feat: idp and login policy configurations (#619)

* feat: oidc config * fix: oidc configurations * feat: oidc idp config * feat: add oidc config test * fix: tests * fix: tests * feat: translate new events * feat: idp eventstore * feat: idp eventstore * fix: tests * feat: command side idp * feat: query side idp * feat: idp config on org * fix: tests * feat: authz idp on org * feat: org idps * feat: login policy * feat: login policy * feat: login policy * feat: add idp func on login policy * feat: add validation to loginpolicy and idp provider * feat: add default login policy * feat: login policy on org * feat: login policy on org * fix: id config handlers * fix: id config handlers * fix: create idp on org * fix: create idp on org * fix: not existing idp config * fix: default login policy * fix: add login policy on org * fix: idp provider search on org * fix: test * fix: remove idp on org * fix: test * fix: test * fix: remove admin idp * fix: logo src as byte * fix: migration * fix: tests * Update internal/iam/repository/eventsourcing/iam.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/iam_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/iam_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/model/login_policy.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/model/login_policy.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/org/repository/eventsourcing/org_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/model/login_policy_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/iam/repository/eventsourcing/model/login_policy_test.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * fix: pr comments * fix: tests * Update types.go * fix: merge request changes * fix: reduce optimization Co-authored-by: Silvan <silvan.reusser@gmail.com> Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2025-08-12 08:07:32 +00:00 · 2020-08-26 09:56:23 +02:00
parent f05c5bae24
commit db1d8f4efe
157 changed files with 37510 additions and 15698 deletions
--- a/internal/iam/repository/view/model/iam_member.go
+++ b/internal/iam/repository/view/model/iam_member.go
@@ -14,17 +14,17 @@ import (
 )

 const (
-	IamMemberKeyUserID    = "user_id"
-	IamMemberKeyIamID     = "iam_id"
-	IamMemberKeyUserName  = "user_name"
-	IamMemberKeyEmail     = "email"
-	IamMemberKeyFirstName = "first_name"
-	IamMemberKeyLastName  = "last_name"
+	IAMMemberKeyUserID    = "user_id"
+	IAMMemberKeyIamID     = "iam_id"
+	IAMMemberKeyUserName  = "user_name"
+	IAMMemberKeyEmail     = "email"
+	IAMMemberKeyFirstName = "first_name"
+	IAMMemberKeyLastName  = "last_name"
 )

-type IamMemberView struct {
+type IAMMemberView struct {
 	UserID      string         `json:"userId" gorm:"column:user_id;primary_key"`
-	IamID       string         `json:"-" gorm:"column:iam_id"`
+	IAMID       string         `json:"-" gorm:"column:iam_id"`
 	UserName    string         `json:"-" gorm:"column:user_name"`
 	Email       string         `json:"-" gorm:"column:email_address"`
 	FirstName   string         `json:"-" gorm:"column:first_name"`
@@ -37,10 +37,10 @@ type IamMemberView struct {
 	ChangeDate   time.Time `json:"-" gorm:"column:change_date"`
 }

-func IamMemberViewFromModel(member *model.IamMemberView) *IamMemberView {
-	return &IamMemberView{
+func IAMMemberViewFromModel(member *model.IAMMemberView) *IAMMemberView {
+	return &IAMMemberView{
 		UserID:       member.UserID,
-		IamID:        member.IamID,
+		IAMID:        member.IAMID,
 		UserName:     member.UserName,
 		Email:        member.Email,
 		FirstName:    member.FirstName,
@@ -53,10 +53,10 @@ func IamMemberViewFromModel(member *model.IamMemberView) *IamMemberView {
 	}
 }

-func IamMemberToModel(member *IamMemberView) *model.IamMemberView {
-	return &model.IamMemberView{
+func IAMMemberToModel(member *IAMMemberView) *model.IAMMemberView {
+	return &model.IAMMemberView{
 		UserID:       member.UserID,
-		IamID:        member.IamID,
+		IAMID:        member.IAMID,
 		UserName:     member.UserName,
 		Email:        member.Email,
 		FirstName:    member.FirstName,
@@ -69,33 +69,33 @@ func IamMemberToModel(member *IamMemberView) *model.IamMemberView {
 	}
 }

