feat: idp and login policy configurations (#619)

* feat: oidc config

* fix: oidc configurations

* feat: oidc idp config

* feat: add oidc config test

* fix: tests

* fix: tests

* feat: translate new events

* feat: idp eventstore

* feat: idp eventstore

* fix: tests

* feat: command side idp

* feat: query side idp

* feat: idp config on org

* fix: tests

* feat: authz idp on org

* feat: org idps

* feat: login policy

* feat: login policy

* feat: login policy

* feat: add idp func on login policy

* feat: add validation to loginpolicy and idp provider

* feat: add default login policy

* feat: login policy on org

* feat: login policy on org

* fix: id config handlers

* fix: id config handlers

* fix: create idp on org

* fix: create idp on org

* fix: not existing idp config

* fix: default login policy

* fix: add login policy on org

* fix: idp provider search on org

* fix: test

* fix: remove idp on org

* fix: test

* fix: test

* fix: remove admin idp

* fix: logo src as byte

* fix: migration

* fix: tests

* Update internal/iam/repository/eventsourcing/iam.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* Update internal/iam/repository/eventsourcing/iam_test.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* Update internal/iam/repository/eventsourcing/iam_test.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* Update internal/iam/repository/eventsourcing/model/login_policy.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* Update internal/iam/repository/eventsourcing/model/login_policy.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* Update internal/org/repository/eventsourcing/org_test.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* Update internal/iam/repository/eventsourcing/model/login_policy_test.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* Update internal/iam/repository/eventsourcing/model/login_policy_test.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* fix: pr comments

* fix: tests

* Update types.go

* fix: merge request changes

* fix: reduce optimization

Co-authored-by: Silvan <silvan.reusser@gmail.com>
Co-authored-by: Livio Amstutz <livio.a@gmail.com>

cmd/zitadel/authz.yaml

@@ -10,12 +10,18 @@ InternalAuthZ:
         - "iam.member.read"
         - "iam.member.write"
         - "iam.member.delete"
+        - "iam.idp.read"
+        - "iam.idp.write"
+        - "iam.idp.delete"
         - "org.read"
         - "org.create"
         - "org.write"
         - "org.member.read"
         - "org.member.write"
         - "org.member.delete"
+        - "org.idp.read"
+        - "org.idp.write"
+        - "org.idp.delete"
         - "user.read"
         - "user.write"
         - "user.delete"
@@ -55,8 +61,10 @@ InternalAuthZ:
         - "iam.read"
         - "iam.policy.read"
         - "iam.member.read"
+        - "iam.idp.read"
         - "org.read"
         - "org.member.read"
+        - "org.idp.read"
         - "user.read"
         - "user.grant.read"
         - "user.membership.read"
@@ -77,6 +85,9 @@ InternalAuthZ:
         - "org.member.read"
         - "org.member.write"
         - "org.member.delete"
+        - "org.idp.read"
+        - "org.idp.write"
+        - "org.idp.delete"
         - "user.read"
         - "user.write"
         - "user.delete"
@@ -114,6 +125,7 @@ InternalAuthZ:
       Permissions:
         - "org.read"
         - "org.member.read"
+        - "org.idp.read"
         - "user.read"
         - "user.grant.read"
         - "user.membership.read"

cmd/zitadel/caos_local.sh

@@ -21,6 +21,7 @@ gopass zitadel-secrets/zitadel/developer/default/keys.yaml > "$BASEDIR/local_key
 export ZITADEL_KEY_PATH="$BASEDIR/local_keys.yaml"
 
 export ZITADEL_USER_VERIFICATION_KEY=UserVerificationKey_1
+export ZITADEL_IDP_CONFIG_VERIFICATION_KEY=IdpConfigVerificationKey_1
 export ZITADEL_OTP_VERIFICATION_KEY=OTPVerificationKey_1
 export ZITADEL_OIDC_KEYS_ID=OIDCKey_1
 export ZITADEL_COOKIE_KEY=CookieKey_1

cmd/zitadel/setup.yaml

@@ -25,6 +25,10 @@ Eventstore:
 SetUp:
   GlobalOrg: 'Global'
   IAMProject: 'Zitadel'
+  DefaultLoginPolicy:
+    AllowUsernamePassword: true
+    AllowRegister: true
+    AllowExternalIdp: true
   Orgs:
     - Name: 'Global'
       Domain: 'global.caos.ch'

cmd/zitadel/system-defaults.yaml

@@ -6,6 +6,8 @@ SystemDefaults:
     DiscoveryEndpoint: '$ZITADEL_ISSUER/.well-known/openid-configuration'
   UserVerificationKey:
     EncryptionKeyID: $ZITADEL_USER_VERIFICATION_KEY
+  IDPConfigVerificationKey:
+    EncryptionKeyID: $ZITADEL_IDP_CONFIG_VERIFICATION_KEY
   SecretGenerators:
     PasswordSaltCost: 14
     ClientSecretGenerator: