumnID)).
PlaceholderFormat(sq.Dollar), func(row *sql.Rows) (*Apps, error) {
apps := &Apps{Apps: []*App{}}
@@ -554,6 +653,7 @@ func prepareAppsQuery() (sq.SelectBuilder, func(*sql.Rows) (*Apps, error)) {
var (
apiConfig = sqlAPIConfig{}
oidcConfig = sqlOIDCConfig{}
+ samlConfig = sqlSAMLConfig{}
)
err := row.Scan(
@@ -586,6 +686,12 @@ func prepareAppsQuery() (sq.SelectBuilder, func(*sql.Rows) (*Apps, error)) {
&oidcConfig.iDTokenUserinfoAssertion,
&oidcConfig.clockSkew,
&oidcConfig.additionalOrigins,
+
+ &samlConfig.appID,
+ &samlConfig.entityID,
+ &samlConfig.metadata,
+ &samlConfig.metadataURL,
+
&apps.Count,
)
@@ -595,6 +701,7 @@ func prepareAppsQuery() (sq.SelectBuilder, func(*sql.Rows) (*Apps, error)) {
apiConfig.set(app)
oidcConfig.set(app)
+ samlConfig.set(app)
apps.Apps = append(apps.Apps, app)
}
@@ -681,6 +788,24 @@ func (c sqlOIDCConfig) set(app *App) {
logging.LogWithFields("app", app.ID).OnError(err).Warn("unable to set allowed origins")
}
+type sqlSAMLConfig struct {
+ appID sql.NullString
+ entityID sql.NullString
+ metadataURL sql.NullString
+ metadata []byte
+}
+
+func (c sqlSAMLConfig) set(app *App) {
+ if !c.appID.Valid {
+ return
+ }
+ app.SAMLConfig = &SAMLApp{
+ MetadataURL: c.metadataURL.String,
+ Metadata: c.metadata,
+ EntityID: c.entityID.String,
+ }
+}
+
type sqlAPIConfig struct {
appID sql.NullString
clientID sql.NullString
diff --git a/internal/query/app_test.go b/internal/query/app_test.go
index 76a759ff4b..30b38c95c7 100644
--- a/internal/query/app_test.go
+++ b/internal/query/app_test.go
@@ -15,80 +15,93 @@ import (
)
var (
- expectedAppQuery = regexp.QuoteMeta(`SELECT projections.apps2.id,` +
- ` projections.apps2.name,` +
- ` projections.apps2.project_id,` +
- ` projections.apps2.creation_date,` +
- ` projections.apps2.change_date,` +
- ` projections.apps2.resource_owner,` +
- ` projections.apps2.state,` +
- ` projections.apps2.sequence,` +
+ expectedAppQuery = regexp.QuoteMeta(`SELECT projections.apps3.id,` +
+ ` projections.apps3.name,` +
+ ` projections.apps3.project_id,` +
+ ` projections.apps3.creation_date,` +
+ ` projections.apps3.change_date,` +
+ ` projections.apps3.resource_owner,` +
+ ` projections.apps3.state,` +
+ ` projections.apps3.sequence,` +
// api config
- ` projections.apps2_api_configs.app_id,` +
- ` projections.apps2_api_configs.client_id,` +
- ` projections.apps2_api_configs.auth_method,` +
+ ` projections.apps3_api_configs.app_id,` +
+ ` projections.apps3_api_configs.client_id,` +
+ ` projections.apps3_api_configs.auth_method,` +
// oidc config
- ` projections.apps2_oidc_configs.app_id,` +
- ` projections.apps2_oidc_configs.version,` +
- ` projections.apps2_oidc_configs.client_id,` +
- ` projections.apps2_oidc_configs.redirect_uris,` +
- ` projections.apps2_oidc_configs.response_types,` +
- ` projections.apps2_oidc_configs.grant_types,` +
- ` projections.apps2_oidc_configs.application_type,` +
- ` projections.apps2_oidc_configs.auth_method_type,` +
- ` projections.apps2_oidc_configs.post_logout_redirect_uris,` +
- ` projections.apps2_oidc_configs.is_dev_mode,` +
- ` projections.apps2_oidc_configs.access_token_type,` +
- ` projections.apps2_oidc_configs.access_token_role_assertion,` +
- ` projections.apps2_oidc_configs.id_token_role_assertion,` +
- ` projections.apps2_oidc_configs.id_token_userinfo_assertion,` +
- ` projections.apps2_oidc_configs.clock_skew,` +
- ` projections.apps2_oidc_configs.additional_origins` +
- ` FROM projections.apps2` +
- ` LEFT JOIN projections.apps2_api_configs ON projections.apps2.id = projections.apps2_api_configs.app_id` +
- ` LEFT JOIN projections.apps2_oidc_configs ON projections.apps2.id = projections.apps2_oidc_configs.app_id`)
- expectedAppsQuery = regexp.QuoteMeta(`SELECT projections.apps2.id,` +
- ` projections.apps2.name,` +
- ` projections.apps2.project_id,` +
- ` projections.apps2.creation_date,` +
- ` projections.apps2.change_date,` +
- ` projections.apps2.resource_owner,` +
- ` projections.apps2.state,` +
- ` projections.apps2.sequence,` +
+ ` projections.apps3_oidc_configs.app_id,` +
+ ` projections.apps3_oidc_configs.version,` +
+ ` projections.apps3_oidc_configs.client_id,` +
+ ` projections.apps3_oidc_configs.redirect_uris,` +
+ ` projections.apps3_oidc_configs.response_types,` +
+ ` projections.apps3_oidc_configs.grant_types,` +
+ ` projections.apps3_oidc_configs.application_type,` +
+ ` projections.apps3_oidc_configs.auth_method_type,` +
+ ` projections.apps3_oidc_configs.post_logout_redirect_uris,` +
+ ` projections.apps3_oidc_configs.is_dev_mode,` +
+ ` projections.apps3_oidc_configs.access_token_type,` +
+ ` projections.apps3_oidc_configs.access_token_role_assertion,` +
+ ` projections.apps3_oidc_configs.id_token_role_assertion,` +
+ ` projections.apps3_oidc_configs.id_token_userinfo_assertion,` +
+ ` projections.apps3_oidc_configs.clock_skew,` +
+ ` projections.apps3_oidc_configs.additional_origins,` +
+ //saml config
+ ` projections.apps3_saml_configs.app_id,` +
+ ` projections.apps3_saml_configs.entity_id,` +
+ ` projections.apps3_saml_configs.metadata,` +
+ ` projections.apps3_saml_configs.metadata_url` +
+ ` FROM projections.apps3` +
+ ` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id` +
+ ` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id` +
+ ` LEFT JOIN projections.apps3_saml_configs ON projections.apps3.id = projections.apps3_saml_configs.app_id`)
+ expectedAppsQuery = regexp.QuoteMeta(`SELECT projections.apps3.id,` +
+ ` projections.apps3.name,` +
+ ` projections.apps3.project_id,` +
+ ` projections.apps3.creation_date,` +
+ ` projections.apps3.change_date,` +
+ ` projections.apps3.resource_owner,` +
+ ` projections.apps3.state,` +
+ ` projections.apps3.sequence,` +
// api config
- ` projections.apps2_api_configs.app_id,` +
- ` projections.apps2_api_configs.client_id,` +
- ` projections.apps2_api_configs.auth_method,` +
+ ` projections.apps3_api_configs.app_id,` +
+ ` projections.apps3_api_configs.client_id,` +
+ ` projections.apps3_api_configs.auth_method,` +
// oidc config
- ` projections.apps2_oidc_configs.app_id,` +
- ` projections.apps2_oidc_configs.version,` +
- ` projections.apps2_oidc_configs.client_id,` +
- ` projections.apps2_oidc_configs.redirect_uris,` +
- ` projections.apps2_oidc_configs.response_types,` +
- ` projections.apps2_oidc_configs.grant_types,` +
- ` projections.apps2_oidc_configs.application_type,` +
- ` projections.apps2_oidc_configs.auth_method_type,` +
- ` projections.apps2_oidc_configs.post_logout_redirect_uris,` +
- ` projections.apps2_oidc_configs.is_dev_mode,` +
- ` projections.apps2_oidc_configs.access_token_type,` +
- ` projections.apps2_oidc_configs.access_token_role_assertion,` +
- ` projections.apps2_oidc_configs.id_token_role_assertion,` +
- ` projections.apps2_oidc_configs.id_token_userinfo_assertion,` +
- ` projections.apps2_oidc_configs.clock_skew,` +
- ` projections.apps2_oidc_configs.additional_origins,` +
+ ` projections.apps3_oidc_configs.app_id,` +
+ ` projections.apps3_oidc_configs.version,` +
+ ` projections.apps3_oidc_configs.client_id,` +
+ ` projections.apps3_oidc_configs.redirect_uris,` +
+ ` projections.apps3_oidc_configs.response_types,` +
+ ` projections.apps3_oidc_configs.grant_types,` +
+ ` projections.apps3_oidc_configs.application_type,` +
+ ` projections.apps3_oidc_configs.auth_method_type,` +
+ ` projections.apps3_oidc_configs.post_logout_redirect_uris,` +
+ ` projections.apps3_oidc_configs.is_dev_mode,` +
+ ` projections.apps3_oidc_configs.access_token_type,` +
+ ` projections.apps3_oidc_configs.access_token_role_assertion,` +
+ ` projections.apps3_oidc_configs.id_token_role_assertion,` +
+ ` projections.apps3_oidc_configs.id_token_userinfo_assertion,` +
+ ` projections.apps3_oidc_configs.clock_skew,` +
+ ` projections.apps3_oidc_configs.additional_origins,` +
+ //saml config
+ ` projections.apps3_saml_configs.app_id,` +
+ ` projections.apps3_saml_configs.entity_id,` +
+ ` projections.apps3_saml_configs.metadata,` +
+ ` projections.apps3_saml_configs.metadata_url,` +
` COUNT(*) OVER ()` +
- ` FROM projections.apps2` +
- ` LEFT JOIN projections.apps2_api_configs ON projections.apps2.id = projections.apps2_api_configs.app_id` +
- ` LEFT JOIN projections.apps2_oidc_configs ON projections.apps2.id = projections.apps2_oidc_configs.app_id`)
- expectedAppIDsQuery = regexp.QuoteMeta(`SELECT projections.apps2_api_configs.client_id,` +
- ` projections.apps2_oidc_configs.client_id` +
- ` FROM projections.apps2` +
- ` LEFT JOIN projections.apps2_api_configs ON projections.apps2.id = projections.apps2_api_configs.app_id` +
- ` LEFT JOIN projections.apps2_oidc_configs ON projections.apps2.id = projections.apps2_oidc_configs.app_id`)
- expectedProjectIDByAppQuery = regexp.QuoteMeta(`SELECT projections.apps2.project_id` +
- ` FROM projections.apps2` +
- ` LEFT JOIN projections.apps2_api_configs ON projections.apps2.id = projections.apps2_api_configs.app_id` +
- ` LEFT JOIN projections.apps2_oidc_configs ON projections.apps2.id = projections.apps2_oidc_configs.app_id`)
+ ` FROM projections.apps3` +
+ ` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id` +
+ ` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id` +
+ ` LEFT JOIN projections.apps3_saml_configs ON projections.apps3.id = projections.apps3_saml_configs.app_id`)
+ expectedAppIDsQuery = regexp.QuoteMeta(`SELECT projections.apps3_api_configs.client_id,` +
+ ` projections.apps3_oidc_configs.client_id` +
+ ` FROM projections.apps3` +
+ ` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id` +
+ ` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id`)
+ expectedProjectIDByAppQuery = regexp.QuoteMeta(`SELECT projections.apps3.project_id` +
+ ` FROM projections.apps3` +
+ ` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id` +
+ ` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id` +
+ ` LEFT JOIN projections.apps3_saml_configs ON projections.apps3.id = projections.apps3_saml_configs.app_id`)
expectedProjectByAppQuery = regexp.QuoteMeta(`SELECT projections.projects2.id,` +
` projections.projects2.creation_date,` +
` projections.projects2.change_date,` +
@@ -101,9 +114,10 @@ var (