-func IamMembersToModel(roles []*IamMemberView) []*model.IamMemberView {
-	result := make([]*model.IamMemberView, len(roles))
+func IAMMembersToModel(roles []*IAMMemberView) []*model.IAMMemberView {
+	result := make([]*model.IAMMemberView, len(roles))
 	for i, r := range roles {
-		result[i] = IamMemberToModel(r)
+		result[i] = IAMMemberToModel(r)
 	}
 	return result
 }

-func (r *IamMemberView) AppendEvent(event *models.Event) (err error) {
+func (r *IAMMemberView) AppendEvent(event *models.Event) (err error) {
 	r.Sequence = event.Sequence
 	r.ChangeDate = event.CreationDate
 	switch event.Type {
-	case es_model.IamMemberAdded:
+	case es_model.IAMMemberAdded:
 		r.setRootData(event)
 		r.CreationDate = event.CreationDate
 		err = r.SetData(event)
-	case es_model.IamMemberChanged:
+	case es_model.IAMMemberChanged:
 		err = r.SetData(event)
 	}
 	return err
 }

-func (r *IamMemberView) setRootData(event *models.Event) {
-	r.IamID = event.AggregateID
+func (r *IAMMemberView) setRootData(event *models.Event) {
+	r.IAMID = event.AggregateID
 }

-func (r *IamMemberView) SetData(event *models.Event) error {
+func (r *IAMMemberView) SetData(event *models.Event) error {
 	if err := json.Unmarshal(event.Data, r); err != nil {
 		logging.Log("EVEN-Psl89").WithError(err).Error("could not unmarshal event data")
 		return caos_errs.ThrowInternal(err, "MODEL-lub6s", "Could not unmarshal data")
--- a/internal/iam/repository/view/model/iam_member_query.go
+++ b/internal/iam/repository/view/model/iam_member_query.go
@@ -6,63 +6,63 @@ import (
 	"github.com/caos/zitadel/internal/view/repository"
 )

-type IamMemberSearchRequest iam_model.IamMemberSearchRequest
-type IamMemberSearchQuery iam_model.IamMemberSearchQuery
-type IamMemberSearchKey iam_model.IamMemberSearchKey
+type IAMMemberSearchRequest iam_model.IAMMemberSearchRequest
+type IAMMemberSearchQuery iam_model.IAMMemberSearchQuery
+type IAMMemberSearchKey iam_model.IAMMemberSearchKey

-func (req IamMemberSearchRequest) GetLimit() uint64 {
+func (req IAMMemberSearchRequest) GetLimit() uint64 {
 	return req.Limit
 }

-func (req IamMemberSearchRequest) GetOffset() uint64 {
+func (req IAMMemberSearchRequest) GetOffset() uint64 {
 	return req.Offset
 }

-func (req IamMemberSearchRequest) GetSortingColumn() repository.ColumnKey {
-	if req.SortingColumn == iam_model.IamMemberSearchKeyUnspecified {
+func (req IAMMemberSearchRequest) GetSortingColumn() repository.ColumnKey {
+	if req.SortingColumn == iam_model.IAMMemberSearchKeyUnspecified {
 		return nil
 	}
-	return IamMemberSearchKey(req.SortingColumn)
+	return IAMMemberSearchKey(req.SortingColumn)
 }

-func (req IamMemberSearchRequest) GetAsc() bool {
+func (req IAMMemberSearchRequest) GetAsc() bool {
 	return req.Asc
 }

-func (req IamMemberSearchRequest) GetQueries() []repository.SearchQuery {
+func (req IAMMemberSearchRequest) GetQueries() []repository.SearchQuery {
 	result := make([]repository.SearchQuery, len(req.Queries))
 	for i, q := range req.Queries {
-		result[i] = IamMemberSearchQuery{Key: q.Key, Value: q.Value, Method: q.Method}
+		result[i] = IAMMemberSearchQuery{Key: q.Key, Value: q.Value, Method: q.Method}
 	}
 	return result
 }

-func (req IamMemberSearchQuery) GetKey() repository.ColumnKey {
-	return IamMemberSearchKey(req.Key)
+func (req IAMMemberSearchQuery) GetKey() repository.ColumnKey {
+	return IAMMemberSearchKey(req.Key)
 }

-func (req IamMemberSearchQuery) GetMethod() global_model.SearchMethod {
+func (req IAMMemberSearchQuery) GetMethod() global_model.SearchMethod {
 	return req.Method
 }

