Merge pull request #4501 from Infisical/ENG-3677

improvement(google-oauth-enforcement): prevent conflicting sso enforcement configuration
2026-09-22 13:39:35 +00:00 · 2025-09-09 14:44:01 -07:00
parent fe9ca7a3ee b113eabeb7
commit b59657f64a
12 changed files with 251 additions and 46 deletions
--- a/backend/src/ee/services/ldap-config/ldap-config-service.ts
+++ b/backend/src/ee/services/ldap-config/ldap-config-service.ts
@@ -127,6 +127,20 @@ export const ldapConfigServiceFactory = ({
        message:
          "Failed to create LDAP configuration due to plan restriction. Upgrade plan to create LDAP configuration."
      });
+
+    const org = await orgDAL.findOrgById(orgId);
+
+    if (!org) {
+      throw new NotFoundError({ message: `Could not find organization with ID "${orgId}"` });
+    }
+
+    if (org.googleSsoAuthEnforced && isActive) {
+      throw new BadRequestError({
+        message:
+          "You cannot enable LDAP SSO while Google OAuth is enforced. Disable Google OAuth enforcement to enable LDAP SSO."
+      });
+    }
+
    const { encryptor } = await kmsService.createCipherPairWithDataKey({
      type: KmsDataKey.Organization,
      orgId
@@ -233,6 +247,19 @@ export const ldapConfigServiceFactory = ({
          "Failed to update LDAP configuration due to plan restriction. Upgrade plan to update LDAP configuration."
      });

+    const org = await orgDAL.findOrgById(orgId);
+
+    if (!org) {
+      throw new NotFoundError({ message: `Could not find organization with ID "${orgId}"` });
+    }
+
+    if (org.googleSsoAuthEnforced && isActive) {
+      throw new BadRequestError({
+        message:
+          "You cannot enable LDAP SSO while Google OAuth is enforced. Disable Google OAuth enforcement to enable LDAP SSO."
+      });
+    }
+
    const updateQuery: TLdapConfigsUpdate = {
      isActive,
      url,
--- a/backend/src/ee/services/oidc/oidc-config-service.ts
+++ b/backend/src/ee/services/oidc/oidc-config-service.ts
@@ -499,6 +499,13 @@ export const oidcConfigServiceFactory = ({
    );
    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Sso);

+    if (org.googleSsoAuthEnforced && isActive) {
+      throw new BadRequestError({
+        message:
+          "You cannot enable OIDC SSO while Google OAuth is enforced. Disable Google OAuth enforcement to enable OIDC SSO."
+      });
+    }
+
    const { encryptor } = await kmsService.createCipherPairWithDataKey({
      type: KmsDataKey.Organization,
      orgId: org.id
@@ -586,6 +593,13 @@ export const oidcConfigServiceFactory = ({
    );
    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Sso);

+    if (org.googleSsoAuthEnforced && isActive) {
+      throw new BadRequestError({
+        message:
+          "You cannot enable OIDC SSO while Google OAuth is enforced. Disable Google OAuth enforcement to enable OIDC SSO."
+      });
+    }
+
    const { encryptor } = await kmsService.createCipherPairWithDataKey({
      type: KmsDataKey.Organization,
      orgId: org.id
--- a/backend/src/ee/services/saml-config/saml-config-service.ts
+++ b/backend/src/ee/services/saml-config/saml-config-service.ts
@@ -82,6 +82,19 @@ export const samlConfigServiceFactory = ({
          "Failed to create SAML SSO configuration due to plan restriction. Upgrade plan to create SSO configuration."
      });

+    const org = await orgDAL.findOrgById(orgId);
+
+    if (!org) {
+      throw new NotFoundError({ message: `Could not find organization with ID "${orgId}"` });
+    }
+
+    if (org.googleSsoAuthEnforced && isActive) {
+      throw new BadRequestError({
+        message:
+          "You cannot enable SAML SSO while Google OAuth is enforced. Disable Google OAuth enforcement to enable SAML SSO."
+      });
+    }
+
    const { encryptor } = await kmsService.createCipherPairWithDataKey({
      type: KmsDataKey.Organization,
      orgId
@@ -120,6 +133,19 @@ export const samlConfigServiceFactory = ({
          "Failed to update SAML SSO configuration due to plan restriction. Upgrade plan to update SSO configuration."
      });

+    const org = await orgDAL.findOrgById(orgId);
+
+    if (!org) {
+      throw new NotFoundError({ message: `Could not find organization with ID "${orgId}"` });
+    }
+
+    if (org.googleSsoAuthEnforced && isActive) {
+      throw new BadRequestError({
+        message:
+          "Cannot enable SAML SSO while Google OAuth is enforced. Disable Google OAuth enforcement to enable SAML SSO."
+      });
+    }
+
    const updateQuery: TSamlConfigsUpdate = { authProvider, isActive, lastUsed: null };
    const { encryptor } = await kmsService.createCipherPairWithDataKey({
      type: KmsDataKey.Organization,
--- a/backend/src/keystore/keystore.ts
+++ b/backend/src/keystore/keystore.ts
@@ -1,9 +1,10 @@
+import { Cluster, Redis } from "ioredis";
+
 import { buildRedisFromConfig, TRedisConfigKeys } from "@app/lib/config/redis";
 import { pgAdvisoryLockHashText } from "@app/lib/crypto/hashtext";
 import { applyJitter } from "@app/lib/dates";
 import { delay as delayMs } from "@app/lib/delay";
 import { ExecutionResult, Redlock, Settings } from "@app/lib/red-lock";
-import { Redis, Cluster } from "ioredis";

 export const PgSqlLock = {
  BootUpMigration: 2023,
--- a/backend/src/server/routes/index.ts
+++ b/backend/src/server/routes/index.ts
@@ -807,6 +807,7 @@ export const registerRoutes = async (
    groupDAL,
    orgBotDAL,
    oidcConfigDAL,
+    ldapConfigDAL,
    loginService,
    projectBotService,
    reminderService
--- a/backend/src/services/org/org-service.ts
+++ b/backend/src/services/org/org-service.ts
@@ -9,11 +9,14 @@ import {
  ProjectMembershipRole,
  ProjectVersion,
  TableName,
+  TOidcConfigs,
  TProjectMemberships,
  TProjectUserMembershipRolesInsert,
+  TSamlConfigs,
  TUsers
 } from "@app/db/schemas";
 import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
+import { TLdapConfigDALFactory } from "@app/ee/services/ldap-config/ldap-config-dal";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TOidcConfigDALFactory } from "@app/ee/services/oidc/oidc-config-dal";
 import {
@@ -125,6 +128,7 @@ type TOrgServiceFactoryDep = {
  incidentContactDAL: TIncidentContactsDALFactory;
  samlConfigDAL: Pick<TSamlConfigDALFactory, "findOne">;
  oidcConfigDAL: Pick<TOidcConfigDALFactory, "findOne">;
+  ldapConfigDAL: Pick<TLdapConfigDALFactory, "findOne">;
  smtpService: TSmtpService;
  tokenService: TAuthTokenServiceFactory;
  permissionService: TPermissionServiceFactory;
@@ -165,6 +169,7 @@ export const orgServiceFactory = ({
  projectRoleDAL,
  samlConfigDAL,
  oidcConfigDAL,
+  ldapConfigDAL,
  projectUserMembershipRoleDAL,
  identityMetadataDAL,
  projectBotService,
@@ -446,16 +451,20 @@ export const orgServiceFactory = ({
      });
    }

-    if (authEnforced) {
-      const samlCfg = await samlConfigDAL.findOne({
+    let samlCfg: TSamlConfigs | undefined;
+    let oidcCfg: TOidcConfigs | undefined;
+    if (authEnforced || googleSsoAuthEnforced) {
+      samlCfg = await samlConfigDAL.findOne({
        orgId,
        isActive: true
      });
-      const oidcCfg = await oidcConfigDAL.findOne({
+      oidcCfg = await oidcConfigDAL.findOne({
        orgId,
        isActive: true
      });
+    }

+    if (authEnforced) {
      if (!samlCfg && !oidcCfg)
        throw new NotFoundError({
          message: `SAML or OIDC configuration for organization with ID '${orgId}' not found`
@@ -483,6 +492,32 @@ export const orgServiceFactory = ({
        });
      }