` projections.projects2.has_project_check,` +
` projections.projects2.private_labeling_setting` +
` FROM projections.projects2` +
- ` JOIN projections.apps2 ON projections.projects2.id = projections.apps2.project_id` +
- ` LEFT JOIN projections.apps2_api_configs ON projections.apps2.id = projections.apps2_api_configs.app_id` +
- ` LEFT JOIN projections.apps2_oidc_configs ON projections.apps2.id = projections.apps2_oidc_configs.app_id`)
+ ` JOIN projections.apps3 ON projections.projects2.id = projections.apps3.project_id` +
+ ` LEFT JOIN projections.apps3_api_configs ON projections.apps3.id = projections.apps3_api_configs.app_id` +
+ ` LEFT JOIN projections.apps3_oidc_configs ON projections.apps3.id = projections.apps3_oidc_configs.app_id` +
+ ` LEFT JOIN projections.apps3_saml_configs ON projections.apps3.id = projections.apps3_saml_configs.app_id`)
appCols = database.StringArray{
"id",
@@ -135,6 +149,11 @@ var (
"id_token_userinfo_assertion",
"clock_skew",
"additional_origins",
+ //saml config
+ "app_id",
+ "entity_id",
+ "metadata",
+ "metadata_url",
}
appsCols = append(appCols, "count")
)
@@ -200,6 +219,11 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
@@ -260,6 +284,11 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
@@ -285,6 +314,75 @@ func Test_AppsPrepare(t *testing.T) {
},
},
},
+ }, {
+ name: "prepareAppsQuery saml app",
+ prepare: prepareAppsQuery,
+ want: want{
+ sqlExpectations: mockQueries(
+ expectedAppsQuery,
+ appsCols,
+ [][]driver.Value{
+ {
+ "app-id",
+ "app-name",
+ "project-id",
+ testNow,
+ testNow,
+ "ro",
+ domain.AppStateActive,
+ uint64(20211109),
+ // api config
+ nil,
+ nil,
+ nil,
+ // oidc config
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ // saml config
+ "app-id",
+ "https://test.com/saml/metadata",
+ []byte("\n\n \n urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n \n \n \n"),
+ "https://test.com/saml/metadata",
+ },
+ },
+ ),
+ },
+ object: &Apps{
+ SearchResponse: SearchResponse{
+ Count: 1,
+ },
+ Apps: []*App{
+ {
+ ID: "app-id",
+ CreationDate: testNow,
+ ChangeDate: testNow,
+ ResourceOwner: "ro",
+ State: domain.AppStateActive,
+ Sequence: 20211109,
+ Name: "app-name",
+ ProjectID: "project-id",
+ SAMLConfig: &SAMLApp{
+ Metadata: []byte("\n\n \n urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n \n \n \n"),
+ MetadataURL: "https://test.com/saml/metadata",
+ EntityID: "https://test.com/saml/metadata",
+ },
+ },
+ },
+ },
},
{
name: "prepareAppsQuery oidc app",
@@ -324,6 +422,11 @@ func Test_AppsPrepare(t *testing.T) {
true,
1 * time.Second,
database.StringArray{"additional.origin"},
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
@@ -403,6 +506,11 @@ func Test_AppsPrepare(t *testing.T) {
true,
1 * time.Second,
database.StringArray{"additional.origin"},
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
@@ -482,6 +590,11 @@ func Test_AppsPrepare(t *testing.T) {
true,
1 * time.Second,
database.StringArray{"additional.origin"},
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
@@ -561,6 +674,11 @@ func Test_AppsPrepare(t *testing.T) {
true,
1 * time.Second,
database.StringArray{"additional.origin"},
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
@@ -640,6 +758,11 @@ func Test_AppsPrepare(t *testing.T) {
true,
1 * time.Second,
database.StringArray{"additional.origin"},
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
@@ -719,6 +842,11 @@ func Test_AppsPrepare(t *testing.T) {
true,
1 * time.Second,
database.StringArray{"additional.origin"},
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
{
"api-app-id",
@@ -750,13 +878,54 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
+ },
+ {
+ "saml-app-id",
+ "app-name",
+ "project-id",
+ testNow,
+ testNow,
+ "ro",
+ domain.AppStateActive,
+ uint64(20211109),
+ // api config
+ nil,
+ nil,
+ nil,
+ // oidc config
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ // saml config
+ "saml-app-id",
+ "https://test.com/saml/metadata",
+ []byte("\n\n \n urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n \n \n \n"),
+ "https://test.com/saml/metadata",
},
},
),
},
object: &Apps{
SearchResponse: SearchResponse{
- Count: 2,
+ Count: 3,
},
Apps: []*App{
{
@@ -802,6 +971,21 @@ func Test_AppsPrepare(t *testing.T) {
AuthMethodType: domain.APIAuthMethodTypePrivateKeyJWT,
},
},
+ {
+ ID: "saml-app-id",
+ CreationDate: testNow,
+ ChangeDate: testNow,
+ ResourceOwner: "ro",
+ State: domain.AppStateActive,
+ Sequence: 20211109,
+ Name: "app-name",
+ ProjectID: "project-id",
+ SAMLConfig: &SAMLApp{
+ Metadata: []byte("\n\n \n urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n \n \n \n"),
+ MetadataURL: "https://test.com/saml/metadata",
+ EntityID: "https://test.com/saml/metadata",
+ },
+ },
},
},
},
@@ -896,6 +1080,11 @@ func Test_AppPrepare(t *testing.T) {
nil,
nil,
nil,
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
),
},
@@ -948,6 +1137,11 @@ func Test_AppPrepare(t *testing.T) {
nil,
nil,
nil,
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
@@ -1005,6 +1199,11 @@ func Test_AppPrepare(t *testing.T) {
true,
1 * time.Second,
database.StringArray{"additional.origin"},
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
@@ -1038,6 +1237,68 @@ func Test_AppPrepare(t *testing.T) {
AllowedOrigins: database.StringArray{"https://redirect.to", "additional.origin"},
},
},
+ }, {
+ name: "prepareAppQuery saml app",
+ prepare: prepareAppQuery,
+ want: want{
+ sqlExpectations: mockQueries(
+ expectedAppQuery,
+ appCols,
+ [][]driver.Value{
+ {
+ "app-id",
+ "app-name",
+ "project-id",
+ testNow,
+ testNow,
+ "ro",
+ domain.AppStateActive,
+ uint64(20211109),
+ // api config
+ nil,
+ nil,
+ nil,
+ // oidc config
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ nil,
+ // saml config
+ "app-id",
+ "https://test.com/saml/metadata",
+ []byte("\n\n \n urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n \n \n \n"),
+ "https://test.com/saml/metadata",
+ },
+ },
+ ),
+ },
+ object: &App{
+ ID: "app-id",
+ CreationDate: testNow,
+ ChangeDate: testNow,
+ ResourceOwner: "ro",
+ State: domain.AppStateActive,
+ Sequence: 20211109,
+ Name: "app-name",
+ ProjectID: "project-id",
+ SAMLConfig: &SAMLApp{
+ Metadata: []byte("\n\n \n urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\n \n \n \n"),
+ MetadataURL: "https://test.com/saml/metadata",
+ EntityID: "https://test.com/saml/metadata",
+ },
+ },
},
{
name: "prepareAppQuery oidc app IsDevMode inactive",
@@ -1077,6 +1338,11 @@ func Test_AppPrepare(t *testing.T) {
true,
1 * time.Second,
database.StringArray{"additional.origin"},
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
@@ -1149,6 +1415,11 @@ func Test_AppPrepare(t *testing.T) {
true,
1 * time.Second,
database.StringArray{"additional.origin"},
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
@@ -1221,6 +1492,11 @@ func Test_AppPrepare(t *testing.T) {
true,
1 * time.Second,
database.StringArray{"additional.origin"},
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
@@ -1293,6 +1569,11 @@ func Test_AppPrepare(t *testing.T) {
false,
1 * time.Second,
database.StringArray{"additional.origin"},
+ // saml config
+ nil,
+ nil,
+ nil,
+ nil,
},
},
),
diff --git a/internal/query/certificate.go b/internal/query/certificate.go
new file mode 100644
index 0000000000..90576b9078
--- /dev/null
+++ b/internal/query/certificate.go
@@ -0,0 +1,156 @@
+package query
+
+import (
+ "context"
+ "database/sql"
+ "time"
+
+ sq "github.com/Masterminds/squirrel"
+
+ "github.com/zitadel/zitadel/internal/api/authz"
+ "github.com/zitadel/zitadel/internal/crypto"
+ "github.com/zitadel/zitadel/internal/domain"
+ "github.com/zitadel/zitadel/internal/errors"
+ "github.com/zitadel/zitadel/internal/query/projection"
+)
+
+type Certificate interface {
+ Key
+ Expiry() time.Time
+ Key() *crypto.CryptoValue
+ Certificate() []byte
+}
+
+type Certificates struct {
+ SearchResponse
+ Certificates []Certificate
+}
+
+type rsaCertificate struct {
+ key
+ expiry time.Time
+ privateKey *crypto.CryptoValue
+ certificate []byte
+}
+
+func (c *rsaCertificate) Expiry() time.Time {
+ return c.expiry
+}
+
+func (c *rsaCertificate) Key() *crypto.CryptoValue {
+ return c.privateKey
+}
+
+func (c *rsaCertificate) Certificate() []byte {
+ return c.certificate
+}
+
+var (
+ certificateTable = table{
+ name: projection.CertificateTable,
+ }
+ CertificateColID = Column{
+ name: projection.CertificateColumnID,
+ table: certificateTable,
+ }
+ CertificateColExpiry = Column{
+ name: projection.CertificateColumnExpiry,
+ table: certificateTable,
+ }
+ CertificateColCertificate = Column{
+ name: projection.CertificateColumnCertificate,
+ table: certificateTable,
+ }
+)
+
+func (q *Queries) ActiveCertificates(ctx context.Context, t time.Time, usage domain.KeyUsage) (*Certificates, error) {
+ query, scan := prepareCertificateQuery()
+ if t.IsZero() {
+ t = time.Now()
+ }
+ stmt, args, err := query.Where(
+ sq.And{
+ sq.Eq{
+ KeyColInstanceID.identifier(): authz.GetInstance(ctx).InstanceID(),
+ KeyColUse.identifier(): usage,
+ },
+ sq.Gt{
+ CertificateColExpiry.identifier(): t,
+ },
+ sq.Gt{
+ KeyPrivateColExpiry.identifier(): t,
+ },
+ }).OrderBy(KeyPrivateColExpiry.identifier()).ToSql()
+ if err != nil {
+ return nil, errors.ThrowInternal(err, "QUERY-SDfkg", "Errors.Query.SQLStatement")
+ }
+
+ rows, err := q.client.QueryContext(ctx, stmt, args...)
+ if err != nil {
+ return nil, errors.ThrowInternal(err, "QUERY-Sgan4", "Errors.Internal")
+ }
+ keys, err := scan(rows)
+ if err != nil {
+ return nil, err
+ }
+ keys.LatestSequence, err = q.latestSequence(ctx, keyTable)
+ if !errors.IsNotFound(err) {
+ return keys, err
+ }
+ return keys, nil
+}
+
+func prepareCertificateQuery() (sq.SelectBuilder, func(*sql.Rows) (*Certificates, error)) {
+ return sq.Select(
+ KeyColID.identifier(),
+ KeyColCreationDate.identifier(),
+ KeyColChangeDate.identifier(),
+ KeyColSequence.identifier(),
+ KeyColResourceOwner.identifier(),
+ KeyColAlgorithm.identifier(),
+ KeyColUse.identifier(),
+ CertificateColExpiry.identifier(),
+ CertificateColCertificate.identifier(),
+ KeyPrivateColKey.identifier(),
+ countColumn.identifier(),
+ ).From(keyTable.identifier()).
