mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-13 19:44:21 +00:00
6128c0c672
* fix: return authorizations on userinfo * fix: response type mapping * fix tests * fix angular * regenerate mgmt proto * enable login link again
440 lines
15 KiB
Go
440 lines
15 KiB
Go
package setup
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"github.com/caos/logging"
|
|
|
|
"github.com/caos/zitadel/internal/api/authz"
|
|
"github.com/caos/zitadel/internal/config/systemdefaults"
|
|
"github.com/caos/zitadel/internal/config/types"
|
|
caos_errs "github.com/caos/zitadel/internal/errors"
|
|
"github.com/caos/zitadel/internal/eventstore/models"
|
|
iam_model "github.com/caos/zitadel/internal/iam/model"
|
|
iam_event "github.com/caos/zitadel/internal/iam/repository/eventsourcing"
|
|
org_model "github.com/caos/zitadel/internal/org/model"
|
|
org_event "github.com/caos/zitadel/internal/org/repository/eventsourcing"
|
|
policy_model "github.com/caos/zitadel/internal/policy/model"
|
|
policy_event "github.com/caos/zitadel/internal/policy/repository/eventsourcing"
|
|
proj_model "github.com/caos/zitadel/internal/project/model"
|
|
proj_event "github.com/caos/zitadel/internal/project/repository/eventsourcing"
|
|
usr_model "github.com/caos/zitadel/internal/user/model"
|
|
usr_event "github.com/caos/zitadel/internal/user/repository/eventsourcing"
|
|
)
|
|
|
|
type Setup struct {
|
|
repos EventstoreRepos
|
|
iamID string
|
|
setUpConfig types.IAMSetUp
|
|
}
|
|
|
|
type EventstoreRepos struct {
|
|
IamEvents *iam_event.IamEventstore
|
|
OrgEvents *org_event.OrgEventstore
|
|
UserEvents *usr_event.UserEventstore
|
|
ProjectEvents *proj_event.ProjectEventstore
|
|
PolicyEvents *policy_event.PolicyEventstore
|
|
}
|
|
|
|
type initializer struct {
|
|
*Setup
|
|
createdUsers map[string]*usr_model.User
|
|
createdOrgs map[string]*org_model.Org
|
|
createdProjects map[string]*proj_model.Project
|
|
pwComplexityPolicy *policy_model.PasswordComplexityPolicy
|
|
}
|
|
|
|
const (
|
|
OrgOwnerRole = "ORG_OWNER"
|
|
SetupUser = "SETUP"
|
|
OIDCResponseTypeCode = "CODE"
|
|
OIDCResponseTypeIDToken = "ID_TOKEN"
|
|
OIDCResponseTypeToken = "ID_TOKEN TOKEN"
|
|
OIDCGrantTypeAuthorizationCode = "AUTHORIZATION_CODE"
|
|
OIDCGrantTypeImplicit = "IMPLICIT"
|
|
OIDCGrantTypeRefreshToken = "REFRESH_TOKEN"
|
|
OIDCApplicationTypeNative = "NATIVE"
|
|
OIDCApplicationTypeUserAgent = "USER_AGENT"
|
|
OIDCApplicationTypeWeb = "WEB"
|
|
OIDCAuthMethodTypeNone = "NONE"
|
|
OIDCAuthMethodTypeBasic = "BASIC"
|
|
OIDCAuthMethodTypePost = "POST"
|
|
)
|
|
|
|
func StartSetup(sd systemdefaults.SystemDefaults, repos EventstoreRepos) *Setup {
|
|
return &Setup{
|
|
repos: repos,
|
|
iamID: sd.IamID,
|
|
setUpConfig: sd.SetUp,
|
|
}
|
|
}
|
|
|
|
func (s *Setup) Execute(ctx context.Context) error {
|
|
iam, err := s.repos.IamEvents.IamByID(ctx, s.iamID)
|
|
if err != nil && !caos_errs.IsNotFound(err) {
|
|
return err
|
|
}
|
|
if iam != nil && iam.SetUpDone {
|
|
return nil
|
|
}
|
|
|
|
if iam != nil && iam.SetUpStarted {
|
|
return s.waitForSetupDone(ctx)
|
|
}
|
|
|
|
logging.Log("SETUP-hwG32").Info("starting setup")
|
|
ctx = setSetUpContextData(ctx, s.iamID)
|
|
iam, err = s.repos.IamEvents.StartSetup(ctx, s.iamID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
