Skip to content

Commit a7efd2e

Browse files
frikkyfrikky
authored
Merge pull request #149 from LalitDeore/sso-autoprovision
[Fix] - Autoprovisioning of user in org
2 parents 8e36cf7 + 9279c24 commit a7efd2e

File tree

1 file changed

+220
-17
lines changed

1 file changed

+220
-17
lines changed

‎shared.go‎

Lines changed: 220 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -19464,8 +19464,20 @@ func HandleOpenId(resp http.ResponseWriter, request *http.Request) {
1946419464

1946519465
redirectUrl := "https://shuffler.io/workflows"
1946619466

19467-
if len(os.Getenv("SSO_REDIRECT_URL")) > 0 {
19468-
redirectUrl = os.Getenv("SSO_REDIRECT_URL")
19467+
if project.Environment != "cloud" {
19468+
redirectUrl = "http://localhost:3001/workflows"
19469+
if len(os.Getenv("SSO_REDIRECT_URL")) > 0 {
19470+
baseUrl := os.Getenv("SSO_REDIRECT_URL")
19471+
// Check if URL contains /api/v1/login_openid and replace with /workflows
19472+
if strings.Contains(baseUrl, "/api/v1/login_openid") {
19473+
redirectUrl = strings.Replace(baseUrl, "/api/v1/login_openid", "/workflows", 1)
19474+
} else if !strings.HasSuffix(baseUrl, "/workflows") {
19475+
// If URL doesn't end with /workflows, append it
19476+
redirectUrl = fmt.Sprintf("%s/workflows", baseUrl)
19477+
} else {
19478+
redirectUrl = baseUrl
19479+
}
19480+
}
1946919481
}
1947019482

1947119483
if len(userName) == 0 {
@@ -19480,7 +19492,40 @@ func HandleOpenId(resp http.ResponseWriter, request *http.Request) {
1948019492
for _, user := range users {
1948119493
log.Printf("%s - %s", user.GeneratedUsername, userName)
1948219494
if user.GeneratedUsername == userName {
19483-
log.Printf("[AUDIT] Found user %s (%s) which matches SSO info for %s. Redirecting to login!", user.Username, user.Id, userName)
19495+
foundOrgInUser := false
19496+
for _, userOrg := range user.Orgs {
19497+
if userOrg == org.Id {
19498+
foundOrgInUser = true
19499+
break
19500+
}
19501+
}
19502+
19503+
// check whether user is in org or not
19504+
foundUserInOrg := false
19505+
var usr User
19506+
for _, usr = range org.Users {
19507+
if usr.Id == user.Id {
19508+
foundUserInOrg = true
19509+
break
19510+
}
19511+
}
19512+
19513+
if (!foundOrgInUser || !foundUserInOrg) && org.SSOConfig.AutoProvision {
19514+
log.Printf("[WARNING] User %s (%s) is not in org %s (%s). Please contact the administrator - (1)", user.Username, user.Id, org.Name, org.Id)
19515+
resp.WriteHeader(401)
19516+
resp.Write([]byte(fmt.Sprintf(`{"success": false, "reason": "User not found in the org. Autoprovisioning is disabled. Please contact the admin of the org to allow auto-provisioning of user."}`)))
19517+
return
19518+
} else if !foundOrgInUser || !foundUserInOrg {
19519+
log.Printf("[INFO] User %s (%s) is not in org %s (%s). Auto-provisioning is enabled. Adding user to org - (1)", user.Username, user.Id, org.Name, org.Id)
19520+
if !foundOrgInUser {
19521+
user.Orgs = append(user.Orgs, org.Id)
19522+
}
19523+
if !foundUserInOrg {
19524+
org.Users = append(org.Users, user)
19525+
}
19526+
} else {
19527+
log.Printf("[AUDIT] Found user %s (%s) which matches SSO info for %s. Redirecting to login! - (1)", user.Username, user.Id, userName)
19528+
}
1948419529

1948519530
//log.Printf("SESSION: %s", user.Session)
1948619531
user.ActiveOrg = OrgMini{
@@ -19567,6 +19612,16 @@ func HandleOpenId(resp http.ResponseWriter, request *http.Request) {
1956719612
return
1956819613
}
1956919614

