Skip to content

Adding support for allowed groups in SAML Connector#1544

Merged
bonifaido merged 1 commit into
dexidp:masterfrom
kenperkins:saml-groups
Oct 30, 2019
Merged

Adding support for allowed groups in SAML Connector#1544
bonifaido merged 1 commit into
dexidp:masterfrom
kenperkins:saml-groups

Conversation

@kenperkins
Copy link
Copy Markdown
Contributor

@kenperkins kenperkins commented Sep 10, 2019

I'm not suggesting this should be taken as is, but I wanted to use it as a conversation starter on adding SAML support for group filtering. This is based on conversation in #1476

I thought briefly about a generalized approach but right now I just wanted to get a primitive implementation vetted and ideally merged, and then follow that with figuring out what it looks like across providers.

Obviously, there are no tests or docs in this change.

@kenperkins kenperkins force-pushed the saml-groups branch 2 times, most recently from 6e2fd5c to 827f3bb Compare September 10, 2019 13:33
@kenperkins
Copy link
Copy Markdown
Contributor Author

I've now added a few tests that test the groups behavior for SAML:

  • TestGroupsWhitelist (User should be allowed)
  • TestGroupsWhitelistEmpty (Empty groups whitelist)
  • TestGroupsWhitelistDisallowed (User not allowed)
  • TestGroupsWhitelistDisallowedNoGroupsOnIdent (User has no groups from saml backend)

@kenperkins
Copy link
Copy Markdown
Contributor Author

I've added docs with my latest commit.

Copy link
Copy Markdown
Contributor

@srenatus srenatus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for looking into this. You're right, there's no harm done in adding this before (or even without) harmonizing the groups filtering code among different connectors.

One inline comment, but this looks great 🚀

Comment thread connector/saml/saml.go Outdated
Copy link
Copy Markdown
Contributor

@srenatus srenatus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 😃

@srenatus
Copy link
Copy Markdown
Contributor

A bird in the hand is worth two in the bush, so let's get this in and keep the refactor briefly discussed in #1476 in mind.

@kenperkins I'd like to get another maintainer to approve this; and would you mind squashing these commits? 😃

@kenperkins
Copy link
Copy Markdown
Contributor Author

You need me to squash before merge? Do you not squash/merge as part of GH merge button? (That's fine, just looking for clarity).

@srenatus
Copy link
Copy Markdown
Contributor

srenatus commented Sep 10, 2019 via email

@kenperkins
Copy link
Copy Markdown
Contributor Author

I'm not sure you're waiting on me, I'm totally ok with my commits to be squashed, if you need me to do it, please give me clear guidance and I'll re-push.

@srenatus
Copy link
Copy Markdown
Contributor

@kenperkins sorry, was on thumbs. I'd appreciate if you could squash them. Thanks! There's a bit of commit guidance in the dev docs: https://github.com/dexidp/dex/blob/60264d440cd668fe601f8ade81e100c8cd95e7f1/Documentation/dev-dependencies.md#composing-commits -- but we haven't been too strict in following these lately 😉

Thanks again for your quick action here 🚀

- 4 new tests
- Doc changes to use the group filtering
@kenperkins
Copy link
Copy Markdown
Contributor Author

So updated.

@kenperkins
Copy link
Copy Markdown
Contributor Author

Is there anything I can do here to help?

@kenperkins
Copy link
Copy Markdown
Contributor Author

@srenatus is there another maintainer that could assist in a review here?

@srenatus
Copy link
Copy Markdown
Contributor

@kenperkins I suppose so! 🏓 @JoelSpeed @bonifaido could you please have a look?

test.run(t)
}

func TestGroupsWhitelist(t *testing.T) {
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Love the tests! 🎉

Copy link
Copy Markdown
Member

@bonifaido bonifaido left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thank you for the PR.

Copy link
Copy Markdown
Contributor

@JoelSpeed JoelSpeed left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! 🎉

@bonifaido bonifaido merged commit 6d41541 into dexidp:master Oct 30, 2019
@kenperkins
Copy link
Copy Markdown
Contributor Author

🎉

@kenperkins kenperkins deleted the saml-groups branch October 30, 2019 14:03
@Sanyaorg
Copy link
Copy Markdown

Hey @kenperkins, do you have working config for allowedGroups?
It doesn't work for me, so I'm not sure what the issue is.
It still returns token with all groups inside.
Thanks
Appreciate your help

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants