awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 14:34:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3424 from Infisical/misc/allow-org-admins-to-bypass-sso-enforcement

Browse Source 
misc: allow org admins to bypass sso enforcement
This commit is contained in:
Daniel Hougaard
2025-04-17 00:22:18 +04:00
committed by GitHub
parent 6f5fe053cd 1137247e69
commit 242e8fd2c6
33 changed files with 385 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/helpers/roles.ts
+1 -1
View File
@@ -1,6 +1,6 @@
import { ProjectMembershipRole, TOrgRole } from "@app/hooks/api/roles/types";
enum OrgMembershipRole {
export enum OrgMembershipRole {
Admin = "admin",
Member = "member",
NoAccess = "no-access"
frontend/src/hooks/api/organization/queries.tsx
+4 -2
View File
@@ -110,7 +110,8 @@ export const useUpdateOrg = () => {
defaultMembershipRoleSlug,
enforceMfa,
selectedMfaMethod,
allowSecretSharingOutsideOrganization
allowSecretSharingOutsideOrganization,
bypassOrgAuthEnabled
}) => {
return apiRequest.patch(`/api/v1/organization/${orgId}`, {
name,
@@ -120,7 +121,8 @@ export const useUpdateOrg = () => {
defaultMembershipRoleSlug,
enforceMfa,
selectedMfaMethod,
allowSecretSharingOutsideOrganization
allowSecretSharingOutsideOrganization,
bypassOrgAuthEnabled
});
},
onSuccess: () => {
frontend/src/hooks/api/organization/types.ts
+3
View File
@@ -9,6 +9,7 @@ export type Organization = {
createAt: string;
updatedAt: string;
authEnforced: boolean;
bypassOrgAuthEnabled: boolean;
orgAuthMethod: string;
scimEnabled: boolean;
slug: string;
@@ -17,6 +18,7 @@ export type Organization = {
selectedMfaMethod?: MfaMethod;
shouldUseNewPrivilegeSystem: boolean;
allowSecretSharingOutsideOrganization?: boolean;
userRole: string;
};
export type UpdateOrgDTO = {
@@ -29,6 +31,7 @@ export type UpdateOrgDTO = {
enforceMfa?: boolean;
selectedMfaMethod?: MfaMethod;
allowSecretSharingOutsideOrganization?: boolean;
bypassOrgAuthEnabled?: boolean;
};
export type BillingDetails = {
frontend/src/pages/auth/AdminLoginPage/route.tsx
+7
View File
@@ -0,0 +1,7 @@
import { createFileRoute } from "@tanstack/react-router";
import { LoginPage } from "../LoginPage/LoginPage";
export const Route = createFileRoute("/_restrict-login-signup/login/admin")({
component: () => <LoginPage isAdmin />
});
frontend/src/pages/auth/LoginPage/Login.utils.tsx
+9 -2
View File
@@ -33,14 +33,21 @@ export const useNavigateToSelectOrganization = () => {
const { config } = useServerConfig();
const navigate = useNavigate();
const navigateToSelectOrganization = async (cliCallbackPort?: string) => {
const navigateToSelectOrganization = async (
cliCallbackPort?: string,
isFromAdminLogin?: boolean
) => {
if (!config.defaultAuthOrgId) {
queryClient.invalidateQueries({ queryKey: userKeys.getUser });
}
navigate({
to: "/login/select-organization",
search: { callback_port: cliCallbackPort, org_id: config.defaultAuthOrgId }
search: {
callback_port: cliCallbackPort,
org_id: config.defaultAuthOrgId,
is_admin_login: isFromAdminLogin
}
});
};
frontend/src/pages/auth/LoginPage/LoginPage.tsx
+2 -1
View File
@@ -8,7 +8,7 @@ import { isLoggedIn } from "@app/hooks/api/reactQuery";
import { InitialStep, SSOStep } from "./components";
import { useNavigateToSelectOrganization } from "./Login.utils";
export const LoginPage = () => {
export const LoginPage = ({ isAdmin }: { isAdmin?: boolean }) => {
const { t } = useTranslation();
const [step, setStep] = useState(0);
const [email, setEmail] = useState("");
@@ -44,6 +44,7 @@ export const LoginPage = () => {
case 0:
return (
<InitialStep
isAdmin={isAdmin}
setStep={setStep}
email={email}
setEmail={setEmail}
frontend/src/pages/auth/LoginPage/components/InitialStep/InitialStep.tsx
+15 -5
View File
@@ -26,9 +26,17 @@ type Props = {
setEmail: (email: string) => void;
password: string;
setPassword: (email: string) => void;
isAdmin?: boolean;
};
export const InitialStep = ({ setStep, email, setEmail, password, setPassword }: Props) => {
export const InitialStep = ({
setStep,
email,
setEmail,
password,
setPassword,
isAdmin
}: Props) => {
const navigate = useNavigate();
const { t } = useTranslation();
@@ -62,7 +70,9 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