19615+
if !foundUserInOrg {
19616+
err = SetOrg(ctx, *org, org.Id)
19617+
if err != nil {
19618+
log.Printf("[WARNING] Failed updating org when setting user: %s", err)
19619+
resp.WriteHeader(401)
19620+
resp.Write([]byte(`{"success": false, "reason": "Failed org update during user storage (2)"}`))
19621+
return
19622+
}
19623+
}
19624+
1957019625
//redirectUrl = fmt.Sprintf("%s?source=SSO&id=%s", redirectUrl, session)
1957119626
http.Redirect(resp, request, redirectUrl, http.StatusSeeOther)
1957219627
return
@@ -19579,8 +19634,41 @@ func HandleOpenId(resp http.ResponseWriter, request *http.Request) {
1957919634
if err == nil && len(users) > 0 {
1958019635
for _, user := range users {
1958119636
if user.Username == userName {
19582-
log.Printf("[AUDIT] Found user %s (%s) which matches SSO info for %s. Redirecting to login %s!", user.Username, user.Id, userName, redirectUrl)
19637+
// Checking whether the user is in the org
19638+
foundOrgInUser := false
19639+
for _, userOrg := range user.Orgs {
19640+
if userOrg == org.Id {
19641+
foundOrgInUser = true
19642+
break
19643+
}
19644+
}
1958319645

19646+
// check whether user is in org or not
19647+
foundUserInOrg := false
19648+
var usr User
19649+
for _, usr = range org.Users {
19650+
if usr.Id == user.Id {
19651+
foundUserInOrg = true
19652+
break
19653+
}
19654+
}
19655+
19656+
if (!foundOrgInUser || !foundUserInOrg) && org.SSOConfig.AutoProvision {
19657+
log.Printf("[WARNING] User %s (%s) is not in org %s (%s). Please contact the administrator - (2)", user.Username, user.Id, org.Name, org.Id)
19658+
resp.WriteHeader(401)
19659+
resp.Write([]byte(fmt.Sprintf(`{"success": false, "reason": "User not found in the org. Autoprovisioning is disabled. Please contact the admin of the org to allow auto-provisioning of user."}`)))
19660+
return
19661+
} else if !foundOrgInUser || !foundUserInOrg {
19662+
log.Printf("[INFO] User %s (%s) is not in org %s (%s). Auto-provisioning is enabled. Adding user to org - (2)", user.Username, user.Id, org.Name, org.Id)
19663+
if !foundOrgInUser {
19664+
user.Orgs = append(user.Orgs, org.Id)
19665+
}
19666+
if !foundUserInOrg {
19667+
org.Users = append(org.Users, user)
19668+
}
19669+
} else {
19670+
log.Printf("[AUDIT] Found user %s (%s) which matches SSO info for %s. Redirecting to login!- (2)", user.Username, user.Id, userName)
19671+
}
1958419672
//log.Printf("SESSION: %s", user.Session)
1958519673
user.ActiveOrg = OrgMini{
1958619674
Name: org.Name,
@@ -19665,6 +19753,16 @@ func HandleOpenId(resp http.ResponseWriter, request *http.Request) {
1966519753
return
1966619754
}
1966719755

19756+
if !foundUserInOrg {
19757+
err = SetOrg(ctx, *org, org.Id)
19758+
if err != nil {
19759+
log.Printf("[WARNING] Failed updating org when setting session: %s", err)
19760+
resp.WriteHeader(401)
19761+
resp.Write([]byte(`{"success": false, "reason": "Failed org update during session storage (2)"}`))
19762+
return
19763+
}
19764+
}
19765+
1966819766
//redirectUrl = fmt.Sprintf("%s?source=SSO&id=%s", redirectUrl, session)
1966919767
http.Redirect(resp, request, redirectUrl, http.StatusSeeOther)
1967019768
return
@@ -19697,6 +19795,13 @@ func HandleOpenId(resp http.ResponseWriter, request *http.Request) {
1969719795
return
1969819796
}
1969919797

19798+
if org.SSOConfig.AutoProvision {
19799+
log.Printf("[INFO] Auto-provisioning user is not allow for org %s (%s) - can not add new user %s - (3)", org.Name, org.Id, userName)
19800+
resp.WriteHeader(401)
19801+
resp.Write([]byte(fmt.Sprintf(`{"success": false, "reason": "User not found in the org. Autoprovisioning is disabled. Please contact the admin of the org to allow auto-provisioning of user."}`)))
19802+
return
19803+
}
19804+
1970019805
log.Printf("[AUDIT] Adding user %s to org %s (%s) through single sign-on", userName, org.Name, org.Id)
1970119806
newUser := new(User)
1970219807
// Random password to ensure its not empty
@@ -19786,17 +19891,20 @@ func HandleSSO(resp http.ResponseWriter, request *http.Request) {
1978619891
redirectUrl := "http://localhost:3001/workflows"
1978719892
backendUrl := os.Getenv("SSO_REDIRECT_URL")
1978819893

