From 0b31d7f86095419a29ee882dfa04bedaae980df2 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Thu, 8 May 2025 08:14:29 +0400 Subject: [PATCH] feat(identities): ldap auth, requested changes --- .../identity-access-token-dal.ts | 5 ++++- .../identity-access-token-service.ts | 3 ++- .../identity-ldap-auth-service.ts | 8 ++++---- frontend/src/hooks/api/auditLogs/constants.tsx | 2 +- frontend/src/hooks/api/auditLogs/enums.tsx | 15 ++++++++------- frontend/src/hooks/api/identities/mutations.tsx | 3 +++ frontend/src/hooks/api/identities/queries.tsx | 1 + frontend/src/hooks/api/identities/types.ts | 2 +- .../AuditLogsPage/components/LogsFilter.tsx | 4 ++-- .../ViewIdentityAwsAuthContent.tsx | 4 ++-- .../ViewIdentityAzureAuthContent.tsx | 4 ++-- .../ViewIdentityGcpAuthContent.tsx | 4 ++-- .../ViewIdentityJwtAuthContent.tsx | 4 ++-- .../ViewIdentityKubernetesAuthContent.tsx | 4 ++-- .../ViewIdentityLdapAuthContent.tsx | 4 ++-- .../ViewIdentityOidcAuthContent.tsx | 4 ++-- .../ViewIdentityTokenAuthContent.tsx | 4 ++-- .../ViewIdentityUniversalAuthContent.tsx | 4 ++-- 18 files changed, 44 insertions(+), 35 deletions(-) diff --git a/backend/src/services/identity-access-token/identity-access-token-dal.ts b/backend/src/services/identity-access-token/identity-access-token-dal.ts index 57517c706..a2a067cad 100644 --- a/backend/src/services/identity-access-token/identity-access-token-dal.ts +++ b/backend/src/services/identity-access-token/identity-access-token-dal.ts @@ -30,6 +30,7 @@ export const identityAccessTokenDALFactory = (db: TDbClient) => { .leftJoin(TableName.IdentityGcpAuth, `${TableName.Identity}.id`, `${TableName.IdentityGcpAuth}.identityId`) .leftJoin(TableName.IdentityAwsAuth, `${TableName.Identity}.id`, `${TableName.IdentityAwsAuth}.identityId`) .leftJoin(TableName.IdentityAzureAuth, `${TableName.Identity}.id`, `${TableName.IdentityAzureAuth}.identityId`) + .leftJoin(TableName.IdentityLdapAuth, `${TableName.Identity}.id`, `${TableName.IdentityLdapAuth}.identityId`) .leftJoin( TableName.IdentityKubernetesAuth, `${TableName.Identity}.id`, @@ -48,6 +49,7 @@ export const identityAccessTokenDALFactory = (db: TDbClient) => { db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityOidcAuth).as("accessTokenTrustedIpsOidc"), db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityTokenAuth).as("accessTokenTrustedIpsToken"), db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityJwtAuth).as("accessTokenTrustedIpsJwt"), + db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityLdapAuth).as("accessTokenTrustedIpsLdap"), db.ref("name").withSchema(TableName.Identity) ) .first(); @@ -63,7 +65,8 @@ export const identityAccessTokenDALFactory = (db: TDbClient) => { trustedIpsKubernetesAuth: doc.accessTokenTrustedIpsK8s, trustedIpsOidcAuth: doc.accessTokenTrustedIpsOidc, trustedIpsAccessTokenAuth: doc.accessTokenTrustedIpsToken, - trustedIpsAccessJwtAuth: doc.accessTokenTrustedIpsJwt + trustedIpsAccessJwtAuth: doc.accessTokenTrustedIpsJwt, + trustedIpsAccessLdapAuth: doc.accessTokenTrustedIpsLdap }; } catch (error) { throw new DatabaseError({ error, name: "IdAccessTokenFindOne" }); diff --git a/backend/src/services/identity-access-token/identity-access-token-service.ts b/backend/src/services/identity-access-token/identity-access-token-service.ts index a51d80e41..cd79981fe 100644 --- a/backend/src/services/identity-access-token/identity-access-token-service.ts +++ b/backend/src/services/identity-access-token/identity-access-token-service.ts @@ -186,7 +186,8 @@ export const identityAccessTokenServiceFactory = ({ [IdentityAuthMethod.KUBERNETES_AUTH]: identityAccessToken.trustedIpsKubernetesAuth, [IdentityAuthMethod.OIDC_AUTH]: identityAccessToken.trustedIpsOidcAuth, [IdentityAuthMethod.TOKEN_AUTH]: identityAccessToken.trustedIpsAccessTokenAuth, - [IdentityAuthMethod.JWT_AUTH]: identityAccessToken.trustedIpsAccessJwtAuth + [IdentityAuthMethod.JWT_AUTH]: identityAccessToken.trustedIpsAccessJwtAuth, + [IdentityAuthMethod.LDAP_AUTH]: identityAccessToken.trustedIpsAccessLdapAuth }; const trustedIps = trustedIpsMap[identityAccessToken.authMethod as IdentityAuthMethod]; diff --git a/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts b/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts index 916fa1f9b..86343e3e2 100644 --- a/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts +++ b/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts @@ -241,6 +241,8 @@ export const identityLdapAuthServiceFactory = ({ return extractIPDetails(accessTokenTrustedIp.ipAddress); }); + if (allowedFields) AllowedFieldsSchema.array().parse(allowedFields); + const identityLdapAuth = await identityLdapAuthDAL.transaction(async (tx) => { const { encryptor } = await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.Organization, @@ -264,8 +266,6 @@ export const identityLdapAuthServiceFactory = ({ plainText: Buffer.from(bindDN) }); - if (allowedFields) AllowedFieldsSchema.array().parse(allowedFields); - const isConnected = await testLDAPConfig({ bindDN, bindPass, @@ -374,6 +374,8 @@ export const identityLdapAuthServiceFactory = ({ return extractIPDetails(accessTokenTrustedIp.ipAddress); }); + if (allowedFields) AllowedFieldsSchema.array().parse(allowedFields); + const { encryptor } = await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.Organization, orgId: identityMembershipOrg.orgId @@ -422,8 +424,6 @@ export const identityLdapAuthServiceFactory = ({ }); } - if (allowedFields) AllowedFieldsSchema.array().parse(allowedFields); - const updatedLdapAuth = await identityLdapAuthDAL.updateById(identityLdapAuth.id, { url, searchBase, diff --git a/frontend/src/hooks/api/auditLogs/constants.tsx b/frontend/src/hooks/api/auditLogs/constants.tsx index d48d8ae80..f726566cd 100644 --- a/frontend/src/hooks/api/auditLogs/constants.tsx +++ b/frontend/src/hooks/api/auditLogs/constants.tsx @@ -192,7 +192,7 @@ export const eventToNameMap: { [K in EventType]: string } = { [EventType.REVOKE_IDENTITY_LDAP_AUTH]: "Revoked LDAP Auth for identity" }; -export const userAgentTTypeoNameMap: { [K in UserAgentType]: string } = { +export const userAgentTypeToNameMap: { [K in UserAgentType]: string } = { [UserAgentType.WEB]: "Web", [UserAgentType.CLI]: "CLI", [UserAgentType.K8_OPERATOR]: "K8s operator", diff --git a/frontend/src/hooks/api/auditLogs/enums.tsx b/frontend/src/hooks/api/auditLogs/enums.tsx index 59ae35d45..b74969d6d 100644 --- a/frontend/src/hooks/api/auditLogs/enums.tsx +++ b/frontend/src/hooks/api/auditLogs/enums.tsx @@ -47,6 +47,13 @@ export enum EventType { CREATE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET = "create-identity-universal-auth-client-secret", REVOKE_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRET = "revoke-identity-universal-auth-client-secret", GET_IDENTITY_UNIVERSAL_AUTH_CLIENT_SECRETS = "get-identity-universal-auth-client-secret", + + LOGIN_IDENTITY_LDAP_AUTH = "login-identity-ldap-auth", + ADD_IDENTITY_LDAP_AUTH = "add-identity-ldap-auth", + UPDATE_IDENTITY_LDAP_AUTH = "update-identity-ldap-auth", + GET_IDENTITY_LDAP_AUTH = "get-identity-ldap-auth", + REVOKE_IDENTITY_LDAP_AUTH = "revoke-identity-ldap-auth", + CREATE_ENVIRONMENT = "create-environment", UPDATE_ENVIRONMENT = "update-environment", DELETE_ENVIRONMENT = "delete-environment", @@ -176,11 +183,5 @@ export enum EventType { MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_CHECK_INSTALLATION_STATUS = "microsoft-teams-workflow-integration-check-installation-status", MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_GET_TEAMS = "microsoft-teams-workflow-integration-get-teams", MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_GET = "microsoft-teams-workflow-integration-get", - MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_LIST = "microsoft-teams-workflow-integration-list", - - LOGIN_IDENTITY_LDAP_AUTH = "login-identity-ldap-auth", - ADD_IDENTITY_LDAP_AUTH = "add-identity-ldap-auth", - UPDATE_IDENTITY_LDAP_AUTH = "update-identity-ldap-auth", - GET_IDENTITY_LDAP_AUTH = "get-identity-ldap-auth", - REVOKE_IDENTITY_LDAP_AUTH = "revoke-identity-ldap-auth" + MICROSOFT_TEAMS_WORKFLOW_INTEGRATION_LIST = "microsoft-teams-workflow-integration-list" } diff --git a/frontend/src/hooks/api/identities/mutations.tsx b/frontend/src/hooks/api/identities/mutations.tsx index 7d9b4fbcb..e19ec7458 100644 --- a/frontend/src/hooks/api/identities/mutations.tsx +++ b/frontend/src/hooks/api/identities/mutations.tsx @@ -1145,6 +1145,9 @@ export const useUpdateIdentityLdapAuth = () => { queryKey: organizationKeys.getOrgIdentityMemberships(organizationId) }); queryClient.invalidateQueries({ queryKey: identitiesKeys.getIdentityById(identityId) }); + queryClient.invalidateQueries({ + queryKey: identitiesKeys.getIdentityLdapAuth(identityId) + }); } }); }; diff --git a/frontend/src/hooks/api/identities/queries.tsx b/frontend/src/hooks/api/identities/queries.tsx index 74ac4b214..3bc94534c 100644 --- a/frontend/src/hooks/api/identities/queries.tsx +++ b/frontend/src/hooks/api/identities/queries.tsx @@ -253,6 +253,7 @@ export const useGetIdentityLdapAuth = ( enabled: Boolean(identityId) && (options?.enabled ?? true) }); }; + export const useGetIdentityTokensTokenAuth = (identityId: string) => { return useQuery({ enabled: Boolean(identityId), diff --git a/frontend/src/hooks/api/identities/types.ts b/frontend/src/hooks/api/identities/types.ts index 0ad6e9316..a97067e41 100644 --- a/frontend/src/hooks/api/identities/types.ts +++ b/frontend/src/hooks/api/identities/types.ts @@ -482,7 +482,7 @@ export type IdentityLdapAuth = { searchFilter: string; uniqueAttribute: string; ldapCaCertificate?: string; - allowedFields: { + allowedFields?: { key: string; value: string; }[]; diff --git a/frontend/src/pages/organization/AuditLogsPage/components/LogsFilter.tsx b/frontend/src/pages/organization/AuditLogsPage/components/LogsFilter.tsx index 59440c814..b015e0679 100644 --- a/frontend/src/pages/organization/AuditLogsPage/components/LogsFilter.tsx +++ b/frontend/src/pages/organization/AuditLogsPage/components/LogsFilter.tsx @@ -38,7 +38,7 @@ import { useGetUserWorkspaces } from "@app/hooks/api"; import { eventToNameMap, secretEvents, - userAgentTTypeoNameMap + userAgentTypeToNameMap } from "@app/hooks/api/auditLogs/constants"; import { EventType } from "@app/hooks/api/auditLogs/enums"; import { UserAgentType } from "@app/hooks/api/auth/types"; @@ -47,7 +47,7 @@ import { LogFilterItem } from "./LogFilterItem"; import { AuditLogFilterFormData, Presets } from "./types"; const eventTypes = Object.entries(eventToNameMap).map(([value, label]) => ({ label, value })); -const userAgentTypes = Object.entries(userAgentTTypeoNameMap).map(([value, label]) => ({ +const userAgentTypes = Object.entries(userAgentTypeToNameMap).map(([value, label]) => ({ label, value })); diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityAwsAuthContent.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityAwsAuthContent.tsx index 64eea9cf6..e7130d8a2 100644 --- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityAwsAuthContent.tsx +++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityAwsAuthContent.tsx @@ -47,10 +47,10 @@ export const ViewIdentityAwsAuthContent = ({ onEdit={() => handlePopUpOpen("identityAuthMethod")} onDelete={onDelete} > - + {data.accessTokenTTL} - + {data.accessTokenMaxTTL} diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityAzureAuthContent.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityAzureAuthContent.tsx index fa146e4ca..ea9ee09ea 100644 --- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityAzureAuthContent.tsx +++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityAzureAuthContent.tsx @@ -47,10 +47,10 @@ export const ViewIdentityAzureAuthContent = ({ onEdit={() => handlePopUpOpen("identityAuthMethod")} onDelete={onDelete} > - + {data.accessTokenTTL} - + {data.accessTokenMaxTTL} diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityGcpAuthContent.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityGcpAuthContent.tsx index 9eefe96fd..4008850e9 100644 --- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityGcpAuthContent.tsx +++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityGcpAuthContent.tsx @@ -47,10 +47,10 @@ export const ViewIdentityGcpAuthContent = ({ onEdit={() => handlePopUpOpen("identityAuthMethod")} onDelete={onDelete} > - + {data.accessTokenTTL} - + {data.accessTokenMaxTTL} diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityJwtAuthContent.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityJwtAuthContent.tsx index d16635937..b0e50278e 100644 --- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityJwtAuthContent.tsx +++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityJwtAuthContent.tsx @@ -49,10 +49,10 @@ export const ViewIdentityJwtAuthContent = ({ onEdit={() => handlePopUpOpen("identityAuthMethod")} onDelete={onDelete} > - + {data.accessTokenTTL} - + {data.accessTokenMaxTTL} diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityKubernetesAuthContent.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityKubernetesAuthContent.tsx index da0455160..214bb1b21 100644 --- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityKubernetesAuthContent.tsx +++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityKubernetesAuthContent.tsx @@ -51,10 +51,10 @@ export const ViewIdentityKubernetesAuthContent = ({ onEdit={() => handlePopUpOpen("identityAuthMethod")} onDelete={onDelete} > - + {data.accessTokenTTL} - + {data.accessTokenMaxTTL} diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityLdapAuthContent.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityLdapAuthContent.tsx index ae6200d8a..006c38229 100644 --- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityLdapAuthContent.tsx +++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityLdapAuthContent.tsx @@ -48,10 +48,10 @@ export const ViewIdentityLdapAuthContent = ({ onEdit={() => handlePopUpOpen("identityAuthMethod")} onDelete={onDelete} > - + {data.accessTokenTTL} - + {data.accessTokenMaxTTL} diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityOidcAuthContent.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityOidcAuthContent.tsx index 116ecfd38..a326fda45 100644 --- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityOidcAuthContent.tsx +++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityOidcAuthContent.tsx @@ -48,10 +48,10 @@ export const ViewIdentityOidcAuthContent = ({ onEdit={() => handlePopUpOpen("identityAuthMethod")} onDelete={onDelete} > - + {data.accessTokenTTL} - + {data.accessTokenMaxTTL} diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityTokenAuthContent.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityTokenAuthContent.tsx index 0e28516fa..516289f74 100644 --- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityTokenAuthContent.tsx +++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityTokenAuthContent.tsx @@ -50,10 +50,10 @@ export const ViewIdentityTokenAuthContent = ({ onEdit={() => handlePopUpOpen("identityAuthMethod")} onDelete={onDelete} > - + {data.accessTokenTTL} - + {data.accessTokenMaxTTL} diff --git a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityUniversalAuthContent.tsx b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityUniversalAuthContent.tsx index ca1c30eed..3a794ce60 100644 --- a/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityUniversalAuthContent.tsx +++ b/frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityUniversalAuthContent.tsx @@ -62,10 +62,10 @@ export const ViewIdentityUniversalAuthContent = ({ onEdit={() => handlePopUpOpen("identityAuthMethod")} onDelete={onDelete} > - + {data.accessTokenTTL} - + {data.accessTokenMaxTTL}