+ LeftJoin(join(CertificateColID, KeyColID)).
+ LeftJoin(join(KeyPrivateColID, KeyColID)).
+ PlaceholderFormat(sq.Dollar),
+ func(rows *sql.Rows) (*Certificates, error) {
+ certificates := make([]Certificate, 0)
+ var count uint64
+ for rows.Next() {
+ k := new(rsaCertificate)
+ err := rows.Scan(
+ &k.id,
+ &k.creationDate,
+ &k.changeDate,
+ &k.sequence,
+ &k.resourceOwner,
+ &k.algorithm,
+ &k.use,
+ &k.expiry,
+ &k.certificate,
+ &k.privateKey,
+ &count,
+ )
+ if err != nil {
+ return nil, err
+ }
+
+ certificates = append(certificates, k)
+ }
+
+ if err := rows.Close(); err != nil {
+ return nil, errors.ThrowInternal(err, "QUERY-rKd6k", "Errors.Query.CloseRows")
+ }
+
+ return &Certificates{
+ Certificates: certificates,
+ SearchResponse: SearchResponse{
+ Count: count,
+ },
+ }, nil
+ }
+}
diff --git a/internal/query/certificate_test.go b/internal/query/certificate_test.go
new file mode 100644
index 0000000000..a02cd3b87a
--- /dev/null
+++ b/internal/query/certificate_test.go
@@ -0,0 +1,169 @@
+package query
+
+import (
+ "database/sql"
+ "database/sql/driver"
+ "errors"
+ "fmt"
+ "regexp"
+ "testing"
+
+ "github.com/zitadel/zitadel/internal/crypto"
+ "github.com/zitadel/zitadel/internal/domain"
+ errs "github.com/zitadel/zitadel/internal/errors"
+)
+
+func Test_CertificatePrepares(t *testing.T) {
+ type want struct {
+ sqlExpectations sqlExpectation
+ err checkErr
+ }
+ tests := []struct {
+ name string
+ prepare interface{}
+ want want
+ object interface{}
+ }{
+ {
+ name: "prepareCertificateQuery no result",
+ prepare: prepareCertificateQuery,
+ want: want{
+ sqlExpectations: mockQueries(
+ regexp.QuoteMeta(`SELECT projections.keys3.id,`+
+ ` projections.keys3.creation_date,`+
+ ` projections.keys3.change_date,`+
+ ` projections.keys3.sequence,`+
+ ` projections.keys3.resource_owner,`+
+ ` projections.keys3.algorithm,`+
+ ` projections.keys3.use,`+
+ ` projections.keys3_certificate.expiry,`+
+ ` projections.keys3_certificate.certificate,`+
+ ` projections.keys3_private.key,`+
+ ` COUNT(*) OVER ()`+
+ ` FROM projections.keys3`+
+ ` LEFT JOIN projections.keys3_certificate ON projections.keys3.id = projections.keys3_certificate.id`+
+ ` LEFT JOIN projections.keys3_private ON projections.keys3.id = projections.keys3_private.id`),
+ nil,
+ nil,
+ ),
+ err: func(err error) (error, bool) {
+ if !errs.IsNotFound(err) {
+ return fmt.Errorf("err should be zitadel.NotFoundError got: %w", err), false
+ }
+ return nil, true
+ },
+ },
+ object: &Certificates{Certificates: []Certificate{}},
+ },
+ {
+ name: "prepareCertificateQuery found",
+ prepare: prepareCertificateQuery,
+ want: want{
+ sqlExpectations: mockQueries(
+ regexp.QuoteMeta(`SELECT projections.keys3.id,`+
+ ` projections.keys3.creation_date,`+
+ ` projections.keys3.change_date,`+
+ ` projections.keys3.sequence,`+
+ ` projections.keys3.resource_owner,`+
+ ` projections.keys3.algorithm,`+
+ ` projections.keys3.use,`+
+ ` projections.keys3_certificate.expiry,`+
+ ` projections.keys3_certificate.certificate,`+
+ ` projections.keys3_private.key,`+
+ ` COUNT(*) OVER ()`+
+ ` FROM projections.keys3`+
+ ` LEFT JOIN projections.keys3_certificate ON projections.keys3.id = projections.keys3_certificate.id`+
+ ` LEFT JOIN projections.keys3_private ON projections.keys3.id = projections.keys3_private.id`),
+ []string{
+ "id",
+ "creation_date",
+ "change_date",
+ "sequence",
+ "resource_owner",
+ "algorithm",
+ "use",
+ "expiry",
+ "certificate",
+ "key",
+ "count",
+ },
+ [][]driver.Value{
+ {
+ "key-id",
+ testNow,
+ testNow,
+ uint64(20211109),
+ "ro",
+ "",
+ 1,
+ testNow,
+ []byte(`privateKey`),
+ []byte(`{"Algorithm": "enc", "Crypted": "cHJpdmF0ZUtleQ==", "CryptoType": 0, "KeyID": "id"}`),
+ },
+ },
+ ),
+ },
+ object: &Certificates{
+ SearchResponse: SearchResponse{
+ Count: 1,
+ },
+ Certificates: []Certificate{
+ &rsaCertificate{
+ key: key{
+ id: "key-id",
+ creationDate: testNow,
+ changeDate: testNow,
+ sequence: 20211109,
+ resourceOwner: "ro",
+ algorithm: "",
+ use: domain.KeyUsageSAMLMetadataSigning,
+ },
+ expiry: testNow,
+ certificate: []byte("privateKey"),
+ privateKey: &crypto.CryptoValue{
+ CryptoType: crypto.TypeEncryption,
+ Algorithm: "enc",
+ KeyID: "id",
+ Crypted: []byte("privateKey"),
+ },
+ },
+ },
+ },
+ },
+ {
+ name: "prepareCertificateQuery sql err",
+ prepare: prepareCertificateQuery,
+ want: want{
+ sqlExpectations: mockQueryErr(
+ regexp.QuoteMeta(`SELECT projections.keys3.id,`+
+ ` projections.keys3.creation_date,`+
+ ` projections.keys3.change_date,`+
+ ` projections.keys3.sequence,`+
+ ` projections.keys3.resource_owner,`+
+ ` projections.keys3.algorithm,`+
+ ` projections.keys3.use,`+
+ ` projections.keys3_certificate.expiry,`+
+ ` projections.keys3_certificate.certificate,`+
+ ` projections.keys3_private.key,`+
+ ` COUNT(*) OVER ()`+
+ ` FROM projections.keys3`+
+ ` LEFT JOIN projections.keys3_certificate ON projections.keys3.id = projections.keys3_certificate.id`+
+ ` LEFT JOIN projections.keys3_private ON projections.keys3.id = projections.keys3_private.id`),
+ sql.ErrConnDone,
+ ),
+ err: func(err error) (error, bool) {
+ if !errors.Is(err, sql.ErrConnDone) {
+ return fmt.Errorf("err should be sql.ErrConnDone got: %w", err), false
+ }
+ return nil, true
+ },
+ },
+ object: nil,
+ },
+ }
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ assertPrepare(t, tt.prepare, tt.object, tt.want.sqlExpectations, tt.want.err)
+ })
+ }
+}
diff --git a/internal/query/key.go b/internal/query/key.go
index 28375158bd..890e5ee81c 100644
--- a/internal/query/key.go
+++ b/internal/query/key.go
@@ -200,7 +200,10 @@ func (q *Queries) ActivePublicKeys(ctx context.Context, t time.Time) (*PublicKey
return nil, err
}
keys.LatestSequence, err = q.latestSequence(ctx, keyTable)
- return keys, err
+ if !errors.IsNotFound(err) {
+ return keys, err
+ }
+ return keys, nil
}
func (q *Queries) ActivePrivateSigningKey(ctx context.Context, t time.Time) (*PrivateKeys, error) {
diff --git a/internal/query/key_test.go b/internal/query/key_test.go
index 5d00060cd2..aaca437b16 100644
--- a/internal/query/key_test.go
+++ b/internal/query/key_test.go
@@ -31,18 +31,18 @@ func Test_KeyPrepares(t *testing.T) {
prepare: preparePublicKeysQuery,
want: want{
sqlExpectations: mockQueries(
- regexp.QuoteMeta(`SELECT projections.keys2.id,`+
- ` projections.keys2.creation_date,`+
- ` projections.keys2.change_date,`+
- ` projections.keys2.sequence,`+
- ` projections.keys2.resource_owner,`+
- ` projections.keys2.algorithm,`+
- ` projections.keys2.use,`+
- ` projections.keys2_public.expiry,`+
- ` projections.keys2_public.key,`+
+ regexp.QuoteMeta(`SELECT projections.keys3.id,`+
+ ` projections.keys3.creation_date,`+
+ ` projections.keys3.change_date,`+
+ ` projections.keys3.sequence,`+
+ ` projections.keys3.resource_owner,`+
+ ` projections.keys3.algorithm,`+
+ ` projections.keys3.use,`+
+ ` projections.keys3_public.expiry,`+
+ ` projections.keys3_public.key,`+
` COUNT(*) OVER ()`+
- ` FROM projections.keys2`+
- ` LEFT JOIN projections.keys2_public ON projections.keys2.id = projections.keys2_public.id`),
+ ` FROM projections.keys3`+
+ ` LEFT JOIN projections.keys3_public ON projections.keys3.id = projections.keys3_public.id`),
nil,
nil,
),
@@ -60,18 +60,18 @@ func Test_KeyPrepares(t *testing.T) {
prepare: preparePublicKeysQuery,
want: want{
sqlExpectations: mockQueries(
- regexp.QuoteMeta(`SELECT projections.keys2.id,`+
- ` projections.keys2.creation_date,`+
- ` projections.keys2.change_date,`+
- ` projections.keys2.sequence,`+
- ` projections.keys2.resource_owner,`+
- ` projections.keys2.algorithm,`+
- ` projections.keys2.use,`+
- ` projections.keys2_public.expiry,`+
- ` projections.keys2_public.key,`+
+ regexp.QuoteMeta(`SELECT projections.keys3.id,`+
+ ` projections.keys3.creation_date,`+
+ ` projections.keys3.change_date,`+
+ ` projections.keys3.sequence,`+
+ ` projections.keys3.resource_owner,`+
+ ` projections.keys3.algorithm,`+
+ ` projections.keys3.use,`+
+ ` projections.keys3_public.expiry,`+
+ ` projections.keys3_public.key,`+
` COUNT(*) OVER ()`+
- ` FROM projections.keys2`+
- ` LEFT JOIN projections.keys2_public ON projections.keys2.id = projections.keys2_public.id`),
+ ` FROM projections.keys3`+
+ ` LEFT JOIN projections.keys3_public ON projections.keys3.id = projections.keys3_public.id`),
[]string{
"id",
"creation_date",
@@ -128,18 +128,18 @@ func Test_KeyPrepares(t *testing.T) {
prepare: preparePublicKeysQuery,
want: want{
sqlExpectations: mockQueryErr(
- regexp.QuoteMeta(`SELECT projections.keys2.id,`+
- ` projections.keys2.creation_date,`+
- ` projections.keys2.change_date,`+
- ` projections.keys2.sequence,`+
- ` projections.keys2.resource_owner,`+
- ` projections.keys2.algorithm,`+
- ` projections.keys2.use,`+
- ` projections.keys2_public.expiry,`+
- ` projections.keys2_public.key,`+
+ regexp.QuoteMeta(`SELECT projections.keys3.id,`+
+ ` projections.keys3.creation_date,`+
+ ` projections.keys3.change_date,`+
+ ` projections.keys3.sequence,`+
+ ` projections.keys3.resource_owner,`+
+ ` projections.keys3.algorithm,`+
+ ` projections.keys3.use,`+
+ ` projections.keys3_public.expiry,`+
+ ` projections.keys3_public.key,`+
` COUNT(*) OVER ()`+
- ` FROM projections.keys2`+
- ` LEFT JOIN projections.keys2_public ON projections.keys2.id = projections.keys2_public.id`),
+ ` FROM projections.keys3`+
+ ` LEFT JOIN projections.keys3_public ON projections.keys3.id = projections.keys3_public.id`),
sql.ErrConnDone,
),
err: func(err error) (error, bool) {
@@ -156,18 +156,18 @@ func Test_KeyPrepares(t *testing.T) {
prepare: preparePrivateKeysQuery,
want: want{
sqlExpectations: mockQueries(
- regexp.QuoteMeta(`SELECT projections.keys2.id,`+
- ` projections.keys2.creation_date,`+
- ` projections.keys2.change_date,`+
- ` projections.keys2.sequence,`+
- ` projections.keys2.resource_owner,`+
- ` projections.keys2.algorithm,`+
- ` projections.keys2.use,`+
- ` projections.keys2_private.expiry,`+
- ` projections.keys2_private.key,`+
+ regexp.QuoteMeta(`SELECT projections.keys3.id,`+
+ ` projections.keys3.creation_date,`+
+ ` projections.keys3.change_date,`+
+ ` projections.keys3.sequence,`+
+ ` projections.keys3.resource_owner,`+