};
useEffect(() => {
if (serverDetails?.samlDefaultOrgSlug) redirectToSaml(serverDetails.samlDefaultOrgSlug);
if (serverDetails?.samlDefaultOrgSlug && !isAdmin) {
redirectToSaml(serverDetails.samlDefaultOrgSlug);
}
}, [serverDetails?.samlDefaultOrgSlug]);
const handleSaml = () => {
@@ -82,7 +92,7 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
};
const shouldDisplayLoginMethod = (method: LoginMethod) =>
!config.enabledLoginMethods || config.enabledLoginMethods.includes(method);
isAdmin || !config.enabledLoginMethods || config.enabledLoginMethods.includes(method);
const handleLogin = async (e: FormEvent<HTMLFormElement>) => {
e.preventDefault();
@@ -120,7 +130,7 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
if (isLoginSuccessful && isLoginSuccessful.success) {
// case: login was successful
navigateToSelectOrganization();
navigateToSelectOrganization(undefined, isAdmin);
createNotification({
text: "Successfully logged in",
type: "success"
@@ -160,7 +170,7 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
setIsLoading(false);
};
if (config.defaultAuthOrgAuthEnforced && config.defaultAuthOrgAuthMethod) {
if (config.defaultAuthOrgAuthEnforced && config.defaultAuthOrgAuthMethod && !isAdmin) {
return (
<form
onSubmit={handleLogin}
frontend/src/pages/auth/SelectOrgPage/SelectOrgPage.tsx
+8 -1
View File
@@ -14,6 +14,7 @@ import { IsCliLoginSuccessful } from "@app/components/utilities/attemptCliLogin"
import SecurityClient from "@app/components/utilities/SecurityClient";
import { Button, Spinner } from "@app/components/v2";
import { SessionStorageKeys } from "@app/const";
import { OrgMembershipRole } from "@app/helpers/roles";
import { useToggle } from "@app/hooks";
import {
useGetOrganizations,
@@ -53,6 +54,7 @@ export const SelectOrganizationPage = () => {
const queryParams = new URLSearchParams(window.location.search);
const orgId = queryParams.get("org_id");
const callbackPort = queryParams.get("callback_port");
const isAdminLogin = queryParams.get("is_admin_login") === "true";
const defaultSelectedOrg = organizations.data?.find((org) => org.id === orgId);
const logout = useLogoutUser(true);
@@ -68,7 +70,12 @@ export const SelectOrganizationPage = () => {
const handleSelectOrganization = useCallback(
async (organization: Organization) => {
if (organization.authEnforced) {
const canBypassOrgAuth =
organization.bypassOrgAuthEnabled &&
organization.userRole === OrgMembershipRole.Admin &&
isAdminLogin;
if (organization.authEnforced && !canBypassOrgAuth) {
// org has an org-level auth method enabled (e.g. SAML)
// -> logout + redirect to SAML SSO
await logout.mutateAsync();
frontend/src/pages/auth/SelectOrgPage/route.tsx
+5 -2
View File
@@ -6,13 +6,16 @@ import { SelectOrganizationPage } from "./SelectOrgPage";
export const SelectOrganizationPageQueryParams = z.object({
org_id: z.string().optional().catch(""),
callback_port: z.coerce.number().optional().catch(undefined)
callback_port: z.coerce.number().optional().catch(undefined),
is_admin_login: z.boolean().optional().catch(false)
});
export const Route = createFileRoute("/_restrict-login-signup/login/select-organization")({
component: SelectOrganizationPage,
validateSearch: zodValidator(SelectOrganizationPageQueryParams),
search: {
middlewares: [stripSearchParams({ org_id: "", callback_port: undefined })]
middlewares: [
stripSearchParams({ org_id: "", callback_port: undefined, is_admin_login: false })
]
}
});
frontend/src/pages/organization/SettingsPage/components/OrgAuthTab/OrgGeneralAuthSection.tsx
+83 -3
View File
@@ -1,7 +1,10 @@
import { faInfoCircle } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { UpgradePlanModal } from "@app/components/license/UpgradePlanModal";
import { createNotification } from "@app/components/notifications";
import { OrgPermissionCan } from "@app/components/permissions";
import { Switch } from "@app/components/v2";
import { Switch, Tooltip } from "@app/components/v2";
import {
OrgPermissionActions,
OrgPermissionSubjects,
@@ -52,6 +55,28 @@ export const OrgGeneralAuthSection = () => {
}
};
const handleEnableBypassOrgAuthToggle = async (value: boolean) => {
try {
if (!currentOrg?.id) return;