setUp := &initializer{
|
|
Setup: s,
|
|
createdUsers: make(map[string]*usr_model.User),
|
|
createdOrgs: make(map[string]*org_model.Org),
|
|
createdProjects: make(map[string]*proj_model.Project),
|
|
}
|
|
|
|
pwComplexityPolicy, err := s.repos.PolicyEvents.GetPasswordComplexityPolicy(ctx, policy_model.DefaultPolicy)
|
|
if err != nil {
|
|
logging.Log("SETUP-9osWF").WithError(err).Error("unable to read complexity policy")
|
|
return err
|
|
}
|
|
setUp.pwComplexityPolicy = pwComplexityPolicy
|
|
|
|
err = setUp.orgs(ctx, s.setUpConfig.Orgs)
|
|
if err != nil {
|
|
logging.Log("SETUP-p4oWq").WithError(err).Error("unable to set up orgs")
|
|
return err
|
|
}
|
|
|
|
ctx = setSetUpContextData(ctx, s.iamID)
|
|
err = setUp.iamOwners(ctx, s.setUpConfig.Owners)
|
|
if err != nil {
|
|
logging.Log("SETUP-WHr01").WithError(err).Error("unable to set up iam owners")
|
|
return err
|
|
}
|
|
|
|
err = setUp.setGlobalOrg(ctx)
|
|
if err != nil {
|
|
logging.Log("SETUP-0874m").WithError(err).Error("unable to set global org")
|
|
return err
|
|
}
|
|
|
|
err = setUp.setIamProject(ctx)
|
|
if err != nil {
|
|
logging.Log("SETUP-kaWjq").WithError(err).Error("unable to set zitadel project")
|
|
return err
|
|
}
|
|
|
|
iam, err = s.repos.IamEvents.SetupDone(ctx, s.iamID)
|
|
if err != nil {
|
|
logging.Log("SETUP-de342").WithError(err).Error("unable to finish setup")
|
|
return err
|
|
}
|
|
logging.Log("SETUP-ds31h").Info("setup done")
|
|
return nil
|
|
}
|
|
|
|
func (s *Setup) waitForSetupDone(ctx context.Context) error {
|
|
logging.Log("SETUP-hws22").Info("waiting for setup to be done")
|
|
ctx, cancel := context.WithDeadline(ctx, time.Now().UTC().Add(10*time.Second))
|
|
defer cancel()
|
|
|
|
for {
|
|
select {
|
|
case <-time.After(1 * time.Second):
|
|
iam, _ := s.repos.IamEvents.IamByID(ctx, s.iamID)
|
|
if iam != nil && iam.SetUpDone {
|
|
return nil
|
|
}
|
|
logging.Log("SETUP-d23g1").Info("setup not done yet")
|
|
case <-ctx.Done():
|
|
return caos_errs.ThrowInternal(ctx.Err(), "SETUP-dsjg3", "Timeout exceeded for setup")
|
|
}
|
|
}
|
|
}
|
|
|
|
func (setUp *initializer) orgs(ctx context.Context, orgs []types.Org) error {
|
|
logging.Log("SETUP-dsTh3").Info("setting up orgs")
|
|
for _, iamOrg := range orgs {
|
|
org, err := setUp.org(ctx, iamOrg)
|
|
if err != nil {
|
|
logging.LogWithFields("SETUP-IlLif", "Org", iamOrg.Name).WithError(err).Error("unable to create org")
|
|
return err
|
|
}
|
|
setUp.createdOrgs[iamOrg.Name] = org
|
|
|
|
var policy *org_model.OrgIamPolicy
|
|
if iamOrg.OrgIamPolicy {
|
|
policy, err = setUp.iamorgpolicy(ctx, org)
|
|
if err != nil {
|
|
logging.LogWithFields("SETUP-IlLif", "Org Iam Policy", iamOrg.Name).WithError(err).Error("unable to create iam org policy")
|
|
return err
|
|
}
|
|
} else {
|
|
policy, err = setUp.repos.OrgEvents.GetOrgIamPolicy(ctx, policy_model.DefaultPolicy)
|
|
if err != nil {
|
|
logging.LogWithFields("SETUP-IS8wS", "Org Iam Policy", iamOrg.Name).WithError(err).Error("unable to get default iam org policy")
|
|
return err
|
|
}
|
|
}
|
|
|
|
ctx = setSetUpContextData(ctx, org.AggregateID)
|
|
err = setUp.users(ctx, iamOrg.Users, policy)
|
|
if err != nil {
|
|
logging.LogWithFields("SETUP-8zfwz", "Org", iamOrg.Name).WithError(err).Error("unable to set up org users")
|
|
return err
|
|
}
|
|
|
|
err = setUp.orgOwners(ctx, org, iamOrg.Owners)
|
|
if err != nil {
|
|
logging.LogWithFields("SETUP-0874m", "Org", iamOrg.Name).WithError(err).Error("unable to set up org owners")
|
|
return err
|
|
}
|
|
|
|
err = setUp.projects(ctx, iamOrg.Projects)
|
|
if err != nil {
|
|
logging.LogWithFields("SETUP-wUzqY", "Org", iamOrg.Name).WithError(err).Error("unable to set up org projects")
|
|
return err
|
|
}
|
|
}
|
|
logging.Log("SETUP-dgjT4").Info("orgs set up")
|
|
return nil
|
|
}
|
|
|
|
func (setUp *initializer) org(ctx context.Context, org types.Org) (*org_model.Org, error) {
|
|
ctx = setSetUpContextData(ctx, "")
|
|
createOrg := &org_model.Org{
|
|
Name: org.Name,
|
|
Domains: []*org_model.OrgDomain{{Domain: org.Domain}},
|
|
}
|
|
return setUp.repos.OrgEvents.CreateOrg(ctx, createOrg)
|
|
}
|
|
|
|
func (setUp *initializer) iamorgpolicy(ctx context.Context, org *org_model.Org) (*org_model.OrgIamPolicy, error) {
|
|
ctx = setSetUpContextData(ctx, org.AggregateID)
|
|
policy := &org_model.OrgIamPolicy{
|
|
ObjectRoot: models.ObjectRoot{AggregateID: org.AggregateID},
|
|
UserLoginMustBeDomain: false,
|
|
}
|
|
return setUp.repos.OrgEvents.AddOrgIamPolicy(ctx, policy)
|
|
}
|
|
|
|
func (setUp *initializer) iamOwners(ctx context.Context, owners []string) error {
|
|
logging.Log("SETUP-dtxfj").Info("setting iam owners")
|
|
for _, iamOwner := range owners {
|
|
user, ok := setUp.createdUsers[iamOwner]
|
|
if !ok {
|
|
logging.LogWithFields("SETUP-8siew", "Owner", iamOwner).Error("unable to add user to iam members")
|
|
return caos_errs.ThrowPreconditionFailedf(nil, "SETUP-su6L3", "unable to add user to iam members")
|
|
}
|
|
_, err := setUp.repos.IamEvents.AddIamMember(ctx, &iam_model.IamMember{ObjectRoot: models.ObjectRoot{AggregateID: setUp.iamID}, UserID: user.AggregateID, Roles: []string{"IAM_OWNER"}})
|
|
if err != nil {
|
|
logging.Log("SETUP-LM7rI").WithError(err).Error("unable to add iam administrator to iam members as owner")
|
|
return err
|
|
}
|
|
}
|
|
logging.Log("SETUP-fg5aq").Info("iam owners set")
|
|
return nil
|
|
}
|
|
|
|
func (setUp *initializer) setGlobalOrg(ctx context.Context) error {
|
|
logging.Log("SETUP-dsj75").Info("setting global org")
|
|
globalOrg, ok := setUp.createdOrgs[setUp.setUpConfig.GlobalOrg]
|
|
if !ok {
|
|
logging.LogWithFields("SETUP-FBhs9", "GlobalOrg", setUp.setUpConfig.GlobalOrg).Error("global org not created")
|
|
return caos_errs.ThrowPreconditionFailedf(nil, "SETUP-4GwU7", "global org not created: %v", setUp.setUpConfig.GlobalOrg)
|
|
}
|
|
|
|
if _, err := setUp.repos.IamEvents.SetGlobalOrg(ctx, setUp.iamID, globalOrg.AggregateID); err != nil {
|
|
logging.Log("SETUP-uGMA3").WithError(err).Error("unable to set global org on iam")
|
|
return err
|
|
}
|
|
logging.Log("SETUP-d32h1").Info("global org set")
|
|
return nil
|
|
}
|
|
|
|
func (setUp *initializer) setIamProject(ctx context.Context) error {
|
|
logging.Log("SETUP-HE3qa").Info("setting iam project")
|
|
iamProject, ok := setUp.createdProjects[setUp.setUpConfig.IAMProject]
|
|
if !ok {
|
|
logging.LogWithFields("SETUP-SJFWP", "Iam Project", setUp.setUpConfig.IAMProject).Error("iam project created")