+ ` projections.keys3.algorithm,`+
+ ` projections.keys3.use,`+
+ ` projections.keys3_private.expiry,`+
+ ` projections.keys3_private.key,`+
` COUNT(*) OVER ()`+
- ` FROM projections.keys2`+
- ` LEFT JOIN projections.keys2_private ON projections.keys2.id = projections.keys2_private.id`),
+ ` FROM projections.keys3`+
+ ` LEFT JOIN projections.keys3_private ON projections.keys3.id = projections.keys3_private.id`),
nil,
nil,
),
@@ -185,18 +185,18 @@ func Test_KeyPrepares(t *testing.T) {
prepare: preparePrivateKeysQuery,
want: want{
sqlExpectations: mockQueries(
- regexp.QuoteMeta(`SELECT projections.keys2.id,`+
- ` projections.keys2.creation_date,`+
- ` projections.keys2.change_date,`+
- ` projections.keys2.sequence,`+
- ` projections.keys2.resource_owner,`+
- ` projections.keys2.algorithm,`+
- ` projections.keys2.use,`+
- ` projections.keys2_private.expiry,`+
- ` projections.keys2_private.key,`+
+ regexp.QuoteMeta(`SELECT projections.keys3.id,`+
+ ` projections.keys3.creation_date,`+
+ ` projections.keys3.change_date,`+
+ ` projections.keys3.sequence,`+
+ ` projections.keys3.resource_owner,`+
+ ` projections.keys3.algorithm,`+
+ ` projections.keys3.use,`+
+ ` projections.keys3_private.expiry,`+
+ ` projections.keys3_private.key,`+
` COUNT(*) OVER ()`+
- ` FROM projections.keys2`+
- ` LEFT JOIN projections.keys2_private ON projections.keys2.id = projections.keys2_private.id`),
+ ` FROM projections.keys3`+
+ ` LEFT JOIN projections.keys3_private ON projections.keys3.id = projections.keys3_private.id`),
[]string{
"id",
"creation_date",
@@ -255,18 +255,18 @@ func Test_KeyPrepares(t *testing.T) {
prepare: preparePrivateKeysQuery,
want: want{
sqlExpectations: mockQueryErr(
- regexp.QuoteMeta(`SELECT projections.keys2.id,`+
- ` projections.keys2.creation_date,`+
- ` projections.keys2.change_date,`+
- ` projections.keys2.sequence,`+
- ` projections.keys2.resource_owner,`+
- ` projections.keys2.algorithm,`+
- ` projections.keys2.use,`+
- ` projections.keys2_private.expiry,`+
- ` projections.keys2_private.key,`+
+ regexp.QuoteMeta(`SELECT projections.keys3.id,`+
+ ` projections.keys3.creation_date,`+
+ ` projections.keys3.change_date,`+
+ ` projections.keys3.sequence,`+
+ ` projections.keys3.resource_owner,`+
+ ` projections.keys3.algorithm,`+
+ ` projections.keys3.use,`+
+ ` projections.keys3_private.expiry,`+
+ ` projections.keys3_private.key,`+
` COUNT(*) OVER ()`+
- ` FROM projections.keys2`+
- ` LEFT JOIN projections.keys2_private ON projections.keys2.id = projections.keys2_private.id`),
+ ` FROM projections.keys3`+
+ ` LEFT JOIN projections.keys3_private ON projections.keys3.id = projections.keys3_private.id`),
sql.ErrConnDone,
),
err: func(err error) (error, bool) {
diff --git a/internal/query/projection/app.go b/internal/query/projection/app.go
index af85ce1109..2018acb306 100644
--- a/internal/query/projection/app.go
+++ b/internal/query/projection/app.go
@@ -13,9 +13,10 @@ import (
)
const (
- AppProjectionTable = "projections.apps2"
+ AppProjectionTable = "projections.apps3"
AppAPITable = AppProjectionTable + "_" + appAPITableSuffix
AppOIDCTable = AppProjectionTable + "_" + appOIDCTableSuffix
+ AppSAMLTable = AppProjectionTable + "_" + appSAMLTableSuffix
AppColumnID = "id"
AppColumnName = "name"
@@ -53,6 +54,13 @@ const (
AppOIDCConfigColumnIDTokenUserinfoAssertion = "id_token_userinfo_assertion"
AppOIDCConfigColumnClockSkew = "clock_skew"
AppOIDCConfigColumnAdditionalOrigins = "additional_origins"
+
+ appSAMLTableSuffix = "saml_configs"
+ AppSAMLConfigColumnAppID = "app_id"
+ AppSAMLConfigColumnInstanceID = "instance_id"
+ AppSAMLConfigColumnEntityID = "entity_id"
+ AppSAMLConfigColumnMetadata = "metadata"
+ AppSAMLConfigColumnMetadataURL = "metadata_url"
)
type appProjection struct {
@@ -116,6 +124,18 @@ func newAppProjection(ctx context.Context, config crdb.StatementHandlerConfig) *
crdb.WithForeignKey(crdb.NewForeignKeyOfPublicKeys("fk_oidc_ref_apps")),
crdb.WithIndex(crdb.NewIndex("oidc_client_id_idx", []string{AppOIDCConfigColumnClientID})),
),
+ crdb.NewSuffixedTable([]*crdb.Column{
+ crdb.NewColumn(AppSAMLConfigColumnAppID, crdb.ColumnTypeText),
+ crdb.NewColumn(AppSAMLConfigColumnInstanceID, crdb.ColumnTypeText),
+ crdb.NewColumn(AppSAMLConfigColumnEntityID, crdb.ColumnTypeText),
+ crdb.NewColumn(AppSAMLConfigColumnMetadata, crdb.ColumnTypeBytes),
+ crdb.NewColumn(AppSAMLConfigColumnMetadataURL, crdb.ColumnTypeText),
+ },
+ crdb.NewPrimaryKey(AppSAMLConfigColumnInstanceID, AppSAMLConfigColumnAppID),
+ appSAMLTableSuffix,
+ crdb.WithForeignKey(crdb.NewForeignKeyOfPublicKeys("fk_saml_ref_apps")),
+ crdb.WithIndex(crdb.NewIndex("saml_entity_id_idx", []string{AppSAMLConfigColumnEntityID})),
+ ),
)
p.StatementHandler = crdb.NewStatementHandler(ctx, config)
return p
@@ -174,6 +194,14 @@ func (p *appProjection) reducers() []handler.AggregateReducer {
Event: project.OIDCConfigSecretChangedType,
Reduce: p.reduceOIDCConfigSecretChanged,
},
+ {
+ Event: project.SAMLConfigAddedType,
+ Reduce: p.reduceSAMLConfigAdded,
+ },
+ {
+ Event: project.SAMLConfigChangedType,
+ Reduce: p.reduceSAMLConfigChanged,
+ },
},
},
}
@@ -535,3 +563,77 @@ func (p *appProjection) reduceOIDCConfigSecretChanged(event eventstore.Event) (*
),
), nil
}
+
+func (p *appProjection) reduceSAMLConfigAdded(event eventstore.Event) (*handler.Statement, error) {
+ e, ok := event.(*project.SAMLConfigAddedEvent)
+ if !ok {
+ return nil, errors.ThrowInvalidArgument(nil, "HANDL-GMHU1", "reduce.wrong.event.type")
+ }
+ return crdb.NewMultiStatement(
+ e,
+ crdb.AddCreateStatement(
+ []handler.Column{
+ handler.NewCol(AppSAMLConfigColumnAppID, e.AppID),
+ handler.NewCol(AppSAMLConfigColumnInstanceID, e.Aggregate().InstanceID),
+ handler.NewCol(AppSAMLConfigColumnEntityID, e.EntityID),
+ handler.NewCol(AppSAMLConfigColumnMetadata, e.Metadata),
+ handler.NewCol(AppSAMLConfigColumnMetadataURL, e.MetadataURL),
+ },
+ crdb.WithTableSuffix(appSAMLTableSuffix),
+ ),
+ crdb.AddUpdateStatement(
+ []handler.Column{
+ handler.NewCol(AppColumnChangeDate, e.CreationDate()),
+ handler.NewCol(AppColumnSequence, e.Sequence()),
+ },
+ []handler.Condition{
+ handler.NewCond(AppColumnID, e.AppID),
+ handler.NewCond(AppColumnInstanceID, e.Aggregate().InstanceID),
+ },
+ ),
+ ), nil
+}
+
+func (p *appProjection) reduceSAMLConfigChanged(event eventstore.Event) (*handler.Statement, error) {
+ e, ok := event.(*project.SAMLConfigChangedEvent)
+ if !ok {
+ return nil, errors.ThrowInvalidArgument(nil, "HANDL-GMHU2", "reduce.wrong.event.type")
+ }
+
+ cols := make([]handler.Column, 0, 3)
+ if e.Metadata != nil {
+ cols = append(cols, handler.NewCol(AppSAMLConfigColumnMetadata, e.Metadata))
+ }
+ if e.MetadataURL != nil {
+ cols = append(cols, handler.NewCol(AppSAMLConfigColumnMetadataURL, *e.MetadataURL))
+ }
+ if e.EntityID != "" {
+ cols = append(cols, handler.NewCol(AppSAMLConfigColumnEntityID, e.EntityID))
+ }
+
+ if len(cols) == 0 {
+ return crdb.NewNoOpStatement(e), nil
+ }
+
+ return crdb.NewMultiStatement(
+ e,
+ crdb.AddUpdateStatement(
+ cols,
+ []handler.Condition{
+ handler.NewCond(AppSAMLConfigColumnAppID, e.AppID),
+ handler.NewCond(AppSAMLConfigColumnInstanceID, e.Aggregate().InstanceID),
+ },
+ crdb.WithTableSuffix(appSAMLTableSuffix),
+ ),
+ crdb.AddUpdateStatement(
+ []handler.Column{
+ handler.NewCol(AppColumnChangeDate, e.CreationDate()),
+ handler.NewCol(AppColumnSequence, e.Sequence()),
+ },
+ []handler.Condition{
+ handler.NewCond(AppColumnID, e.AppID),
+ handler.NewCond(AppColumnInstanceID, e.Aggregate().InstanceID),
+ },
+ ),
+ ), nil
+}
diff --git a/internal/query/projection/app_test.go b/internal/query/projection/app_test.go
index d9d282883f..4ac9e1d3b9 100644
--- a/internal/query/projection/app_test.go
+++ b/internal/query/projection/app_test.go
@@ -44,7 +44,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "INSERT INTO projections.apps2 (id, name, project_id, creation_date, change_date, resource_owner, instance_id, state, sequence) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",
+ expectedStmt: "INSERT INTO projections.apps3 (id, name, project_id, creation_date, change_date, resource_owner, instance_id, state, sequence) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",
expectedArgs: []interface{}{
"app-id",
"my-app",
@@ -82,7 +82,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "UPDATE projections.apps2 SET (name, change_date, sequence) = ($1, $2, $3) WHERE (id = $4) AND (instance_id = $5)",
+ expectedStmt: "UPDATE projections.apps3 SET (name, change_date, sequence) = ($1, $2, $3) WHERE (id = $4) AND (instance_id = $5)",
expectedArgs: []interface{}{
"my-app",
anyArg{},
@@ -115,7 +115,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "UPDATE projections.apps2 SET (state, change_date, sequence) = ($1, $2, $3) WHERE (id = $4) AND (instance_id = $5)",
+ expectedStmt: "UPDATE projections.apps3 SET (state, change_date, sequence) = ($1, $2, $3) WHERE (id = $4) AND (instance_id = $5)",
expectedArgs: []interface{}{
domain.AppStateInactive,
anyArg{},
@@ -148,7 +148,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "UPDATE projections.apps2 SET (state, change_date, sequence) = ($1, $2, $3) WHERE (id = $4) AND (instance_id = $5)",
+ expectedStmt: "UPDATE projections.apps3 SET (state, change_date, sequence) = ($1, $2, $3) WHERE (id = $4) AND (instance_id = $5)",
expectedArgs: []interface{}{
domain.AppStateActive,
anyArg{},
@@ -181,7 +181,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "DELETE FROM projections.apps2 WHERE (id = $1) AND (instance_id = $2)",
+ expectedStmt: "DELETE FROM projections.apps3 WHERE (id = $1) AND (instance_id = $2)",
expectedArgs: []interface{}{
"app-id",
"instance-id",
@@ -209,7 +209,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "DELETE FROM projections.apps2 WHERE (project_id = $1) AND (instance_id = $2)",
+ expectedStmt: "DELETE FROM projections.apps3 WHERE (project_id = $1) AND (instance_id = $2)",
expectedArgs: []interface{}{
"agg-id",
"instance-id",
@@ -242,7 +242,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "INSERT INTO projections.apps2_api_configs (app_id, instance_id, client_id, client_secret, auth_method) VALUES ($1, $2, $3, $4, $5)",