-func (req IamMemberSearchQuery) GetValue() interface{} {
+func (req IAMMemberSearchQuery) GetValue() interface{} {
 	return req.Value
 }

-func (key IamMemberSearchKey) ToColumnName() string {
-	switch iam_model.IamMemberSearchKey(key) {
-	case iam_model.IamMemberSearchKeyEmail:
-		return IamMemberKeyEmail
-	case iam_model.IamMemberSearchKeyFirstName:
-		return IamMemberKeyFirstName
-	case iam_model.IamMemberSearchKeyLastName:
-		return IamMemberKeyLastName
-	case iam_model.IamMemberSearchKeyUserName:
-		return IamMemberKeyUserName
-	case iam_model.IamMemberSearchKeyUserID:
-		return IamMemberKeyUserID
-	case iam_model.IamMemberSearchKeyIamID:
-		return IamMemberKeyIamID
+func (key IAMMemberSearchKey) ToColumnName() string {
+	switch iam_model.IAMMemberSearchKey(key) {
+	case iam_model.IAMMemberSearchKeyEmail:
+		return IAMMemberKeyEmail
+	case iam_model.IAMMemberSearchKeyFirstName:
+		return IAMMemberKeyFirstName
+	case iam_model.IAMMemberSearchKeyLastName:
+		return IAMMemberKeyLastName
+	case iam_model.IAMMemberSearchKeyUserName:
+		return IAMMemberKeyUserName
+	case iam_model.IAMMemberSearchKeyUserID:
+		return IAMMemberKeyUserID
+	case iam_model.IAMMemberSearchKeyIamID:
+		return IAMMemberKeyIamID
 	default:
 		return ""
 	}
--- a/internal/iam/repository/view/model/idp_config.go
+++ b/internal/iam/repository/view/model/idp_config.go
@@ -0,0 +1,121 @@
+package model
+
+import (
+	"encoding/json"
+	"github.com/caos/zitadel/internal/crypto"
+	"time"
+
+	es_model "github.com/caos/zitadel/internal/iam/repository/eventsourcing/model"
+	org_es_model "github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
+
+	"github.com/caos/logging"
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/iam/model"
+	"github.com/lib/pq"
+)
+
+const (
+	IDPConfigKeyIdpConfigID  = "idp_config_id"
+	IDPConfigKeyAggregateID  = "aggregate_id"
+	IDPConfigKeyName         = "name"
+	IDPConfigKeyProviderType = "idp_provider_type"
+)
+
+type IDPConfigView struct {
+	IDPConfigID     string    `json:"idpConfigId" gorm:"column:idp_config_id;primary_key"`
+	AggregateID     string    `json:"-" gorm:"column:aggregate_id"`
+	Name            string    `json:"name" gorm:"column:name"`
+	LogoSrc         []byte    `json:"logoSrc" gorm:"column:logo_src"`
+	CreationDate    time.Time `json:"-" gorm:"column:creation_date"`
+	ChangeDate      time.Time `json:"-" gorm:"column:change_date"`
+	IDPState        int32     `json:"-" gorm:"column:idp_state"`
+	IDPProviderType int32     `json:"-" gorm:"column:idp_provider_type"`
+
+	IsOIDC           bool                `json:"-" gorm:"column:is_oidc"`
+	OIDCClientID     string              `json:"clientId" gorm:"column:oidc_client_id"`
+	OIDCClientSecret *crypto.CryptoValue `json:"clientSecret" gorm:"column:oidc_client_secret"`
+	OIDCIssuer       string              `json:"issuer" gorm:"column:oidc_issuer"`
+	OIDCScopes       pq.StringArray      `json:"scopes" gorm:"column:oidc_scopes"`
+
+	Sequence uint64 `json:"-" gorm:"column:sequence"`
+}
+
+func IDPConfigViewFromModel(idp *model.IDPConfigView) *IDPConfigView {
+	return &IDPConfigView{
+		IDPConfigID:      idp.IDPConfigID,
+		AggregateID:      idp.AggregateID,
+		Name:             idp.Name,
+		LogoSrc:          idp.LogoSrc,
+		Sequence:         idp.Sequence,
+		CreationDate:     idp.CreationDate,
+		ChangeDate:       idp.ChangeDate,
+		IDPProviderType:  int32(idp.IDPProviderType),
+		IsOIDC:           idp.IsOIDC,
+		OIDCClientID:     idp.OIDCClientID,