|
|
return caos_errs.ThrowPreconditionFailedf(nil, "SETUP-sGmQt", "iam project not created: %v", setUp.setUpConfig.IAMProject)
|
|
}
|
|
|
|
if _, err := setUp.repos.IamEvents.SetIamProject(ctx, setUp.iamID, iamProject.AggregateID); err != nil {
|
|
logging.Log("SETUP-i1pNh").WithError(err).Error("unable to set iam project on iam")
|
|
return err
|
|
}
|
|
logging.Log("SETUP-d7WEU").Info("iam project set")
|
|
return nil
|
|
}
|
|
|
|
func (setUp *initializer) users(ctx context.Context, users []types.User, orgPolicy *org_model.OrgIamPolicy) error {
|
|
for _, user := range users {
|
|
created, err := setUp.user(ctx, user, orgPolicy)
|
|
if err != nil {
|
|
logging.LogWithFields("SETUP-9soer", "Email", user.Email).WithError(err).Error("unable to create iam user")
|
|
return err
|
|
}
|
|
setUp.createdUsers[user.Email] = created
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (setUp *initializer) user(ctx context.Context, user types.User, orgPolicy *org_model.OrgIamPolicy) (*usr_model.User, error) {
|
|
createUser := &usr_model.User{
|
|
Profile: &usr_model.Profile{
|
|
UserName: user.UserName,
|
|
FirstName: user.FirstName,
|
|
LastName: user.LastName,
|
|
},
|
|
Email: &usr_model.Email{
|
|
EmailAddress: user.Email,
|
|
IsEmailVerified: true,
|
|
},
|
|
Password: &usr_model.Password{
|
|
SecretString: user.Password,
|
|
},
|
|
}
|
|
return setUp.repos.UserEvents.CreateUser(ctx, createUser, setUp.pwComplexityPolicy, orgPolicy)
|
|
}
|
|
|
|
func (setUp *initializer) orgOwners(ctx context.Context, org *org_model.Org, owners []string) error {
|
|
for _, orgOwner := range owners {
|
|
user, ok := setUp.createdUsers[orgOwner]
|
|
if !ok {
|
|
logging.LogWithFields("SETUP-s9ilr", "Owner", orgOwner).Error("unable to add user to org members")
|
|
return caos_errs.ThrowPreconditionFailedf(nil, "SETUP-s0prs", "unable to add user to org members: %v", orgOwner)
|
|
}
|
|
err := setUp.orgOwner(ctx, org, user)
|
|
if err != nil {
|
|
logging.Log("SETUP-s90oe").WithError(err).Error("unable to add global org admin to members of global org")
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (setUp *initializer) orgOwner(ctx context.Context, org *org_model.Org, user *usr_model.User) error {
|
|
addMember := &org_model.OrgMember{
|
|
ObjectRoot: models.ObjectRoot{AggregateID: org.AggregateID},
|
|
UserID: user.AggregateID,
|
|
Roles: []string{OrgOwnerRole},
|
|
}
|
|
_, err := setUp.repos.OrgEvents.AddOrgMember(ctx, addMember)
|
|
return err
|
|
}
|
|
|
|
func (setUp *initializer) projects(ctx context.Context, projects []types.Project) error {
|
|
for _, project := range projects {
|
|
createdProject, err := setUp.project(ctx, project)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
setUp.createdProjects[createdProject.Name] = createdProject
|
|
for _, oidc := range project.OIDCApps {
|
|
app, err := setUp.oidcApp(ctx, createdProject, oidc)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
logging.LogWithFields("SETUP-asd32f", "name", app.Name, "clientID", app.OIDCConfig.ClientID).Info("created OIDC application")
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (setUp *initializer) project(ctx context.Context, project types.Project) (*proj_model.Project, error) {