+ expectedStmt: "INSERT INTO projections.apps3_api_configs (app_id, instance_id, client_id, client_secret, auth_method) VALUES ($1, $2, $3, $4, $5)",
expectedArgs: []interface{}{
"app-id",
"instance-id",
@@ -252,7 +252,7 @@ func TestAppProjection_reduces(t *testing.T) {
},
},
{
- expectedStmt: "UPDATE projections.apps2 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+ expectedStmt: "UPDATE projections.apps3 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
expectedArgs: []interface{}{
anyArg{},
uint64(15),
@@ -287,7 +287,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "UPDATE projections.apps2_api_configs SET (client_secret, auth_method) = ($1, $2) WHERE (app_id = $3) AND (instance_id = $4)",
+ expectedStmt: "UPDATE projections.apps3_api_configs SET (client_secret, auth_method) = ($1, $2) WHERE (app_id = $3) AND (instance_id = $4)",
expectedArgs: []interface{}{
anyArg{},
domain.APIAuthMethodTypePrivateKeyJWT,
@@ -296,7 +296,7 @@ func TestAppProjection_reduces(t *testing.T) {
},
},
{
- expectedStmt: "UPDATE projections.apps2 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+ expectedStmt: "UPDATE projections.apps3 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
expectedArgs: []interface{}{
anyArg{},
uint64(15),
@@ -351,7 +351,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "UPDATE projections.apps2_api_configs SET client_secret = $1 WHERE (app_id = $2) AND (instance_id = $3)",
+ expectedStmt: "UPDATE projections.apps3_api_configs SET client_secret = $1 WHERE (app_id = $2) AND (instance_id = $3)",
expectedArgs: []interface{}{
anyArg{},
"app-id",
@@ -359,7 +359,7 @@ func TestAppProjection_reduces(t *testing.T) {
},
},
{
- expectedStmt: "UPDATE projections.apps2 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+ expectedStmt: "UPDATE projections.apps3 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
expectedArgs: []interface{}{
anyArg{},
uint64(15),
@@ -407,7 +407,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "INSERT INTO projections.apps2_oidc_configs (app_id, instance_id, version, client_id, client_secret, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18)",
+ expectedStmt: "INSERT INTO projections.apps3_oidc_configs (app_id, instance_id, version, client_id, client_secret, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18)",
expectedArgs: []interface{}{
"app-id",
"instance-id",
@@ -430,7 +430,7 @@ func TestAppProjection_reduces(t *testing.T) {
},
},
{
- expectedStmt: "UPDATE projections.apps2 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+ expectedStmt: "UPDATE projections.apps3 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
expectedArgs: []interface{}{
anyArg{},
uint64(15),
@@ -476,7 +476,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "UPDATE projections.apps2_oidc_configs SET (version, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins) = ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14) WHERE (app_id = $15) AND (instance_id = $16)",
+ expectedStmt: "UPDATE projections.apps3_oidc_configs SET (version, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins) = ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14) WHERE (app_id = $15) AND (instance_id = $16)",
expectedArgs: []interface{}{
domain.OIDCVersionV1,
database.StringArray{"redirect.one.ch", "redirect.two.ch"},
@@ -497,7 +497,7 @@ func TestAppProjection_reduces(t *testing.T) {
},
},
{
- expectedStmt: "UPDATE projections.apps2 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+ expectedStmt: "UPDATE projections.apps3 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
expectedArgs: []interface{}{
anyArg{},
uint64(15),
@@ -552,7 +552,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "UPDATE projections.apps2_oidc_configs SET client_secret = $1 WHERE (app_id = $2) AND (instance_id = $3)",
+ expectedStmt: "UPDATE projections.apps3_oidc_configs SET client_secret = $1 WHERE (app_id = $2) AND (instance_id = $3)",
expectedArgs: []interface{}{
anyArg{},
"app-id",
@@ -560,7 +560,7 @@ func TestAppProjection_reduces(t *testing.T) {
},
},
{
- expectedStmt: "UPDATE projections.apps2 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
+ expectedStmt: "UPDATE projections.apps3 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
expectedArgs: []interface{}{
anyArg{},
uint64(15),
diff --git a/internal/query/projection/key.go b/internal/query/projection/key.go
index 50cb513ebc..1c0698c047 100644
--- a/internal/query/projection/key.go
+++ b/internal/query/projection/key.go
@@ -13,9 +13,10 @@ import (
)
const (
- KeyProjectionTable = "projections.keys2"
+ KeyProjectionTable = "projections.keys3"
KeyPrivateTable = KeyProjectionTable + "_" + privateKeyTableSuffix
KeyPublicTable = KeyProjectionTable + "_" + publicKeyTableSuffix
+ CertificateTable = KeyProjectionTable + "_" + certificateTableSuffix
KeyColumnID = "id"
KeyColumnCreationDate = "creation_date"
@@ -37,14 +38,21 @@ const (
KeyPublicColumnInstanceID = "instance_id"
KeyPublicColumnExpiry = "expiry"
KeyPublicColumnKey = "key"
+
+ certificateTableSuffix = "certificate"
+ CertificateColumnID = "id"
+ CertificateColumnInstanceID = "instance_id"
+ CertificateColumnExpiry = "expiry"
+ CertificateColumnCertificate = "certificate"
)
type keyProjection struct {
crdb.StatementHandler
- encryptionAlgorithm crypto.EncryptionAlgorithm
+ encryptionAlgorithm crypto.EncryptionAlgorithm
+ certEncryptionAlgorithm crypto.EncryptionAlgorithm
}
-func newKeyProjection(ctx context.Context, config crdb.StatementHandlerConfig, keyEncryptionAlgorithm crypto.EncryptionAlgorithm) *keyProjection {
+func newKeyProjection(ctx context.Context, config crdb.StatementHandlerConfig, keyEncryptionAlgorithm crypto.EncryptionAlgorithm, certEncryptionAlgorithm crypto.EncryptionAlgorithm) *keyProjection {
p := new(keyProjection)
config.ProjectionName = KeyProjectionTable
config.Reducers = p.reducers()
@@ -82,8 +90,19 @@ func newKeyProjection(ctx context.Context, config crdb.StatementHandlerConfig, k
publicKeyTableSuffix,
crdb.WithForeignKey(crdb.NewForeignKeyOfPublicKeys("fk_public_ref_keys")),
),
+ crdb.NewSuffixedTable([]*crdb.Column{
+ crdb.NewColumn(CertificateColumnID, crdb.ColumnTypeText),
+ crdb.NewColumn(CertificateColumnInstanceID, crdb.ColumnTypeText),
+ crdb.NewColumn(CertificateColumnExpiry, crdb.ColumnTypeTimestamp),
+ crdb.NewColumn(CertificateColumnCertificate, crdb.ColumnTypeBytes),
+ },
+ crdb.NewPrimaryKey(CertificateColumnInstanceID, CertificateColumnID),
+ certificateTableSuffix,
+ crdb.WithForeignKey(crdb.NewForeignKeyOfPublicKeys("fk_certificate_ref_keys")),
+ ),
)
p.encryptionAlgorithm = keyEncryptionAlgorithm
+ p.certEncryptionAlgorithm = certEncryptionAlgorithm
p.StatementHandler = crdb.NewStatementHandler(ctx, config)
return p
@@ -98,6 +117,10 @@ func (p *keyProjection) reducers() []handler.AggregateReducer {
Event: keypair.AddedEventType,
Reduce: p.reduceKeyPairAdded,
},
+ {
+ Event: keypair.AddedCertificateEventType,
+ Reduce: p.reduceCertificateAdded,
+ },
},
},
}
@@ -151,5 +174,34 @@ func (p *keyProjection) reduceKeyPairAdded(event eventstore.Event) (*handler.Sta
crdb.WithTableSuffix(publicKeyTableSuffix),
))
}
+
+ return crdb.NewMultiStatement(e, creates...), nil
+}
+
+func (p *keyProjection) reduceCertificateAdded(event eventstore.Event) (*handler.Statement, error) {
+ e, ok := event.(*keypair.AddedCertificateEvent)
+ if !ok {
+ return nil, errors.ThrowInvalidArgumentf(nil, "HANDL-SAbr09", "reduce.wrong.event.type %s", keypair.AddedCertificateEventType)
+ }
+
+ if e.Certificate.Expiry.Before(time.Now()) {
+ return crdb.NewNoOpStatement(e), nil
+ }
+
+ certificate, err := crypto.Decrypt(e.Certificate.Key, p.certEncryptionAlgorithm)
+ if err != nil {
+ return nil, errors.ThrowInternal(err, "HANDL-Dajwig2f", "cannot decrypt certificate")
+ }
+
+ creates := []func(eventstore.Event) crdb.Exec{crdb.AddCreateStatement(
+ []handler.Column{
+ handler.NewCol(CertificateColumnID, e.Aggregate().ID),
+ handler.NewCol(CertificateColumnInstanceID, e.Aggregate().InstanceID),
+ handler.NewCol(CertificateColumnExpiry, e.Certificate.Expiry),
+ handler.NewCol(CertificateColumnCertificate, certificate),
+ },
+ crdb.WithTableSuffix(certificateTableSuffix),
+ )}
+
return crdb.NewMultiStatement(e, creates...), nil
}
diff --git a/internal/query/projection/key_test.go b/internal/query/projection/key_test.go
index 0745dafd32..a236cfa63f 100644
--- a/internal/query/projection/key_test.go
+++ b/internal/query/projection/key_test.go
@@ -1,6 +1,7 @@
package projection
import (
+ "fmt"
"testing"
"time"
@@ -31,7 +32,7 @@ func TestKeyProjection_reduces(t *testing.T) {
event: getEvent(testEvent(
repository.EventType(keypair.AddedEventType),
keypair.AggregateType,
- keypairAddedEventData(time.Now().Add(time.Hour)),
+ keypairAddedEventData(domain.KeyUsageSigning, time.Now().Add(time.Hour)),
), keypair.AddedEventMapper),
},
reduce: (&keyProjection{encryptionAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t))}).reduceKeyPairAdded,
@@ -43,7 +44,7 @@ func TestKeyProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
- expectedStmt: "INSERT INTO projections.keys2 (id, creation_date, change_date, resource_owner, instance_id, sequence, algorithm, use) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
+ expectedStmt: "INSERT INTO projections.keys3 (id, creation_date, change_date, resource_owner, instance_id, sequence, algorithm, use) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
expectedArgs: []interface{}{
"agg-id",
anyArg{},
@@ -56,7 +57,7 @@ func TestKeyProjection_reduces(t *testing.T) {
},
},
{
- expectedStmt: "INSERT INTO projections.keys2_private (id, instance_id, expiry, key) VALUES ($1, $2, $3, $4)",
+ expectedStmt: "INSERT INTO projections.keys3_private (id, instance_id, expiry, key) VALUES ($1, $2, $3, $4)",
expectedArgs: []interface{}{
"agg-id",
"instance-id",
@@ -70,7 +71,7 @@ func TestKeyProjection_reduces(t *testing.T) {
},
},
{
- expectedStmt: "INSERT INTO projections.keys2_public (id, instance_id, expiry, key) VALUES ($1, $2, $3, $4)",
+ expectedStmt: "INSERT INTO projections.keys3_public (id, instance_id, expiry, key) VALUES ($1, $2, $3, $4)",
expectedArgs: []interface{}{
"agg-id",