+		OIDCClientSecret: idp.OIDCClientSecret,
+		OIDCIssuer:       idp.OIDCIssuer,
+		OIDCScopes:       idp.OIDCScopes,
+	}
+}
+
+func IdpConfigViewToModel(idp *IDPConfigView) *model.IDPConfigView {
+	return &model.IDPConfigView{
+		IDPConfigID:      idp.IDPConfigID,
+		AggregateID:      idp.AggregateID,
+		Name:             idp.Name,
+		LogoSrc:          idp.LogoSrc,
+		Sequence:         idp.Sequence,
+		CreationDate:     idp.CreationDate,
+		ChangeDate:       idp.ChangeDate,
+		IDPProviderType:  model.IDPProviderType(idp.IDPProviderType),
+		IsOIDC:           idp.IsOIDC,
+		OIDCClientID:     idp.OIDCClientID,
+		OIDCClientSecret: idp.OIDCClientSecret,
+		OIDCIssuer:       idp.OIDCIssuer,
+		OIDCScopes:       idp.OIDCScopes,
+	}
+}
+
+func IdpConfigViewsToModel(idps []*IDPConfigView) []*model.IDPConfigView {
+	result := make([]*model.IDPConfigView, len(idps))
+	for i, idp := range idps {
+		result[i] = IdpConfigViewToModel(idp)
+	}
+	return result
+}
+
+func (i *IDPConfigView) AppendEvent(providerType model.IDPProviderType, event *models.Event) (err error) {
+	i.Sequence = event.Sequence
+	i.ChangeDate = event.CreationDate
+	switch event.Type {
+	case es_model.IDPConfigAdded, org_es_model.IDPConfigAdded:
+		i.setRootData(event)
+		i.CreationDate = event.CreationDate
+		i.IDPProviderType = int32(providerType)
+		err = i.SetData(event)
+	case es_model.OIDCIDPConfigAdded, org_es_model.OIDCIDPConfigAdded:
+		i.IsOIDC = true
+		err = i.SetData(event)
+	case es_model.OIDCIDPConfigChanged, org_es_model.OIDCIDPConfigChanged,
+		es_model.IDPConfigChanged, org_es_model.IDPConfigChanged:
+		err = i.SetData(event)
+	case es_model.IDPConfigDeactivated, org_es_model.IDPConfigDeactivated:
+		i.IDPState = int32(model.IDPConfigStateInactive)
+	case es_model.IDPConfigReactivated, org_es_model.IDPConfigReactivated:
+		i.IDPState = int32(model.IDPConfigStateActive)
+	}
+	return err
+}
+
+func (r *IDPConfigView) setRootData(event *models.Event) {
+	r.AggregateID = event.AggregateID
+}
+
+func (r *IDPConfigView) SetData(event *models.Event) error {
+	if err := json.Unmarshal(event.Data, r); err != nil {
+		logging.Log("EVEN-Smkld").WithError(err).Error("could not unmarshal event data")
+		return caos_errs.ThrowInternal(err, "MODEL-lub6s", "Could not unmarshal data")
+	}
+	return nil
+}
--- a/internal/iam/repository/view/model/idp_config_query.go
+++ b/internal/iam/repository/view/model/idp_config_query.go
@@ -0,0 +1,65 @@
+package model
+
+import (
+	iam_model "github.com/caos/zitadel/internal/iam/model"
+	global_model "github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/view/repository"
+)
+
+type IDPConfigSearchRequest iam_model.IDPConfigSearchRequest
+type IDPConfigSearchQuery iam_model.IDPConfigSearchQuery
+type IDPConfigSearchKey iam_model.IDPConfigSearchKey
+
+func (req IDPConfigSearchRequest) GetLimit() uint64 {
+	return req.Limit
+}
+
+func (req IDPConfigSearchRequest) GetOffset() uint64 {
+	return req.Offset
+}
+
+func (req IDPConfigSearchRequest) GetSortingColumn() repository.ColumnKey {
+	if req.SortingColumn == iam_model.IDPConfigSearchKeyUnspecified {
+		return nil
+	}
+	return IDPConfigSearchKey(req.SortingColumn)
+}
+
+func (req IDPConfigSearchRequest) GetAsc() bool {
+	return req.Asc
+}
+
+func (req IDPConfigSearchRequest) GetQueries() []repository.SearchQuery {
+	result := make([]repository.SearchQuery, len(req.Queries))
+	for i, q := range req.Queries {
+		result[i] = IDPConfigSearchQuery{Key: q.Key, Value: q.Value, Method: q.Method}