|
|
addProject := &proj_model.Project{
|
|
Name: project.Name,
|
|
}
|
|
return setUp.repos.ProjectEvents.CreateProject(ctx, addProject)
|
|
}
|
|
|
|
func (setUp *initializer) oidcApp(ctx context.Context, project *proj_model.Project, oidc types.OIDCApp) (*proj_model.Application, error) {
|
|
addOIDCApp := &proj_model.Application{
|
|
ObjectRoot: models.ObjectRoot{AggregateID: project.AggregateID},
|
|
Name: oidc.Name,
|
|
OIDCConfig: &proj_model.OIDCConfig{
|
|
RedirectUris: oidc.RedirectUris,
|
|
ResponseTypes: getOIDCResponseTypes(oidc.ResponseTypes),
|
|
GrantTypes: getOIDCGrantTypes(oidc.GrantTypes),
|
|
ApplicationType: getOIDCApplicationType(oidc.ApplicationType),
|
|
AuthMethodType: getOIDCAuthMethod(oidc.AuthMethodType),
|
|
PostLogoutRedirectUris: oidc.PostLogoutRedirectUris,
|
|
},
|
|
}
|
|
return setUp.repos.ProjectEvents.AddApplication(ctx, addOIDCApp)
|
|
}
|
|
|
|
func getOIDCResponseTypes(responseTypes []string) []proj_model.OIDCResponseType {
|
|
types := make([]proj_model.OIDCResponseType, len(responseTypes))
|
|
for i, t := range responseTypes {
|
|
types[i] = getOIDCResponseType(t)
|
|
}
|
|
return types
|
|
}
|
|
|
|
func getOIDCResponseType(responseType string) proj_model.OIDCResponseType {
|
|
switch responseType {
|
|
case OIDCResponseTypeCode:
|
|
return proj_model.OIDCResponseTypeCode
|
|
case OIDCResponseTypeIDToken:
|
|
return proj_model.OIDCResponseTypeIDToken
|
|
case OIDCResponseTypeToken:
|
|
return proj_model.OIDCResponseTypeIDTokenToken
|
|
}
|
|
return proj_model.OIDCResponseTypeCode
|
|
}
|
|
|
|
func getOIDCGrantTypes(grantTypes []string) []proj_model.OIDCGrantType {
|
|
types := make([]proj_model.OIDCGrantType, len(grantTypes))
|
|
for i, t := range grantTypes {
|
|
types[i] = getOIDCGrantType(t)
|
|
}
|
|
return types
|
|
}
|
|
|
|
func getOIDCGrantType(grantTypes string) proj_model.OIDCGrantType {
|
|
switch grantTypes {
|
|
case OIDCGrantTypeAuthorizationCode:
|
|
return proj_model.OIDCGrantTypeAuthorizationCode
|
|
case OIDCGrantTypeImplicit:
|
|
return proj_model.OIDCGrantTypeImplicit
|
|
case OIDCGrantTypeRefreshToken:
|
|
return proj_model.OIDCGrantTypeRefreshToken
|
|
}
|
|
return proj_model.OIDCGrantTypeAuthorizationCode
|
|
}
|
|
|
|
func getOIDCApplicationType(appType string) proj_model.OIDCApplicationType {
|
|
switch appType {
|
|
case OIDCApplicationTypeNative:
|
|
return proj_model.OIDCApplicationTypeNative
|
|
case OIDCApplicationTypeUserAgent:
|
|
return proj_model.OIDCApplicationTypeUserAgent
|
|
case OIDCApplicationTypeWeb:
|
|
return proj_model.OIDCApplicationTypeWeb
|
|
}
|
|
return proj_model.OIDCApplicationTypeWeb
|
|
}
|
|
|
|
func getOIDCAuthMethod(authMethod string) proj_model.OIDCAuthMethodType {
|
|
switch authMethod {
|
|
case OIDCAuthMethodTypeNone:
|
|
return proj_model.OIDCAuthMethodTypeNone
|
|
case OIDCAuthMethodTypeBasic:
|
|
return proj_model.OIDCAuthMethodTypeBasic
|
|
case OIDCAuthMethodTypePost:
|
|
return proj_model.OIDCAuthMethodTypePost
|
|
}
|
|
return proj_model.OIDCAuthMethodTypeNone
|
|
}
|
|
|
|
func setSetUpContextData(ctx context.Context, orgID string) context.Context {
|
|
return authz.SetCtxData(ctx, authz.CtxData{UserID: SetupUser, OrgID: orgID})
|
|
}
|