mirror of
https://github.com/coder/coder.git
synced 2026-06-03 13:08:25 +00:00
Rafael Rodriguez
5b1e809862
## Summary In this pull request we're adding support for OIDC allowed groups in the OSS version as part of work for https://github.com/coder/coder/issues/17027. ### Changes - Restored support for parsing group allow list in OSS code ### Testing - Added tests for OSS code - Tested allowed/prohibited group OIDC flows in premium and OSS
31 lines
998 B
Go
31 lines
998 B
Go
package enidpsync
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/golang-jwt/jwt/v4"
|
|
|
|
"github.com/coder/coder/v2/coderd/idpsync"
|
|
"github.com/coder/coder/v2/codersdk"
|
|
)
|
|
|
|
func (e EnterpriseIDPSync) GroupSyncEntitled() bool {
|
|
return e.entitlements.Enabled(codersdk.FeatureTemplateRBAC)
|
|
}
|
|
|
|
// ParseGroupClaims parses the user claims and handles deployment wide group behavior.
|
|
// Almost all behavior is deferred since each organization configures it's own
|
|
// group sync settings.
|
|
// GroupAllowList is implemented here to prevent login by unauthorized users.
|
|
// TODO: GroupAllowList overlaps with the default organization group sync settings.
|
|
func (e EnterpriseIDPSync) ParseGroupClaims(ctx context.Context, mergedClaims jwt.MapClaims) (idpsync.GroupParams, *idpsync.HTTPError) {
|
|
resp, err := e.AGPLIDPSync.ParseGroupClaims(ctx, mergedClaims)
|
|
if err != nil {
|
|
return idpsync.GroupParams{}, err
|
|
}
|
|
return idpsync.GroupParams{
|
|
SyncEntitled: e.GroupSyncEntitled(),
|
|
MergedClaims: resp.MergedClaims,
|
|
}, nil
|
|
}
|