+      if (samlCfg) {
+        throw new BadRequestError({
+          message:
+            "Cannot enable Google OAuth enforcement while SAML SSO is configured. Disable SAML SSO to enforce Google OAuth."
+        });
+      }
+
+      if (oidcCfg) {
+        throw new BadRequestError({
+          message:
+            "Cannot enable Google OAuth enforcement while OIDC SSO is configured. Disable OIDC SSO to enforce Google OAuth."
+        });
+      }
+
+      const ldapCfg = await ldapConfigDAL.findOne({
+        orgId,
+        isActive: true
+      });
+
+      if (ldapCfg) {
+        throw new BadRequestError({
+          message:
+            "Cannot enable Google OAuth enforcement while LDAP SSO is configured. Disable LDAP SSO to enforce Google OAuth."
+        });
+      }
+
      if (!currentOrg.googleSsoAuthLastUsed) {
        throw new BadRequestError({
          message:
--- a/frontend/src/components/permissions/OrgPermissionCan.tsx
+++ b/frontend/src/components/permissions/OrgPermissionCan.tsx
@@ -1,6 +1,7 @@
 import { FunctionComponent, ReactNode } from "react";
 import { BoundCanProps, Can } from "@casl/react";

+import { TooltipProps } from "@app/components/v2/Tooltip/Tooltip";
 import { TOrgPermission, useOrgPermission } from "@app/context/OrgPermissionContext";

 import { AccessRestrictedBanner, Tooltip } from "../v2";
@@ -20,6 +21,7 @@ type Props = {
  renderTooltip?: boolean;
  allowedLabel?: string;
  renderGuardBanner?: boolean;
+  tooltipProps?: Omit<TooltipProps, "children">;
 } & BoundCanProps<TOrgPermission>;

 export const OrgPermissionCan: FunctionComponent<Props> = ({
@@ -29,6 +31,7 @@ export const OrgPermissionCan: FunctionComponent<Props> = ({
  renderTooltip,
  allowedLabel,
  renderGuardBanner,
+  tooltipProps,
  ...props
 }) => {
  const { permission } = useOrgPermission();
@@ -43,11 +46,19 @@ export const OrgPermissionCan: FunctionComponent<Props> = ({
            : children;

        if (!isAllowed && passThrough) {
-          return <Tooltip content={label}>{finalChild}</Tooltip>;
+          return (
+            <Tooltip content={label} {...tooltipProps}>
+              {finalChild}
+            </Tooltip>
+          );
        }

        if (isAllowed && renderTooltip && allowedLabel) {
-          return <Tooltip content={allowedLabel}>{finalChild}</Tooltip>;
+          return (
+            <Tooltip content={allowedLabel} {...tooltipProps}>
+              {finalChild}
+            </Tooltip>
+          );
        }

        if (!isAllowed && renderGuardBanner) {
--- a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgGeneralAuthSection.tsx
@@ -24,11 +24,17 @@ enum EnforceAuthType {
 export const OrgGeneralAuthSection = ({
  isSamlConfigured,
  isOidcConfigured,
-  isGoogleConfigured
+  isGoogleConfigured,
+  isSamlActive,
+  isOidcActive,
+  isLdapActive
 }: {
  isSamlConfigured: boolean;
  isOidcConfigured: boolean;
  isGoogleConfigured: boolean;
+  isSamlActive: boolean;
+  isOidcActive: boolean;
+  isLdapActive: boolean;
 }) => {
  const { currentOrg } = useOrganization();
  const { subscription } = useSubscription();
@@ -126,6 +132,15 @@ export const OrgGeneralAuthSection = ({
    }
  };

+  const isGoogleOAuthEnforced = currentOrg.googleSsoAuthEnforced;
+
+  const getActiveSsoLabel = () => {
+    if (isSamlActive) return "SAML";
+    if (isOidcActive) return "OIDC";
+    if (isLdapActive) return "LDAP";
+    return "";
+  };
+
  return (
    <div className="rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-6">
      <div>
@@ -135,7 +150,7 @@ export const OrgGeneralAuthSection = ({
        </p>
      </div>
      <div className="flex flex-col gap-2 py-4">
-        <div className={twMerge("mt-4", !isSamlConfigured && "hidden")}>
+        <div className={twMerge("mt-4", (!isSamlConfigured || isGoogleOAuthEnforced) && "hidden")}>
          <div className="mb-2 flex justify-between">
            <div className="flex items-center gap-1">
              <span className="text-md text-mineshaft-100">Enforce SAML SSO</span>
@@ -160,7 +175,7 @@ export const OrgGeneralAuthSection = ({
          </p>
        </div>