19789-
if len(backendUrl) == 0 && project.Environment == "onprem" {
19790-
backendUrl = "http://localhost:3000"
19791-
}
19792-
19793-
if len(backendUrl) == 0 && len(os.Getenv("BASE_URL")) > 0 {
19794-
backendUrl = os.Getenv("BASE_URL")
19795-
}
19796-
19797-
if len(backendUrl) > 0 {
19798-
//we don't need to add /workflow path in backend url as backend url is SSO_REDIRECT_URL and it is already pointing to /workflow by default.
19799-
redirectUrl = backendUrl
19894+
if project.Environment != "cloud" {
19895+
if len(os.Getenv("SSO_REDIRECT_URL")) > 0 {
19896+
baseUrl := os.Getenv("SSO_REDIRECT_URL")
19897+
19898+
// Check if URL contains /api/v1/login_sso and replace with /workflows
19899+
if strings.Contains(baseUrl, "/api/v1/login_sso") {
19900+
redirectUrl = strings.Replace(baseUrl, "/api/v1/login_sso", "/workflows", 1)
19901+
} else if !strings.HasSuffix(baseUrl, "/workflows") {
19902+
// If URL doesn't end with /workflows, append it
19903+
redirectUrl = fmt.Sprintf("%s/workflows", baseUrl)
19904+
} else {
19905+
redirectUrl = baseUrl
19906+
}
19907+
}
1980019908
}
1980119909

1980219910
if project.Environment == "cloud" {
@@ -19989,7 +20097,40 @@ func HandleSSO(resp http.ResponseWriter, request *http.Request) {
1998920097
for _, user := range users {
1999020098
log.Printf("%s - %s", user.GeneratedUsername, userName)
1999120099
if user.GeneratedUsername == userName {
19992-
log.Printf("[AUDIT] Found user %s (%s) which matches SSO info for %s. Redirecting to login!", user.Username, user.Id, userName)
20100+
foundOrgInUser := false
20101+
for _, userOrg := range user.Orgs {
20102+
if userOrg == foundOrg.Id {
20103+
foundOrgInUser = true
20104+
break
20105+
}
20106+
}
20107+
20108+
// check whether user is in org or not
20109+
foundUserInOrg := false
20110+
var usr User
20111+
for _, usr = range foundOrg.Users {
20112+
if usr.Id == user.Id {
20113+
foundUserInOrg = true
20114+
break
20115+
}
20116+
}
20117+
20118+
if (!foundOrgInUser || !foundUserInOrg) && foundOrg.SSOConfig.AutoProvision {
20119+
log.Printf("[WARNING] User %s (%s) is not in org %s (%s). Autoprovisioning of user is disable. Please contact the administrator - (1)", user.Username, user.Id, foundOrg.Name, foundOrg.Id)
20120+
resp.WriteHeader(401)
20121+
resp.Write([]byte(fmt.Sprintf(`{"success": false, "reason": "User not found in the org. Autoprovisioning is disabled. Please contact the admin of the org to allow auto-provisioning of user."}`)))
20122+
return
20123+
} else if !foundOrgInUser || !foundUserInOrg {
20124+
log.Printf("[INFO] User %s (%s) is not in org %s (%s). Auto-provisioning is enabled. Adding user to org - (1)", user.Username, user.Id, foundOrg.Name, foundOrg.Id)
20125+
if !foundOrgInUser {
20126+
user.Orgs = append(user.Orgs, foundOrg.Id)
20127+
}
20128+
if !foundUserInOrg {
20129+
foundOrg.Users = append(foundOrg.Users, user)
20130+
}
20131+
} else {
20132+
log.Printf("[AUDIT] Found user %s (%s) which matches SSO info for %s. Redirecting to login! - (1)", user.Username, user.Id, userName)
20133+
}
1999320134

1999420135
if project.Environment == "cloud" {
1999520136
// user.ActiveOrg.Id = matchingOrgs[0].Id
@@ -20090,6 +20231,16 @@ func HandleSSO(resp http.ResponseWriter, request *http.Request) {
2009020231
return
2009120232
}
2009220233