if (!subscription?.samlSSO) {
handlePopUpOpen("upgradePlan");
return;
}
await mutateAsync({
orgId: currentOrg?.id,
bypassOrgAuthEnabled: value
});
createNotification({
text: `Successfully ${value ? "enabled" : "disabled"} admin bypassing of org-level auth`,
type: "success"
});
} catch (err) {
console.error(err);
}
};
return (
<>
{/* <div className="py-4">
@@ -72,7 +97,9 @@ export const OrgGeneralAuthSection = () => {
</div> */}
<div className="py-4">
<div className="mb-2 flex justify-between">
<h3 className="text-md text-mineshaft-100">Enforce SAML SSO</h3>
<div className="flex items-center gap-1">
<span className="text-md text-mineshaft-100">Enforce SAML SSO</span>
</div>
<OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Sso}>
{(isAllowed) => (
<Switch
@@ -85,9 +112,62 @@ export const OrgGeneralAuthSection = () => {
</OrgPermissionCan>
</div>
<p className="text-sm text-mineshaft-300">
Enforce members to authenticate via SAML to access this organization
Enforce users to authenticate via SAML to access this organization
</p>
</div>
{currentOrg?.authEnforced && (
<div className="py-4">
<div className="mb-2 flex justify-between">
<div className="flex items-center gap-1">
<span className="text-md text-mineshaft-100">Enable Admin SSO Bypass</span>
<Tooltip
className="max-w-lg"
content={
<div>
<span>
When this is enabled, we strongly recommend enforcing MFA at the organization
level.
</span>
<p className="mt-4">
In case of a lockout, admins can use the admin login portal at{" "}
<a
target="_blank"
rel="noopener noreferrer"
className="underline underline-offset-2 hover:text-mineshaft-300"
href={`${window.location.origin}/login/admin`}
>
{window.location.origin}/login/admin
</a>
</p>
</div>
}
>
<FontAwesomeIcon
icon={faInfoCircle}
size="sm"
className="mt-0.5 inline-block text-mineshaft-400"
/>
</Tooltip>
</div>
<OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Sso}>
{(isAllowed) => (
<Switch
id="allow-admin-bypass"
isChecked={currentOrg?.bypassOrgAuthEnabled ?? false}
onCheckedChange={(value) => handleEnableBypassOrgAuthToggle(value)}
isDisabled={!isAllowed}
/>
)}
</OrgPermissionCan>
</div>
<p className="text-sm text-mineshaft-300">
<span>
Allow organization admins to bypass SAML enforcement when SSO is unavailable,
misconfigured, or inaccessible.
</span>
</p>
</div>
)}
<UpgradePlanModal
isOpen={popUp.upgradePlan.isOpen}
onOpenChange={(isOpen) => handlePopUpToggle("upgradePlan", isOpen)}
frontend/src/pages/organization/SettingsPage/components/OrgAuthTab/OrgOIDCSection.tsx
+79 -2
View File
@@ -82,6 +82,28 @@ export const OrgOIDCSection = (): JSX.Element => {
}
};
const handleEnableBypassOrgAuthToggle = async (value: boolean) => {
try {
if (!currentOrg?.id) return;
if (!subscription?.oidcSSO) {
handlePopUpOpen("upgradePlan");
return;
}
await updateOrg({
orgId: currentOrg?.id,
bypassOrgAuthEnabled: value
});
createNotification({
text: `Successfully ${value ? "enabled" : "disabled"} admin bypassing of org-level auth`,
type: "success"
});
} catch (err) {
console.error(err);
}
};
const handleOIDCGroupManagement = async (value: boolean) => {
try {
if (!currentOrg?.id) return;
@@ -158,7 +180,9 @@ export const OrgOIDCSection = (): JSX.Element => {
)}
<div className="py-4">
<div className="mb-2 flex justify-between">
<h3 className="text-md text-mineshaft-100">Enforce OIDC SSO</h3>
<div className="flex items-center gap-1">
<span className="text-md text-mineshaft-100">Enforce OIDC SSO</span>
</div>
<OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Sso}>
{(isAllowed) => (
<Switch
@@ -171,9 +195,62 @@ export const OrgOIDCSection = (): JSX.Element => {
</OrgPermissionCan>
</div>
<p className="text-sm text-mineshaft-300">
Enforce members to authenticate via OIDC to access this organization
<span>Enforce users to authenticate via OIDC to access this organization.</span>
</p>
</div>
{currentOrg?.authEnforced && (
<div className="py-4">
<div className="mb-2 flex justify-between">
<div className="flex items-center gap-1">
<span className="text-md text-mineshaft-100">Enable Admin SSO Bypass</span>
<Tooltip
className="max-w-lg"
content={
<div>
<span>
When this is enabled, we strongly recommend enforcing MFA at the organization
level.
</span>
<p className="mt-4">
In case of a lockout, admins can use the admin login portal at{" "}
<a
target="_blank"
rel="noopener noreferrer"
className="underline underline-offset-2 hover:text-mineshaft-300"
href={`${window.location.origin}/login/admin`}
>
{window.location.origin}/login/admin
</a>
</p>
</div>
}
>
<FontAwesomeIcon
icon={faInfoCircle}
size="sm"
className="mt-0.5 inline-block text-mineshaft-400"
/>
</Tooltip>
</div>
<OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Sso}>
{(isAllowed) => (
<Switch
id="allow-admin-bypass"
isChecked={currentOrg?.bypassOrgAuthEnabled ?? false}
onCheckedChange={(value) => handleEnableBypassOrgAuthToggle(value)}
isDisabled={!isAllowed}
/>
)}
</OrgPermissionCan>
</div>
<p className="text-sm text-mineshaft-300">
<span>
Allow organization admins to bypass OIDC enforcement when SSO is unavailable,
misconfigured, or inaccessible.
</span>
</p>
</div>
)}
<div className="py-4">
<div className="mb-2 flex justify-between">
<div className="text-md flex items-center text-mineshaft-100">
frontend/src/routeTree.gen.ts
+27
View File
@@ -33,6 +33,7 @@ import { Route as authSignUpSsoPageRouteImport } from './pages/auth/SignUpSsoPag
import { Route as authLoginSsoPageRouteImport } from './pages/auth/LoginSsoPage/route'
import { Route as authSelectOrgPageRouteImport } from './pages/auth/SelectOrgPage/route'
import { Route as authLoginLdapPageRouteImport } from './pages/auth/LoginLdapPage/route'
import { Route as authAdminLoginPageRouteImport } from './pages/auth/AdminLoginPage/route'
import { Route as adminSignUpPageRouteImport } from './pages/admin/SignUpPage/route'
import { Route as organizationNoOrgPageRouteImport } from './pages/organization/NoOrgPage/route'
import { Route as authSignUpPageRouteImport } from './pages/auth/SignUpPage/route'
@@ -393,6 +394,12 @@ const authLoginLdapPageRouteRoute = authLoginLdapPageRouteImport.update({
getParentRoute: () => RestrictLoginSignupLoginRoute,
} as any)
const authAdminLoginPageRouteRoute = authAdminLoginPageRouteImport.update({
id: '/admin',
path: '/admin',
getParentRoute: () => RestrictLoginSignupLoginRoute,
} as any)
const adminSignUpPageRouteRoute = adminSignUpPageRouteImport.update({
id: '/admin/signup',
path: '/admin/signup',
@@ -1775,6 +1782,13 @@ declare module '@tanstack/react-router' {
preLoaderRoute: typeof adminSignUpPageRouteImport
parentRoute: typeof middlewaresRestrictLoginSignupImport
}
'/_restrict-login-signup/login/admin': {
id: '/_restrict-login-signup/login/admin'
path: '/admin'
fullPath: '/login/admin'
preLoaderRoute: typeof authAdminLoginPageRouteImport
parentRoute: typeof RestrictLoginSignupLoginImport
}
'/_restrict-login-signup/login/ldap': {
id: '/_restrict-login-signup/login/ldap'
path: '/ldap'
@@ -3655,6 +3669,7 @@ const middlewaresAuthenticateRouteWithChildren =
interface RestrictLoginSignupLoginRouteChildren {
authLoginPageRouteRoute: typeof authLoginPageRouteRoute
authAdminLoginPageRouteRoute: typeof authAdminLoginPageRouteRoute
authLoginLdapPageRouteRoute: typeof authLoginLdapPageRouteRoute
authSelectOrgPageRouteRoute: typeof authSelectOrgPageRouteRoute
authLoginSsoPageRouteRoute: typeof authLoginSsoPageRouteRoute
@@ -3665,6 +3680,7 @@ interface RestrictLoginSignupLoginRouteChildren {
const RestrictLoginSignupLoginRouteChildren: RestrictLoginSignupLoginRouteChildren =
{
authLoginPageRouteRoute: authLoginPageRouteRoute,
authAdminLoginPageRouteRoute: authAdminLoginPageRouteRoute,
authLoginLdapPageRouteRoute: authLoginLdapPageRouteRoute,
authSelectOrgPageRouteRoute: authSelectOrgPageRouteRoute,
authLoginSsoPageRouteRoute: authLoginSsoPageRouteRoute,
@@ -3739,6 +3755,7 @@ export interface FileRoutesByFullPath {
'/signup/': typeof authSignUpPageRouteRoute
'/organization/none': typeof organizationNoOrgPageRouteRoute
'/admin/signup': typeof adminSignUpPageRouteRoute
'/login/admin': typeof authAdminLoginPageRouteRoute
'/login/ldap': typeof authLoginLdapPageRouteRoute
'/login/select-organization': typeof authSelectOrgPageRouteRoute
'/login/sso': typeof authLoginSsoPageRouteRoute
@@ -3918,6 +3935,7 @@ export interface FileRoutesByTo {
'/signup': typeof authSignUpPageRouteRoute
'/organization/none': typeof organizationNoOrgPageRouteRoute
'/admin/signup': typeof adminSignUpPageRouteRoute
'/login/admin': typeof authAdminLoginPageRouteRoute
'/login/ldap': typeof authLoginLdapPageRouteRoute
'/login/select-organization': typeof authSelectOrgPageRouteRoute
'/login/sso': typeof authLoginSsoPageRouteRoute
@@ -4096,6 +4114,7 @@ export interface FileRoutesById {
'/_restrict-login-signup/signup/': typeof authSignUpPageRouteRoute
'/_authenticate/organization/none': typeof organizationNoOrgPageRouteRoute
'/_restrict-login-signup/admin/signup': typeof adminSignUpPageRouteRoute
'/_restrict-login-signup/login/admin': typeof authAdminLoginPageRouteRoute
'/_restrict-login-signup/login/ldap': typeof authLoginLdapPageRouteRoute
'/_restrict-login-signup/login/select-organization': typeof authSelectOrgPageRouteRoute
'/_restrict-login-signup/login/sso': typeof authLoginSsoPageRouteRoute
@@ -4286,6 +4305,7 @@ export interface FileRouteTypes {
| '/signup/'
| '/organization/none'
| '/admin/signup'
| '/login/admin'
| '/login/ldap'
| '/login/select-organization'
| '/login/sso'
@@ -4464,6 +4484,7 @@ export interface FileRouteTypes {
| '/signup'
| '/organization/none'
| '/admin/signup'
| '/login/admin'
| '/login/ldap'
| '/login/select-organization'
| '/login/sso'
@@ -4640,6 +4661,7 @@ export interface FileRouteTypes {
| '/_restrict-login-signup/signup/'
| '/_authenticate/organization/none'
| '/_restrict-login-signup/admin/signup'
| '/_restrict-login-signup/login/admin'
| '/_restrict-login-signup/login/ldap'
| '/_restrict-login-signup/login/select-organization'
| '/_restrict-login-signup/login/sso'
@@ -4928,6 +4950,7 @@ export const routeTree = rootRoute
"parent": "/_restrict-login-signup",
"children": [
"/_restrict-login-signup/login/",
"/_restrict-login-signup/login/admin",
"/_restrict-login-signup/login/ldap",
"/_restrict-login-signup/login/select-organization",
"/_restrict-login-signup/login/sso",
@@ -4959,6 +4982,10 @@ export const routeTree = rootRoute
"filePath": "admin/SignUpPage/route.tsx",
"parent": "/_restrict-login-signup"
},
"/_restrict-login-signup/login/admin": {
"filePath": "auth/AdminLoginPage/route.tsx",
"parent": "/_restrict-login-signup/login"
},
"/_restrict-login-signup/login/ldap": {
"filePath": "auth/LoginLdapPage/route.tsx",
"parent": "/_restrict-login-signup/login"
frontend/src/routes.ts
+1
View File
@@ -328,6 +328,7 @@ export const routes = rootRoute("root.tsx", [
route("/admin/signup", "admin/SignUpPage/route.tsx"),
route("/login", [
index("auth/LoginPage/route.tsx"),
route("/admin", "auth/AdminLoginPage/route.tsx"),
route("/select-organization", "auth/SelectOrgPage/route.tsx"),
route("/sso", "auth/LoginSsoPage/route.tsx"),
route("/ldap", "auth/LoginLdapPage/route.tsx"),