+	}
+	return result
+}
+
+func (req IDPConfigSearchQuery) GetKey() repository.ColumnKey {
+	return IDPConfigSearchKey(req.Key)
+}
+
+func (req IDPConfigSearchQuery) GetMethod() global_model.SearchMethod {
+	return req.Method
+}
+
+func (req IDPConfigSearchQuery) GetValue() interface{} {
+	return req.Value
+}
+
+func (key IDPConfigSearchKey) ToColumnName() string {
+	switch iam_model.IDPConfigSearchKey(key) {
+	case iam_model.IDPConfigSearchKeyAggregateID:
+		return IDPConfigKeyAggregateID
+	case iam_model.IDPConfigSearchKeyIdpConfigID:
+		return IDPConfigKeyIdpConfigID
+	case iam_model.IDPConfigSearchKeyName:
+		return IDPConfigKeyName
+	case iam_model.IDPConfigSearchKeyIdpProviderType:
+		return IDPConfigKeyProviderType
+	default:
+		return ""
+	}
+}
--- a/internal/iam/repository/view/model/idp_provider.go
+++ b/internal/iam/repository/view/model/idp_provider.go
@@ -0,0 +1,89 @@
+package model
+
+import (
+	"encoding/json"
+	org_es_model "github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
+	"time"
+
+	es_model "github.com/caos/zitadel/internal/iam/repository/eventsourcing/model"
+
+	"github.com/caos/logging"
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/iam/model"
+)
+
+const (
+	IDPProviderKeyAggregateID = "aggregate_id"
+	IDPProviderKeyIdpConfigID = "idp_config_id"
+)
+
+type IDPProviderView struct {
+	AggregateID string `json:"-" gorm:"column:aggregate_id;primary_key"`
+	IDPConfigID string `json:"idpConfigID" gorm:"column:idp_config_id;primary_key"`
+
+	CreationDate time.Time `json:"-" gorm:"column:creation_date"`
+	ChangeDate   time.Time `json:"-" gorm:"column:change_date"`
+
+	Name            string `json:"-" gorm:"column:name"`
+	IDPConfigType   int32  `json:"-" gorm:"column:idp_config_type"`
+	IDPProviderType int32  `json:"idpProviderType" gorm:"column:idp_provider_type"`
+
+	Sequence uint64 `json:"-" gorm:"column:sequence"`
+}
+
+func IDPProviderViewFromModel(policy *model.IDPProviderView) *IDPProviderView {
+	return &IDPProviderView{
+		AggregateID:     policy.AggregateID,
+		Sequence:        policy.Sequence,
+		CreationDate:    policy.CreationDate,
+		ChangeDate:      policy.ChangeDate,
+		Name:            policy.Name,
+		IDPConfigType:   int32(policy.IDPConfigType),
+		IDPProviderType: int32(policy.IDPProviderType),
+	}
+}
+
+func IDPProviderViewToModel(policy *IDPProviderView) *model.IDPProviderView {
+	return &model.IDPProviderView{
+		AggregateID:     policy.AggregateID,
+		Sequence:        policy.Sequence,
+		CreationDate:    policy.CreationDate,
+		ChangeDate:      policy.ChangeDate,
+		Name:            policy.Name,
+		IDPConfigType:   model.IdpConfigType(policy.IDPConfigType),
+		IDPProviderType: model.IDPProviderType(policy.IDPProviderType),
+	}
+}
+
+func IDPProviderViewsToModel(providers []*IDPProviderView) []*model.IDPProviderView {
+	result := make([]*model.IDPProviderView, len(providers))
+	for i, r := range providers {
+		result[i] = IDPProviderViewToModel(r)
+	}
+	return result
+}
+
+func (i *IDPProviderView) AppendEvent(event *models.Event) (err error) {
+	i.Sequence = event.Sequence
+	i.ChangeDate = event.CreationDate
+	switch event.Type {
+	case es_model.LoginPolicyIDPProviderAdded, org_es_model.LoginPolicyIDPProviderAdded:
+		i.setRootData(event)
+		i.CreationDate = event.CreationDate
+		err = i.SetData(event)
+	}
+	return err
+}
+
+func (r *IDPProviderView) setRootData(event *models.Event) {
+	r.AggregateID = event.AggregateID
+}
+