"instance-id",
@@ -88,7 +89,7 @@ func TestKeyProjection_reduces(t *testing.T) {
event: getEvent(testEvent(
repository.EventType(keypair.AddedEventType),
keypair.AggregateType,
- keypairAddedEventData(time.Now().Add(-time.Hour)),
+ keypairAddedEventData(domain.KeyUsageSigning, time.Now().Add(-time.Hour)),
), keypair.AddedEventMapper),
},
reduce: (&keyProjection{}).reduceKeyPairAdded,
@@ -100,6 +101,36 @@ func TestKeyProjection_reduces(t *testing.T) {
executer: &testExecuter{},
},
},
+ {
+ name: "reduceCertificateAdded",
+ args: args{
+ event: getEvent(testEvent(
+ repository.EventType(keypair.AddedCertificateEventType),
+ keypair.AggregateType,
+ certificateAddedEventData(domain.KeyUsageSAMLMetadataSigning, time.Now().Add(time.Hour)),
+ ), keypair.AddedCertificateEventMapper),
+ },
+ reduce: (&keyProjection{certEncryptionAlgorithm: crypto.CreateMockEncryptionAlg(gomock.NewController(t))}).reduceCertificateAdded,
+ want: wantReduce{
+ projection: KeyProjectionTable,
+ aggregateType: eventstore.AggregateType("key_pair"),
+ sequence: 15,
+ previousSequence: 10,
+ executer: &testExecuter{
+ executions: []execution{
+ {
+ expectedStmt: "INSERT INTO projections.keys3_certificate (id, instance_id, expiry, certificate) VALUES ($1, $2, $3, $4)",
+ expectedArgs: []interface{}{
+ "agg-id",
+ "instance-id",
+ anyArg{},
+ []byte("privateKey"),
+ },
+ },
+ },
+ },
+ },
+ },
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
@@ -116,6 +147,10 @@ func TestKeyProjection_reduces(t *testing.T) {
}
}
-func keypairAddedEventData(t time.Time) []byte {
- return []byte(`{"algorithm": "algorithm", "usage": 0, "privateKey": {"key": {"cryptoType": 0, "algorithm": "enc", "keyID": "id", "crypted": "cHJpdmF0ZUtleQ=="}, "expiry": "` + t.Format(time.RFC3339) + `"}, "publicKey": {"key": {"cryptoType": 0, "algorithm": "enc", "keyID": "id", "crypted": "cHVibGljS2V5"}, "expiry": "` + t.Format(time.RFC3339) + `"}}`)
+func keypairAddedEventData(usage domain.KeyUsage, t time.Time) []byte {
+ return []byte(`{"algorithm": "algorithm", "usage": ` + fmt.Sprintf("%d", usage) + `, "privateKey": {"key": {"cryptoType": 0, "algorithm": "enc", "keyID": "id", "crypted": "cHJpdmF0ZUtleQ=="}, "expiry": "` + t.Format(time.RFC3339) + `"}, "publicKey": {"key": {"cryptoType": 0, "algorithm": "enc", "keyID": "id", "crypted": "cHVibGljS2V5"}, "expiry": "` + t.Format(time.RFC3339) + `"}}`)
+}
+
+func certificateAddedEventData(usage domain.KeyUsage, t time.Time) []byte {
+ return []byte(`{"algorithm": "algorithm", "usage": ` + fmt.Sprintf("%d", usage) + `, "certificate": {"key": {"cryptoType": 0, "algorithm": "enc", "keyID": "id", "crypted": "cHJpdmF0ZUtleQ=="}, "expiry": "` + t.Format(time.RFC3339) + `"}}`)
}
diff --git a/internal/query/projection/projection.go b/internal/query/projection/projection.go
index 71b977c470..4495fcb352 100644
--- a/internal/query/projection/projection.go
+++ b/internal/query/projection/projection.go
@@ -62,7 +62,7 @@ var (
NotificationsProjection interface{}
)
-func Start(ctx context.Context, sqlClient *sql.DB, es *eventstore.Eventstore, config Config, keyEncryptionAlgorithm crypto.EncryptionAlgorithm) error {
+func Start(ctx context.Context, sqlClient *sql.DB, es *eventstore.Eventstore, config Config, keyEncryptionAlgorithm crypto.EncryptionAlgorithm, certEncryptionAlgorithm crypto.EncryptionAlgorithm) error {
projectionConfig = crdb.StatementHandlerConfig{
ProjectionHandlerConfig: handler.ProjectionHandlerConfig{
HandlerConfig: handler.HandlerConfig{
@@ -120,7 +120,7 @@ func Start(ctx context.Context, sqlClient *sql.DB, es *eventstore.Eventstore, co
SMSConfigProjection = newSMSConfigProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["sms_config"]))
OIDCSettingsProjection = newOIDCSettingsProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["oidc_settings"]))
DebugNotificationProviderProjection = newDebugNotificationProviderProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["debug_notification_provider"]))
- KeyProjection = newKeyProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["keys"]), keyEncryptionAlgorithm)
+ KeyProjection = newKeyProjection(ctx, applyCustomConfig(projectionConfig, config.Customizations["keys"]), keyEncryptionAlgorithm, certEncryptionAlgorithm)
return nil
}
diff --git a/internal/query/query.go b/internal/query/query.go
index 75dca49d66..437fb497bf 100644
--- a/internal/query/query.go
+++ b/internal/query/query.go
@@ -4,14 +4,15 @@ import (
"context"
"database/sql"
"fmt"
- sd "github.com/zitadel/zitadel/internal/config/systemdefaults"
- "github.com/zitadel/zitadel/internal/domain"
"net/http"
"sync"
"github.com/rakyll/statik/fs"
"golang.org/x/text/language"
+ sd "github.com/zitadel/zitadel/internal/config/systemdefaults"
+ "github.com/zitadel/zitadel/internal/domain"
+
"github.com/zitadel/zitadel/internal/api/authz"
"github.com/zitadel/zitadel/internal/crypto"
"github.com/zitadel/zitadel/internal/eventstore"
@@ -42,7 +43,7 @@ type Queries struct {
multifactors domain.MultifactorConfigs
}
-func StartQueries(ctx context.Context, es *eventstore.Eventstore, sqlClient *sql.DB, projections projection.Config, defaults sd.SystemDefaults, idpConfigEncryption, otpEncryption, keyEncryptionAlgorithm crypto.EncryptionAlgorithm, zitadelRoles []authz.RoleMapping) (repo *Queries, err error) {
+func StartQueries(ctx context.Context, es *eventstore.Eventstore, sqlClient *sql.DB, projections projection.Config, defaults sd.SystemDefaults, idpConfigEncryption, otpEncryption, keyEncryptionAlgorithm crypto.EncryptionAlgorithm, certEncryptionAlgorithm crypto.EncryptionAlgorithm, zitadelRoles []authz.RoleMapping) (repo *Queries, err error) {
statikLoginFS, err := fs.NewWithNamespace("login")
if err != nil {
return nil, fmt.Errorf("unable to start login statik dir")
@@ -79,7 +80,7 @@ func StartQueries(ctx context.Context, es *eventstore.Eventstore, sqlClient *sql
},
}
- err = projection.Start(ctx, sqlClient, es, projections, keyEncryptionAlgorithm)
+ err = projection.Start(ctx, sqlClient, es, projections, keyEncryptionAlgorithm, certEncryptionAlgorithm)
if err != nil {
return nil, err
}
diff --git a/internal/repository/keypair/certificate.go b/internal/repository/keypair/certificate.go
new file mode 100644
index 0000000000..de3ffabb75
--- /dev/null
+++ b/internal/repository/keypair/certificate.go
@@ -0,0 +1,61 @@
+package keypair
+
+import (
+ "context"
+ "encoding/json"
+ "time"
+
+ "github.com/zitadel/zitadel/internal/crypto"
+ "github.com/zitadel/zitadel/internal/errors"
+ "github.com/zitadel/zitadel/internal/eventstore"
+ "github.com/zitadel/zitadel/internal/eventstore/repository"
+)
+
+const (
+ AddedCertificateEventType = eventTypePrefix + "certificate.added"
+)
+
+type AddedCertificateEvent struct {
+ eventstore.BaseEvent `json:"-"`
+
+ Certificate *Key `json:"certificate"`
+}
+
+func (e *AddedCertificateEvent) Data() interface{} {
+ return e
+}
+
+func (e *AddedCertificateEvent) UniqueConstraints() []*eventstore.EventUniqueConstraint {
+ return nil
+}
+
+func NewAddedCertificateEvent(
+ ctx context.Context,
+ aggregate *eventstore.Aggregate,
+ certificateCrypto *crypto.CryptoValue,
+ certificateExpiration time.Time) *AddedCertificateEvent {
+ return &AddedCertificateEvent{
+ BaseEvent: *eventstore.NewBaseEventForPush(
+ ctx,
+ aggregate,
+ AddedCertificateEventType,
+ ),
+ Certificate: &Key{
+ Key: certificateCrypto,
+ Expiry: certificateExpiration,
+ },
+ }
+}
+
+func AddedCertificateEventMapper(event *repository.Event) (eventstore.Event, error) {
+ e := &AddedCertificateEvent{
+ BaseEvent: *eventstore.BaseEventFromRepo(event),
+ }
+
+ err := json.Unmarshal(event.Data, e)
+ if err != nil {
+ return nil, errors.ThrowInternal(err, "KEY-4n9vs", "unable to unmarshal certificate added")
+ }
+
+ return e, nil
+}
diff --git a/internal/repository/keypair/eventstore.go b/internal/repository/keypair/eventstore.go
index dc0509c29b..d4bacdd654 100644
--- a/internal/repository/keypair/eventstore.go
+++ b/internal/repository/keypair/eventstore.go
@@ -6,4 +6,5 @@ import (
func RegisterEventMappers(es *eventstore.Eventstore) {
es.RegisterFilterEventMapper(AddedEventType, AddedEventMapper)
+ es.RegisterFilterEventMapper(AddedCertificateEventType, AddedCertificateEventMapper)
}
diff --git a/internal/repository/project/application.go b/internal/repository/project/application.go
index 3834add6e6..b2afbb9e02 100644
--- a/internal/repository/project/application.go
+++ b/internal/repository/project/application.go
@@ -217,8 +217,9 @@ func ApplicationReactivatedEventMapper(event *repository.Event) (eventstore.Even
type ApplicationRemovedEvent struct {
eventstore.BaseEvent `json:"-"`
- AppID string `json:"appId,omitempty"`
- name string
+ AppID string `json:"appId,omitempty"`
+ name string
+ entityID string
}
func (e *ApplicationRemovedEvent) Data() interface{} {
@@ -226,7 +227,11 @@ func (e *ApplicationRemovedEvent) Data() interface{} {
}
func (e *ApplicationRemovedEvent) UniqueConstraints() []*eventstore.EventUniqueConstraint {
- return []*eventstore.EventUniqueConstraint{NewRemoveApplicationUniqueConstraint(e.name, e.Aggregate().ID)}
+ remove := []*eventstore.EventUniqueConstraint{NewRemoveApplicationUniqueConstraint(e.name, e.Aggregate().ID)}
+ if e.entityID != "" {
+ remove = append(remove, NewRemoveSAMLConfigEntityIDUniqueConstraint(e.entityID))
+ }
+ return remove
}
func NewApplicationRemovedEvent(
@@ -234,6 +239,7 @@ func NewApplicationRemovedEvent(
aggregate *eventstore.Aggregate,
appID,
name string,
+ entityID string,
) *ApplicationRemovedEvent {
return &ApplicationRemovedEvent{
BaseEvent: *eventstore.NewBaseEventForPush(
@@ -241,8 +247,9 @@ func NewApplicationRemovedEvent(
aggregate,
ApplicationRemovedType,
),
- AppID: appID,
- name: name,
+ AppID: appID,
+ name: name,
+ entityID: entityID,
}
}
diff --git a/internal/repository/project/eventstore.go b/internal/repository/project/eventstore.go
index ed2d12adbd..c917ccd818 100644
--- a/internal/repository/project/eventstore.go
+++ b/internal/repository/project/eventstore.go
@@ -41,5 +41,7 @@ func RegisterEventMappers(es *eventstore.Eventstore) {
RegisterFilterEventMapper(APIConfigChangedType, APIConfigChangedEventMapper).