-        <div className={twMerge("mt-4", !isOidcConfigured && "hidden")}>
+        <div className={twMerge("mt-4", (!isOidcConfigured || isGoogleOAuthEnforced) && "hidden")}>
          <div className="mb-2 flex justify-between">
            <div className="flex items-center gap-1">
              <span className="text-md text-mineshaft-100">Enforce OIDC SSO</span>
@@ -188,26 +203,47 @@ export const OrgGeneralAuthSection = ({
        <div className={twMerge("mt-2", !isGoogleConfigured && "hidden")}>
          <div className="mb-2 flex justify-between">
            <div className="flex items-center gap-1">
-              <span className="text-md text-mineshaft-100">Enforce Google SSO</span>
+              <span className="text-md text-mineshaft-100">Enforce Google OAuth</span>
            </div>
-            <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Sso}>
+            <OrgPermissionCan
+              I={OrgPermissionActions.Edit}
+              a={OrgPermissionSubjects.Sso}
+              tooltipProps={{
+                className: "max-w-sm",
+                side: "left"
+              }}
+              allowedLabel={
+                isOidcActive || isSamlActive || isLdapActive
+                  ? `You cannot enforce Google OAuth while ${getActiveSsoLabel()} SSO is enabled. Disable ${getActiveSsoLabel()} SSO to enforce Google OAuth.`
+                  : undefined
+              }
+              renderTooltip={isOidcActive || isSamlActive || isLdapActive}
+            >
              {(isAllowed) => (
-                <Switch
-                  id="enforce-google-sso"
-                  onCheckedChange={(value) =>
-                    handleEnforceOrgAuthToggle(value, EnforceAuthType.GOOGLE)
-                  }
-                  isChecked={currentOrg?.googleSsoAuthEnforced ?? false}
-                  isDisabled={!isAllowed || currentOrg?.authEnforced}
-                />
+                <div>
+                  <Switch
+                    id="enforce-google-sso"
+                    onCheckedChange={(value) =>
+                      handleEnforceOrgAuthToggle(value, EnforceAuthType.GOOGLE)
+                    }
+                    isChecked={currentOrg?.googleSsoAuthEnforced ?? false}
+                    isDisabled={
+                      !isAllowed ||
+                      currentOrg?.authEnforced ||
+                      isOidcActive ||
+                      isSamlActive ||
+                      isLdapActive
+                    }
+                  />
+                </div>
              )}
            </OrgPermissionCan>
          </div>
          <p className="text-sm text-mineshaft-300">
-            Enforce users to authenticate via Google OAuth SSO to access this organization.
+            Enforce users to authenticate via Google OAuth to access this organization.
            <br />
            When this is enabled your organization members will only be able to login with Google
-            SSO (not Google SAML).
+            OAuth (not Google SAML).
          </p>
        </div>
      </div>
@@ -267,8 +303,8 @@ export const OrgGeneralAuthSection = ({
          </div>
          <p className="text-sm text-mineshaft-300">
            <span>
-              Allow organization admins to bypass SAML enforcement when SSO is unavailable,
-              misconfigured, or inaccessible.
+              Allow organization admins to bypass SSO login enforcement when your SSO provider is
+              unavailable, misconfigured, or inaccessible.
            </span>
          </p>
        </div>
--- a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgLDAPSection.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgLDAPSection.tsx
@@ -94,6 +94,8 @@ export const OrgLDAPSection = (): JSX.Element => {
    handlePopUpOpen("ldapGroupMap");
  };

+  const isGoogleOAuthEnabled = currentOrg.googleSsoAuthEnforced;
+
  return (
    <div className="mb-4">
      <div className="py-4">
@@ -116,16 +118,31 @@ export const OrgLDAPSection = (): JSX.Element => {
        <div className="pt-4">
          <div className="mb-2 flex items-center justify-between">
            <h2 className="text-md text-mineshaft-100">Enable LDAP</h2>
-            <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Ldap}>
+            <OrgPermissionCan
+              I={OrgPermissionActions.Edit}
+              a={OrgPermissionSubjects.Ldap}
+              tooltipProps={{
+                className: "max-w-sm",
+                side: "left"
+              }}
+              allowedLabel={
+                isGoogleOAuthEnabled
+                  ? "You cannot enable LDAP SSO while Google OAuth is enforced. Disable Google OAuth enforcement to enable LDAP SSO."
+                  : undefined
+              }
+              renderTooltip={isGoogleOAuthEnabled}
+            >
              {(isAllowed) => (
-                <Switch
-                  id="enable-saml-sso"
-                  onCheckedChange={(value) => handleLDAPToggle(value)}
-                  isChecked={data ? data.isActive : false}
-                  isDisabled={!isAllowed}
-                >
-                  Enable
-                </Switch>
+                <div>
+                  <Switch
+                    id="enable-ldap-sso"
+                    onCheckedChange={(value) => handleLDAPToggle(value)}
+                    isChecked={data ? data.isActive : false}
+                    isDisabled={!isAllowed || isGoogleOAuthEnabled}
+                  >
+                    Enable
+                  </Switch>
+                </div>
              )}
            </OrgPermissionCan>
          </div>
--- a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgOIDCSection.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgOIDCSection.tsx
@@ -83,6 +83,8 @@ export const OrgOIDCSection = (): JSX.Element => {
    }
  };

