mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
zeekayandHanzo Dev
5979de1824
The generic OAuth2 slot upstream calls GitLab is not GitLab-shaped: it is
scope, auth endpoint, token endpoint, user endpoint. Here it is Hanzo
IAM, so it is named that and defaults to hanzo.id's advertised endpoints.
An operator supplies a client id and secret; nothing else.
Three things had to move for that to actually work:
- The client config only emitted the SSO props under a license, so the
sign-in button never rendered without one. Hanzo IAM is this
server's identity provider, not a licensed add-on, so its props are
unconditional.
- getSSOProvider rerouted any openid-scoped service to an OpenID
provider this build does not register, and IAM's scope is
"openid email profile". One service, one provider.
- The provider reads sub as the identity. Email and username move;
sub does not.
Tenancy rides on the owner claim, which IAM treats as authoritative:
each org gets an invite-only team named for it, created on the first
sign-in from that org and joined on every one after. The claim is read
fresh each time, so someone moved between orgs in IAM lands in the right
team on their next login. A profile field cannot influence this -- only
the claim can.
Tests cover the claim mapping and the tenant boundary, including that a
user from one org does not land in another's team. The GitLab provider's
tests are gone with the provider; these replace them.
Co-authored-by: Hanzo Dev <[email protected]>
49 lines
1.5 KiB
Go
49 lines
1.5 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package model
|
|
|
|
type SwitchRequest struct {
|
|
CurrentService string `json:"current_service"`
|
|
NewService string `json:"new_service"`
|
|
Email string `json:"email"`
|
|
Password string `json:"password"`
|
|
NewPassword string `json:"new_password"`
|
|
MfaCode string `json:"mfa_code"`
|
|
LdapLoginId string `json:"ldap_id"`
|
|
}
|
|
|
|
func (o *SwitchRequest) Auditable() map[string]any {
|
|
return map[string]any{
|
|
"current_service": o.CurrentService,
|
|
"new_service": o.NewService,
|
|
"email": o.Email,
|
|
"ldap_login_id": o.LdapLoginId,
|
|
}
|
|
}
|
|
|
|
func (o *SwitchRequest) EmailToOAuth() bool {
|
|
return o.CurrentService == UserAuthServiceEmail &&
|
|
(o.NewService == UserAuthServiceSaml ||
|
|
o.NewService == UserAuthServiceHanzo ||
|
|
o.NewService == ServiceGoogle ||
|
|
o.NewService == ServiceOffice365 ||
|
|
o.NewService == ServiceOpenid)
|
|
}
|
|
|
|
func (o *SwitchRequest) OAuthToEmail() bool {
|
|
return (o.CurrentService == UserAuthServiceSaml ||
|
|
o.CurrentService == UserAuthServiceHanzo ||
|
|
o.CurrentService == ServiceGoogle ||
|
|
o.CurrentService == ServiceOffice365 ||
|
|
o.CurrentService == ServiceOpenid) && o.NewService == UserAuthServiceEmail
|
|
}
|
|
|
|
func (o *SwitchRequest) EmailToLdap() bool {
|
|
return o.CurrentService == UserAuthServiceEmail && o.NewService == UserAuthServiceLdap
|
|
}
|
|
|
|
func (o *SwitchRequest) LdapToEmail() bool {
|
|
return o.CurrentService == UserAuthServiceLdap && o.NewService == UserAuthServiceEmail
|
|
}
|