+func (r *IDPProviderView) SetData(event *models.Event) error {
+	if err := json.Unmarshal(event.Data, r); err != nil {
+		logging.Log("EVEN-Lso0d").WithError(err).Error("could not unmarshal event data")
+		return caos_errs.ThrowInternal(err, "MODEL-Hs8uf", "Could not unmarshal data")
+	}
+	return nil
+}
--- a/internal/iam/repository/view/model/idp_provider_query.go
+++ b/internal/iam/repository/view/model/idp_provider_query.go
@@ -0,0 +1,61 @@
+package model
+
+import (
+	iam_model "github.com/caos/zitadel/internal/iam/model"
+	global_model "github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/view/repository"
+)
+
+type IDPProviderSearchRequest iam_model.IDPProviderSearchRequest
+type IDPProviderSearchQuery iam_model.IDPProviderSearchQuery
+type IDPProviderSearchKey iam_model.IDPProviderSearchKey
+
+func (req IDPProviderSearchRequest) GetLimit() uint64 {
+	return req.Limit
+}
+
+func (req IDPProviderSearchRequest) GetOffset() uint64 {
+	return req.Offset
+}
+
+func (req IDPProviderSearchRequest) GetSortingColumn() repository.ColumnKey {
+	if req.SortingColumn == iam_model.IDPProviderSearchKeyUnspecified {
+		return nil
+	}
+	return IDPProviderSearchKey(req.SortingColumn)
+}
+
+func (req IDPProviderSearchRequest) GetAsc() bool {
+	return req.Asc
+}
+
+func (req IDPProviderSearchRequest) GetQueries() []repository.SearchQuery {
+	result := make([]repository.SearchQuery, len(req.Queries))
+	for i, q := range req.Queries {
+		result[i] = IDPProviderSearchQuery{Key: q.Key, Value: q.Value, Method: q.Method}
+	}
+	return result
+}
+
+func (req IDPProviderSearchQuery) GetKey() repository.ColumnKey {
+	return IDPProviderSearchKey(req.Key)
+}
+
+func (req IDPProviderSearchQuery) GetMethod() global_model.SearchMethod {
+	return req.Method
+}
+
+func (req IDPProviderSearchQuery) GetValue() interface{} {
+	return req.Value
+}
+
+func (key IDPProviderSearchKey) ToColumnName() string {
+	switch iam_model.IDPProviderSearchKey(key) {
+	case iam_model.IDPProviderSearchKeyAggregateID:
+		return IDPProviderKeyAggregateID
+	case iam_model.IDPProviderSearchKeyIdpConfigID:
+		return IDPProviderKeyIdpConfigID
+	default:
+		return ""
+	}
+}
--- a/internal/iam/repository/view/model/login_policy.go
+++ b/internal/iam/repository/view/model/login_policy.go
@@ -0,0 +1,84 @@
+package model
+
+import (
+	"encoding/json"
+	org_es_model "github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
+	"time"
+
+	es_model "github.com/caos/zitadel/internal/iam/repository/eventsourcing/model"
+
+	"github.com/caos/logging"
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/iam/model"
+)
+
+const (
+	LoginPolicyKeyAggregateID = "aggregate_id"
+)
+
+type LoginPolicyView struct {
+	AggregateID  string    `json:"-" gorm:"column:aggregate_id;primary_key"`
+	CreationDate time.Time `json:"-" gorm:"column:creation_date"`
+	ChangeDate   time.Time `json:"-" gorm:"column:change_date"`
+	State        int32     `json:"-" gorm:"column:login_policy_state"`
+
+	AllowRegister         bool `json:"allowRegister" gorm:"column:allow_register"`
+	AllowUsernamePassword bool `json:"allowUsernamePassword" gorm:"column:allow_username_password"`
+	AllowExternalIDP      bool `json:"allowExternalIdp" gorm:"column:allow_external_idp"`
+	Default               bool `json:"-" gorm:"-"`
+
+	Sequence uint64 `json:"-" gorm:"column:sequence"`
+}
+
+func LoginPolicyViewFromModel(policy *model.LoginPolicyView) *LoginPolicyView {
+	return &LoginPolicyView{
+		AggregateID:           policy.AggregateID,