RegisterFilterEventMapper(APIConfigSecretChangedType, APIConfigSecretChangedEventMapper).
RegisterFilterEventMapper(ApplicationKeyAddedEventType, ApplicationKeyAddedEventMapper).
- RegisterFilterEventMapper(ApplicationKeyRemovedEventType, ApplicationKeyRemovedEventMapper)
+ RegisterFilterEventMapper(ApplicationKeyRemovedEventType, ApplicationKeyRemovedEventMapper).
+ RegisterFilterEventMapper(SAMLConfigAddedType, SAMLConfigAddedEventMapper).
+ RegisterFilterEventMapper(SAMLConfigChangedType, SAMLConfigChangedEventMapper)
}
diff --git a/internal/repository/project/project.go b/internal/repository/project/project.go
index a05d06d81c..eb2abba073 100644
--- a/internal/repository/project/project.go
+++ b/internal/repository/project/project.go
@@ -240,7 +240,8 @@ func ProjectReactivatedEventMapper(event *repository.Event) (eventstore.Event, e
type ProjectRemovedEvent struct {
eventstore.BaseEvent `json:"-"`
- Name string
+ Name string
+ entityIDUniqueContraints []*eventstore.EventUniqueConstraint
}
func (e *ProjectRemovedEvent) Data() interface{} {
@@ -248,13 +249,20 @@ func (e *ProjectRemovedEvent) Data() interface{} {
}
func (e *ProjectRemovedEvent) UniqueConstraints() []*eventstore.EventUniqueConstraint {
- return []*eventstore.EventUniqueConstraint{NewRemoveProjectNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner)}
+ constraints := []*eventstore.EventUniqueConstraint{NewRemoveProjectNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner)}
+ if e.entityIDUniqueContraints != nil {
+ for _, constraint := range e.entityIDUniqueContraints {
+ constraints = append(constraints, constraint)
+ }
+ }
+ return constraints
}
func NewProjectRemovedEvent(
ctx context.Context,
aggregate *eventstore.Aggregate,
name string,
+ entityIDUniqueContraints []*eventstore.EventUniqueConstraint,
) *ProjectRemovedEvent {
return &ProjectRemovedEvent{
BaseEvent: *eventstore.NewBaseEventForPush(
@@ -262,7 +270,8 @@ func NewProjectRemovedEvent(
aggregate,
ProjectRemovedType,
),
- Name: name,
+ Name: name,
+ entityIDUniqueContraints: entityIDUniqueContraints,
}
}
diff --git a/internal/repository/project/saml_config.go b/internal/repository/project/saml_config.go
new file mode 100644
index 0000000000..6fc38469e8
--- /dev/null
+++ b/internal/repository/project/saml_config.go
@@ -0,0 +1,163 @@
+package project
+
+import (
+ "context"
+ "encoding/json"
+
+ "github.com/zitadel/zitadel/internal/errors"
+ "github.com/zitadel/zitadel/internal/eventstore"
+ "github.com/zitadel/zitadel/internal/eventstore/repository"
+)
+
+const (
+ UniqueEntityIDType = "entity_ids"
+ SAMLConfigAddedType = applicationEventTypePrefix + "config.saml.added"
+ SAMLConfigChangedType = applicationEventTypePrefix + "config.saml.changed"
+)
+
+type SAMLConfigAddedEvent struct {
+ eventstore.BaseEvent `json:"-"`
+
+ AppID string `json:"appId"`
+ EntityID string `json:"entityId"`
+ Metadata []byte `json:"metadata,omitempty"`
+ MetadataURL string `json:"metadata_url,omitempty"`
+}
+
+func (e *SAMLConfigAddedEvent) Data() interface{} {
+ return e
+}
+
+func NewAddSAMLConfigEntityIDUniqueConstraint(entityID string) *eventstore.EventUniqueConstraint {
+ return eventstore.NewAddEventUniqueConstraint(
+ UniqueEntityIDType,
+ entityID,
+ "Errors.Project.App.SAMLEntityIDAlreadyExists")
+}
+
+func NewRemoveSAMLConfigEntityIDUniqueConstraint(entityID string) *eventstore.EventUniqueConstraint {
+ return eventstore.NewRemoveEventUniqueConstraint(
+ UniqueEntityIDType,
+ entityID)
+}
+
+func (e *SAMLConfigAddedEvent) UniqueConstraints() []*eventstore.EventUniqueConstraint {
+ return []*eventstore.EventUniqueConstraint{NewAddSAMLConfigEntityIDUniqueConstraint(e.EntityID)}
+}
+
+func NewSAMLConfigAddedEvent(
+ ctx context.Context,
+ aggregate *eventstore.Aggregate,
+ appID string,
+ entityID string,
+ metadata []byte,
+ metadataURL string,
+) *SAMLConfigAddedEvent {
+ return &SAMLConfigAddedEvent{
+ BaseEvent: *eventstore.NewBaseEventForPush(
+ ctx,
+ aggregate,
+ SAMLConfigAddedType,
+ ),
+ AppID: appID,
+ EntityID: entityID,
+ Metadata: metadata,
+ MetadataURL: metadataURL,
+ }
+}
+
+func SAMLConfigAddedEventMapper(event *repository.Event) (eventstore.Event, error) {
+ e := &SAMLConfigAddedEvent{
+ BaseEvent: *eventstore.BaseEventFromRepo(event),
+ }
+
+ err := json.Unmarshal(event.Data, e)
+ if err != nil {
+ return nil, errors.ThrowInternal(err, "SAML-BDd15", "unable to unmarshal saml config")
+ }
+
+ return e, nil
+}
+
+type SAMLConfigChangedEvent struct {
+ eventstore.BaseEvent `json:"-"`
+
+ AppID string `json:"appId"`
+ EntityID string `json:"entityId"`
+ Metadata []byte `json:"metadata,omitempty"`
+ MetadataURL *string `json:"metadata_url,omitempty"`
+ oldEntityID string
+}
+
+func (e *SAMLConfigChangedEvent) Data() interface{} {
+ return e
+}
+
+func (e *SAMLConfigChangedEvent) UniqueConstraints() []*eventstore.EventUniqueConstraint {
+ if e.EntityID != "" {
+ return []*eventstore.EventUniqueConstraint{
+ NewRemoveSAMLConfigEntityIDUniqueConstraint(e.oldEntityID),
+ NewAddSAMLConfigEntityIDUniqueConstraint(e.EntityID),
+ }
+ }
+ return nil
+}
+
+func NewSAMLConfigChangedEvent(
+ ctx context.Context,
+ aggregate *eventstore.Aggregate,
+ appID string,
+ oldEntityID string,
+ changes []SAMLConfigChanges,
+) (*SAMLConfigChangedEvent, error) {
+ if len(changes) == 0 {
+ return nil, errors.ThrowPreconditionFailed(nil, "SAML-i8idç", "Errors.NoChangesFound")
+ }
+
+ changeEvent := &SAMLConfigChangedEvent{
+ BaseEvent: *eventstore.NewBaseEventForPush(
+ ctx,
+ aggregate,
+ SAMLConfigChangedType,
+ ),
+ AppID: appID,
+ oldEntityID: oldEntityID,
+ }
+ for _, change := range changes {
+ change(changeEvent)
+ }
+ return changeEvent, nil
+}
+
+type SAMLConfigChanges func(event *SAMLConfigChangedEvent)
+
+func ChangeMetadata(metadata []byte) func(event *SAMLConfigChangedEvent) {
+ return func(e *SAMLConfigChangedEvent) {
+ e.Metadata = metadata
+ }
+}
+
+func ChangeMetadataURL(metadataURL string) func(event *SAMLConfigChangedEvent) {
+ return func(e *SAMLConfigChangedEvent) {
+ e.MetadataURL = &metadataURL
+ }
+}
+
+func ChangeEntityID(entityID string) func(event *SAMLConfigChangedEvent) {
+ return func(e *SAMLConfigChangedEvent) {
+ e.EntityID = entityID
+ }
+}
+
+func SAMLConfigChangedEventMapper(event *repository.Event) (eventstore.Event, error) {
+ e := &SAMLConfigChangedEvent{
+ BaseEvent: *eventstore.BaseEventFromRepo(event),
+ }
+
+ err := json.Unmarshal(event.Data, e)
+ if err != nil {
+ return nil, errors.ThrowInternal(err, "SAML-BFd15", "unable to unmarshal saml config")
+ }
+
+ return e, nil
+}
diff --git a/internal/static/i18n/de.yaml b/internal/static/i18n/de.yaml
index 2f6ad67f40..c7f09e72d1 100644
--- a/internal/static/i18n/de.yaml
+++ b/internal/static/i18n/de.yaml
@@ -247,9 +247,14 @@ Errors:
NotExisting: Applikation existiert nicht
IsNotOIDC: Applikation ist nicht vom Typ OIDC
IsNotAPI: Applikation ist nicht vom Typ API
+ IsNotSAML: Applikation ist nicht vom Typ SAML
NotActive: Applikation ist nicht aktiv
NotInactive: Applikation ist nickt inaktiv
OIDCConfigInvalid: OIDC Konfiguration ist ungültig
+ SAMLConfigInvalid: SAML Konfiguration ist ungültig
+ SAMLMetadataMissing: SAML Metadata ist nicht vorhanden
+ SAMLMetadataFormat: SAML Metadata Formatfehler
+ SAMLEntityIDAlreadyExisting: SAML EntityID existiert bereits
APIConfigInvalid: API Konfiguration ist ungültig
OIDCAuthMethodNoSecret: Gewählte OIDC Auth Method benötigt kein Secret
APIAuthMethodNoSecret: Gewählte API Auth Method benötigt kein Secret
@@ -751,6 +756,9 @@ EventTypes:
added: Applikations Schlüssel hinzugefügt
removed: Applikations Schlüssel entfernt
config:
+ saml:
+ added: SAML Konfiguration hinzugefügt
+ changed: SAML Konfiguration geändert
oidc:
added: OIDC Konfiguration hinzugefügt
changed: OIDC Konfiguration geändert
diff --git a/internal/static/i18n/en.yaml b/internal/static/i18n/en.yaml
index 4058bd401b..488f51e9d9 100644
--- a/internal/static/i18n/en.yaml
+++ b/internal/static/i18n/en.yaml
@@ -249,8 +249,13 @@ Errors:
NotInactive: Application is not inactive
OIDCConfigInvalid: OIDC configuration is invalid
APIConfigInvalid: API configuration is invalid
- IsNotOIDC: Application is not type oidc
+ SAMLConfigInvalid: SAML configuration is invalid
+ IsNotOIDC: Application is not type OIDC
IsNotAPI: Application is not type API
+ IsNotSAML: Application is not type SAML
+ SAMLMetadataMissing: SAML metadata is missing
+ SAMLMetadataFormat: SAML Metadata format error
+ SAMLEntityIDAlreadyExisting: SAML EntityID already existing
OIDCAuthMethodNoSecret: Chosen OIDC Auth Method does not require a secret
APIAuthMethodNoSecret: Chosen API Auth Method does not require a secret
AuthMethodNoPrivateKeyJWT: Chosen Auth Method does not require a key
@@ -751,6 +756,9 @@ EventTypes:
added: Application key added
removed: Application key removed
config:
+ saml:
+ added: SAML Configuration added
+ changed: SAML Configuration changed
oidc:
added: OIDC Configuration added
changed: OIDC Configuration changed
diff --git a/internal/static/i18n/fr.yaml b/internal/static/i18n/fr.yaml
index 4492e0a135..c9d3a1b79a 100644
--- a/internal/static/i18n/fr.yaml
+++ b/internal/static/i18n/fr.yaml
@@ -249,8 +249,13 @@ Errors:
NotInactive: L'application n'est pas inactive
OIDCConfigInvalid: La configuration de l'OIDC n'est pas valide
APIConfigInvalid: La configuration de l'API n'est pas valide
- IsNotOIDC: L'application n'est pas de type oidc
+ SAMLConfigInvalid: La configuration de l'SAML n'est pas valide
+ IsNotOIDC: L'application n'est pas de type OIDC
IsNotAPI: L'application n'est pas de type API
+ IsNotSAML: L'application n'est pas de type SAML
+ SAMLMetadataMissing: Les métadonnées SAML sont manquantes
+ SAMLMetadataFormat: Erreur de format des métadonnées SAML
+ SAMLEntityIDAlreadyExisting: SAML EntityID déjà existant
OIDCAuthMethodNoSecret: La méthode d'authentification OIDC choisie ne nécessite pas de secret.
APIAuthMethodNoSecret: La méthode d'authentification API choisie ne nécessite pas de secret.
AuthMethodNoPrivateKeyJWT: La méthode d'authentification choisie ne nécessite pas de clé.
@@ -751,6 +756,9 @@ EventTypes:
added: Clé d'application ajoutée
removed: Clé d'application supprimée
config:
+ saml:
+ added: Configuration SAML ajoutée
+ changed: La configuration de SAML a été modifiée
oidc:
added: Configuration OIDC ajoutée
changed: Modification de la configuration de l'OIDC
diff --git a/internal/static/i18n/it.yaml b/internal/static/i18n/it.yaml
index e7ef4751d9..af9527ec25 100644
--- a/internal/static/i18n/it.yaml
+++ b/internal/static/i18n/it.yaml
@@ -249,8 +249,13 @@ Errors:
NotInactive: L'applicazione non è inattiva
OIDCConfigInvalid: La configurazione OIDC non è valida
APIConfigInvalid: La configurazione API non è valida
- IsNotOIDC: L'applicazione non è di tipo oidc
+ SAMLConfigInvalid: La configurazione SAML non è valida
+ IsNotOIDC: L'applicazione non è di tipo OIDC
IsNotAPI: L'applicazione non è di tipo API
+ IsNotSAML: L'applicazione non è di tipo SAML
+ SAMLMetadataMissing: Mancano i metadati SAML
+ SAMLMetadataFormat: Errore nel formato dei metadati SAML
+ SAMLEntityIDAlreadyExisting: EntityID SAML già esistente
OIDCAuthMethodNoSecret: Il metodo di autorizzazione OIDC scelto non richiede un segreto
APIAuthMethodNoSecret: Il metodo di autorizzazione API scelto non richiede un segreto
AuthMethodNoPrivateKeyJWT: Il metodo di autorizzazione scelto non richiede una chiave
@@ -751,6 +756,9 @@ EventTypes:
added: Chiave di applicazione aggiunta
removed: Chiave di applicazione rimossa
config:
+ saml:
+ added: Configurazione SAML aggiunta
+ changed: Configurazione SAML modificata
oidc:
added: Configurazione OIDC aggiunta
changed: Configurazione OIDC modificata
diff --git a/internal/static/i18n/zh.yaml b/internal/static/i18n/zh.yaml
index e53cd79113..c436010f74 100644
--- a/internal/static/i18n/zh.yaml
+++ b/internal/static/i18n/zh.yaml
@@ -750,6 +750,9 @@ EventTypes:
added: 添加应用 Key
removed: 删除应用 Key
config:
+ saml:
+ added: 添加 SAML 配置
+ changed: 更改 SAML 配置
oidc:
added: 添加 OIDC 配置
changed: 更改 OIDC 配置
diff --git a/proto/zitadel/app.proto b/proto/zitadel/app.proto
index d4fe2fe0d6..c40077d617 100644
--- a/proto/zitadel/app.proto
+++ b/proto/zitadel/app.proto
@@ -30,6 +30,7 @@ message App {
oneof config {
OIDCConfig oidc_config = 5;
APIConfig api_config = 6;
+ SAMLConfig saml_config = 7;
}
}
@@ -198,6 +199,13 @@ enum OIDCTokenType {
OIDC_TOKEN_TYPE_JWT = 1;
}
+message SAMLConfig {
+ oneof metadata{
+ bytes metadata_xml = 1;
+ string metadata_url = 2;
+ }
+}
+
enum APIAuthMethodType {
API_AUTH_METHOD_TYPE_BASIC = 0;
API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT = 1;
diff --git a/proto/zitadel/management.proto b/proto/zitadel/management.proto
index c49651b309..65f9350d71 100644
--- a/proto/zitadel/management.proto
+++ b/proto/zitadel/management.proto
@@ -1298,14 +1298,28 @@ service ManagementService {
};
}
- // Adds a new api application
- // Returns a client id
- // Returns a new generated secret if needed (Depending on the configuration)
- rpc AddAPIApp(AddAPIAppRequest) returns (AddAPIAppResponse) {
- option (google.api.http) = {
- post: "/projects/{project_id}/apps/api"
- body: "*"
- };
+ // Adds a new saml service provider
+ // Returns a entityID
+ rpc AddSAMLApp(AddSAMLAppRequest) returns (AddSAMLAppResponse) {
+ option (google.api.http) = {
+ post: "/projects/{project_id}/apps/saml"
+ body: "*"
+ };
+
+ option (zitadel.v1.auth_option) = {
+ permission: "project.app.write"
+ check_field_name: "ProjectId"
+ };
+ }
+
+ // Adds a new api application
+ // Returns a client id
+ // Returns a new generated secret if needed (Depending on the configuration)
+ rpc AddAPIApp(AddAPIAppRequest) returns (AddAPIAppResponse) {
+ option (google.api.http) = {
+ post: "/projects/{project_id}/apps/api"
+ body: "*"
+ };
option (zitadel.v1.auth_option) = {
permission: "project.app.write"
@@ -1339,12 +1353,25 @@ service ManagementService {
};
}
- // Changes the configuration of the api application
- rpc UpdateAPIAppConfig(UpdateAPIAppConfigRequest) returns (UpdateAPIAppConfigResponse) {
- option (google.api.http) = {
- put: "/projects/{project_id}/apps/{app_id}/api_config"
- body: "*"
- };
+ // Changes the configuration of the saml application
+ rpc UpdateSAMLAppConfig(UpdateSAMLAppConfigRequest) returns (UpdateSAMLAppConfigResponse) {
+ option (google.api.http) = {
+ put: "/projects/{project_id}/apps/{app_id}/saml_config"
+ body: "*"
+ };
+
+ option (zitadel.v1.auth_option) = {
+ permission: "project.app.write"
+ check_field_name: "ProjectId"
+ };
+ }
+
+ // Changes the configuration of the api application
+ rpc UpdateAPIAppConfig(UpdateAPIAppConfigRequest) returns (UpdateAPIAppConfigResponse) {
+ option (google.api.http) = {
+ put: "/projects/{project_id}/apps/{app_id}/api_config"
+ body: "*"
+ };
option (zitadel.v1.auth_option) = {
permission: "project.app.write"
@@ -3954,6 +3981,21 @@ message AddOIDCAppResponse {
repeated zitadel.v1.LocalizedMessage compliance_problems = 6;
}
+message AddSAMLAppRequest {
+ string project_id = 1 [(validate.rules).string = {min_len: 1, max_len: 200}];
+ string name = 2 [(validate.rules).string = {min_len: 1, max_len: 200}];
+ oneof metadata {
+ option (validate.required) = true;
+ bytes metadata_xml = 3 [(validate.rules).bytes.max_len = 500000];
+ string metadata_url = 4 [(validate.rules).string.max_len = 200];
+ }
+}
+
+message AddSAMLAppResponse {
+ string app_id = 1;
+ zitadel.v1.ObjectDetails details = 2;
+}
+
message AddAPIAppRequest {
string project_id = 1 [(validate.rules).string = {min_len: 1, max_len: 200}];
string name = 2 [(validate.rules).string = {min_len: 1, max_len: 200}];
@@ -4007,7 +4049,22 @@ message UpdateOIDCAppConfigRequest {
}
message UpdateOIDCAppConfigResponse {
- zitadel.v1.ObjectDetails details = 1;
+ zitadel.v1.ObjectDetails details = 1;
+}
+
+message UpdateSAMLAppConfigRequest {
+ string project_id = 1 [(validate.rules).string = {min_len: 1, max_len: 200}];
+ string app_id = 2 [(validate.rules).string = {min_len: 1, max_len: 200}];
+
+ oneof metadata {
+ option (validate.required) = true;
+ bytes metadata_xml = 3 [(validate.rules).bytes.max_len = 500000];
+ string metadata_url = 4 [(validate.rules).string.max_len = 200];
+ }
+}
+
+message UpdateSAMLAppConfigResponse {
+ zitadel.v1.ObjectDetails details = 1;
}
message UpdateAPIAppConfigRequest {