+  const isGoogleOAuthEnabled = currentOrg.googleSsoAuthEnforced;
+
  return (
    <div className="mb-4 rounded-lg border-mineshaft-600 bg-mineshaft-900">
      <div className="mb-4 flex items-center justify-between">
@@ -106,14 +108,29 @@ export const OrgOIDCSection = (): JSX.Element => {
          <div className="mb-2 flex items-center justify-between">
            <h2 className="text-md text-mineshaft-100">Enable OIDC</h2>
            {!isPending && (
-              <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Sso}>
+              <OrgPermissionCan
+                I={OrgPermissionActions.Edit}
+                a={OrgPermissionSubjects.Sso}
+                tooltipProps={{
+                  className: "max-w-sm",
+                  side: "left"
+                }}
+                allowedLabel={
+                  isGoogleOAuthEnabled
+                    ? "You cannot enable OIDC SSO while Google OAuth is enforced. Disable Google OAuth enforcement to enable OIDC SSO."
+                    : undefined
+                }
+                renderTooltip={isGoogleOAuthEnabled}
+              >
                {(isAllowed) => (
-                  <Switch
-                    id="enable-oidc-sso"
-                    onCheckedChange={(value) => handleOIDCToggle(value)}
-                    isChecked={data ? data.isActive : false}
-                    isDisabled={!isAllowed}
-                  />
+                  <div>
+                    <Switch
+                      id="enable-oidc-sso"
+                      onCheckedChange={(value) => handleOIDCToggle(value)}
+                      isChecked={data ? data.isActive : false}
+                      isDisabled={!isAllowed || isGoogleOAuthEnabled}
+                    />
+                  </div>
                )}
              </OrgPermissionCan>
            )}
--- a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgSSOSection.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgSSOSection.tsx
@@ -78,6 +78,8 @@ export const OrgSSOSection = (): JSX.Element => {
    }
  };

+  const isGoogleOAuthEnabled = currentOrg.googleSsoAuthEnforced;
+
  return (
    <div className="space-y-4">
      <div className="mb-4 flex items-center justify-between">
@@ -99,14 +101,29 @@ export const OrgSSOSection = (): JSX.Element => {
        <div className="mb-2 flex items-center justify-between pt-4">
          <h2 className="text-md text-mineshaft-100">Enable SAML</h2>
          {!isPending && (
-            <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Sso}>
+            <OrgPermissionCan
+              I={OrgPermissionActions.Edit}
+              a={OrgPermissionSubjects.Sso}
+              tooltipProps={{
+                className: "max-w-sm",
+                side: "left"
+              }}
+              allowedLabel={
+                isGoogleOAuthEnabled
+                  ? "You cannot enable SAML SSO while Google OAuth is enforced. Disable Google OAuth enforcement to enable SAML SSO."
+                  : undefined
+              }
+              renderTooltip={isGoogleOAuthEnabled}
+            >
              {(isAllowed) => (
-                <Switch
-                  id="enable-saml-sso"
-                  onCheckedChange={(value) => handleSamlSSOToggle(value)}
-                  isChecked={data ? data.isActive : false}
-                  isDisabled={!isAllowed}
-                />
+                <div>
+                  <Switch
+                    id="enable-saml-sso"
+                    onCheckedChange={(value) => handleSamlSSOToggle(value)}
+                    isChecked={data ? data.isActive : false}
+                    isDisabled={!isAllowed || isGoogleOAuthEnabled}
+                  />
+                </div>
              )}
            </OrgPermissionCan>
          )}
--- a/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgSsoTab.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/OrgSsoTab/OrgSsoTab.tsx
@@ -184,6 +184,9 @@ export const OrgSsoTab = withPermission(
              isSamlConfigured={isSamlConfigured}
              isOidcConfigured={isOidcConfigured}
              isGoogleConfigured={isGoogleConfigured}
+              isSamlActive={Boolean(samlConfig?.isActive)}
+              isOidcActive={Boolean(oidcConfig?.isActive)}
+              isLdapActive={Boolean(ldapConfig?.isActive)}
            />
          )}