+		Sequence:              policy.Sequence,
+		CreationDate:          policy.CreationDate,
+		ChangeDate:            policy.ChangeDate,
+		AllowRegister:         policy.AllowRegister,
+		AllowExternalIDP:      policy.AllowExternalIDP,
+		AllowUsernamePassword: policy.AllowUsernamePassword,
+		Default:               policy.Default,
+	}
+}
+
+func LoginPolicyViewToModel(policy *LoginPolicyView) *model.LoginPolicyView {
+	return &model.LoginPolicyView{
+		AggregateID:           policy.AggregateID,
+		Sequence:              policy.Sequence,
+		CreationDate:          policy.CreationDate,
+		ChangeDate:            policy.ChangeDate,
+		AllowRegister:         policy.AllowRegister,
+		AllowExternalIDP:      policy.AllowExternalIDP,
+		AllowUsernamePassword: policy.AllowUsernamePassword,
+		Default:               policy.Default,
+	}
+}
+
+func (i *LoginPolicyView) AppendEvent(event *models.Event) (err error) {
+	i.Sequence = event.Sequence
+	i.ChangeDate = event.CreationDate
+	switch event.Type {
+	case es_model.LoginPolicyAdded, org_es_model.LoginPolicyAdded:
+		i.setRootData(event)
+		i.CreationDate = event.CreationDate
+		err = i.SetData(event)
+	case es_model.LoginPolicyChanged, org_es_model.LoginPolicyChanged:
+		err = i.SetData(event)
+	}
+	return err
+}
+
+func (r *LoginPolicyView) setRootData(event *models.Event) {
+	r.AggregateID = event.AggregateID
+}
+
+func (r *LoginPolicyView) SetData(event *models.Event) error {
+	if err := json.Unmarshal(event.Data, r); err != nil {
+		logging.Log("EVEN-Kn7ds").WithError(err).Error("could not unmarshal event data")
+		return caos_errs.ThrowInternal(err, "MODEL-Hs8uf", "Could not unmarshal data")
+	}
+	return nil
+}
--- a/internal/iam/repository/view/model/login_policy_query.go
+++ b/internal/iam/repository/view/model/login_policy_query.go
@@ -0,0 +1,59 @@
+package model
+
+import (
+	iam_model "github.com/caos/zitadel/internal/iam/model"
+	global_model "github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/view/repository"
+)
+
+type LoginPolicySearchRequest iam_model.LoginPolicySearchRequest
+type LoginPolicySearchQuery iam_model.LoginPolicySearchQuery
+type LoginPolicySearchKey iam_model.LoginPolicySearchKey
+
+func (req LoginPolicySearchRequest) GetLimit() uint64 {
+	return req.Limit
+}
+
+func (req LoginPolicySearchRequest) GetOffset() uint64 {
+	return req.Offset
+}
+
+func (req LoginPolicySearchRequest) GetSortingColumn() repository.ColumnKey {
+	if req.SortingColumn == iam_model.LoginPolicySearchKeyUnspecified {
+		return nil
+	}
+	return LoginPolicySearchKey(req.SortingColumn)
+}
+
+func (req LoginPolicySearchRequest) GetAsc() bool {
+	return req.Asc
+}
+
+func (req LoginPolicySearchRequest) GetQueries() []repository.SearchQuery {
+	result := make([]repository.SearchQuery, len(req.Queries))
+	for i, q := range req.Queries {
+		result[i] = LoginPolicySearchQuery{Key: q.Key, Value: q.Value, Method: q.Method}
+	}
+	return result
+}
+
+func (req LoginPolicySearchQuery) GetKey() repository.ColumnKey {
+	return LoginPolicySearchKey(req.Key)
+}
+
+func (req LoginPolicySearchQuery) GetMethod() global_model.SearchMethod {
+	return req.Method
+}
+
+func (req LoginPolicySearchQuery) GetValue() interface{} {
+	return req.Value
+}
+
+func (key LoginPolicySearchKey) ToColumnName() string {
+	switch iam_model.LoginPolicySearchKey(key) {
+	case iam_model.LoginPolicySearchKeyAggregateID:
+		return LoginPolicyKeyAggregateID
+	default:
+		return ""
+	}
+}