20234+
if !foundUserInOrg {
20235+
err = SetOrg(ctx, foundOrg, foundOrg.Id)
20236+
if err != nil {
20237+
log.Printf("[WARNING] Failed updating org when setting user: %s", err)
20238+
resp.WriteHeader(401)
20239+
resp.Write([]byte(`{"success": false, "reason": "Failed org update during user storage (2)"}`))
20240+
return
20241+
}
20242+
}
20243+
2009320244
//redirectUrl = fmt.Sprintf("%s?source=SSO&id=%s", redirectUrl, session)
2009420245
http.Redirect(resp, request, redirectUrl, http.StatusSeeOther)
2009520246
return
@@ -20102,7 +20253,42 @@ func HandleSSO(resp http.ResponseWriter, request *http.Request) {
2010220253
if err == nil && len(users) > 0 {
2010320254
for _, user := range users {
2010420255
if user.Username == userName {
20105-
log.Printf("[AUDIT] Found user %s (%s) which matches SSO info for %s. Redirecting to login %s!", user.Username, user.Id, userName, redirectUrl)
20256+
20257+
// Checking whether the user is in the org
20258+
foundOrgInUser := false
20259+
for _, userOrg := range user.Orgs {
20260+
if userOrg == foundOrg.Id {
20261+
foundOrgInUser = true
20262+
break
20263+
}
20264+
}
20265+
20266+
// check whether user is in org or not
20267+
foundUserInOrg := false
20268+
var usr User
20269+
for _, usr = range foundOrg.Users {
20270+
if usr.Id == user.Id {
20271+
foundUserInOrg = true
20272+
break
20273+
}
20274+
}
20275+
20276+
if (!foundOrgInUser || !foundUserInOrg) && foundOrg.SSOConfig.AutoProvision {
20277+
log.Printf("[WARNING] User %s (%s) is not in org %s (%s). Autoprovisioning user is not allow in org - (2)", user.Username, user.Id, foundOrg.Name, foundOrg.Id)
20278+
resp.WriteHeader(401)
20279+
resp.Write([]byte(fmt.Sprintf(`{"success": false, "reason": "User not found in the org. Autoprovisioning is disabled. Please contact the admin of the org to allow auto-provisioning of user."}`)))
20280+
return
20281+
} else if !foundOrgInUser || !foundUserInOrg {
20282+
log.Printf("[INFO] User %s (%s) is not in org %s (%s). Auto-provisioning is enabled. Adding user to org - (2)", user.Username, user.Id, foundOrg.Name, foundOrg.Id)
20283+
if !foundOrgInUser {
20284+
user.Orgs = append(user.Orgs, foundOrg.Id)
20285+
}
20286+
if !foundUserInOrg {
20287+
foundOrg.Users = append(foundOrg.Users, user)
20288+
}
20289+
} else {
20290+
log.Printf("[AUDIT] Found user %s (%s) which matches SSO info for %s. Redirecting to login! - (2)", user.Username, user.Id, userName)
20291+
}
2010620292

2010720293
//log.Printf("SESSION: %s", user.Session)
2010820294
// if project.Environment == "cloud" {
@@ -20194,6 +20380,16 @@ func HandleSSO(resp http.ResponseWriter, request *http.Request) {
2019420380
return
2019520381
}
2019620382

20383+
if !foundUserInOrg {
20384+
err = SetOrg(ctx, foundOrg, foundOrg.Id)
20385+
if err != nil {
20386+
log.Printf("[WARNING] Failed updating org when setting session: %s", err)
20387+
resp.WriteHeader(401)
20388+
resp.Write([]byte(`{"success": false, "reason": "Failed org update during session storage (2)"}`))
20389+
return
20390+
}
20391+
}
20392+
2019720393
//redirectUrl = fmt.Sprintf("%s?source=SSO&id=%s", redirectUrl, session)
2019820394
http.Redirect(resp, request, redirectUrl, http.StatusSeeOther)
2019920395
return
@@ -20226,6 +20422,13 @@ func HandleSSO(resp http.ResponseWriter, request *http.Request) {
2022620422
return
2022720423
}
2022820424

20425+
if foundOrg.SSOConfig.AutoProvision {
20426+
log.Printf("[INFO] Auto-provisioning user is not allow for org %s (%s) - can not add new user %s", foundOrg.Name, foundOrg.Id, userName)
20427+
resp.WriteHeader(401)
20428+
resp.Write([]byte(fmt.Sprintf(`{"success": false, "reason": "User not found in the org. Autoprovisioning is disabled. Please contact the admin of the org to allow auto-provisioning of user."}`)))
20429+
return
20430+
}
20431+
2022920432
log.Printf("[AUDIT] Adding user %s to org %s (%s) through single sign-on", userName, foundOrg.Name, foundOrg.Id)
2023020433
newUser := new(User)
2023120434
// Random password to ensure its not empty

0 commit comments

Comments
 (0)