awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2985 from Infisical/misc/add-oidc-saml-handling-for-login-check

Browse Source 
misc: add oidc saml handling for login SA check
This commit is contained in:
Maidul Islam
2025-01-14 13:11:29 -05:00
committed by GitHub
parent 0cef728617 5ad419c079
commit c806059b11
2 changed files with 33 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
backend/src/server/routes/index.ts
View File

@@ -608,6 +608,7 @@ export const registerRoutes = async (
});
const superAdminService = superAdminServiceFactory({
userDAL,
userAliasDAL,
authService: loginService,
serverCfgDAL: superAdminDAL,
kmsRootConfigDAL,

44
backend/src/services/super-admin/super-admin-service.ts
View File

@@ -16,12 +16,15 @@ import { TKmsServiceFactory } from "../kms/kms-service";
import { RootKeyEncryptionStrategy } from "../kms/kms-types";
import { TOrgServiceFactory } from "../org/org-service";
import { TUserDALFactory } from "../user/user-dal";
import { TUserAliasDALFactory } from "../user-alias/user-alias-dal";
import { UserAliasType } from "../user-alias/user-alias-types";
import { TSuperAdminDALFactory } from "./super-admin-dal";
import { LoginMethod, TAdminGetUsersDTO, TAdminSignUpDTO } from "./super-admin-types";
type TSuperAdminServiceFactoryDep = {
serverCfgDAL: TSuperAdminDALFactory;
userDAL: TUserDALFactory;
userAliasDAL: Pick<TUserAliasDALFactory, "findOne">;
authService: Pick<TAuthLoginFactory, "generateUserTokens">;
kmsService: Pick<TKmsServiceFactory, "encryptWithRootKey" | "decryptWithRootKey" | "updateEncryptionStrategy">;
kmsRootConfigDAL: TKmsRootConfigDALFactory;
@@ -48,6 +51,7 @@ const ADMIN_CONFIG_DB_UUID = "00000000-0000-0000-0000-000000000000";
export const superAdminServiceFactory = ({
serverCfgDAL,
userDAL,
userAliasDAL,
authService,
orgService,
keyStore,
@@ -104,29 +108,45 @@ export const superAdminServiceFactory = ({
if (data.enabledLoginMethods) {
const superAdminUser = await userDAL.findById(userId);
const isSamlConfiguredForUser = Boolean(
await userAliasDAL.findOne({
userId,
aliasType: UserAliasType.SAML
})
);
// We do not store SAML and OIDC auth values in the user authMethods field
// and so we infer its usage from the user's aliases
const isUserSamlAccessEnabled = isSamlConfiguredForUser && data.enabledLoginMethods.includes(LoginMethod.SAML);
const isOidcConfiguredForUser = Boolean(
await userAliasDAL.findOne({
userId,
aliasType: UserAliasType.OIDC
})
);
const isUserOidcAccessEnabled = isOidcConfiguredForUser && data.enabledLoginMethods.includes(LoginMethod.OIDC);
const loginMethodToAuthMethod = {
[LoginMethod.EMAIL]: [AuthMethod.EMAIL],
[LoginMethod.GOOGLE]: [AuthMethod.GOOGLE],
[LoginMethod.GITLAB]: [AuthMethod.GITLAB],
[LoginMethod.GITHUB]: [AuthMethod.GITHUB],
[LoginMethod.LDAP]: [AuthMethod.LDAP],
[LoginMethod.OIDC]: [AuthMethod.OIDC],
[LoginMethod.SAML]: [
AuthMethod.AZURE_SAML,
AuthMethod.GOOGLE_SAML,
AuthMethod.JUMPCLOUD_SAML,
AuthMethod.KEYCLOAK_SAML,
AuthMethod.OKTA_SAML
]
[LoginMethod.SAML]: [],
[LoginMethod.OIDC]: []
};
if (
!data.enabledLoginMethods.some((loginMethod) =>
const canServerAdminAccessAfterApply =
data.enabledLoginMethods.some((loginMethod) =>
loginMethodToAuthMethod[loginMethod as LoginMethod].some(
(authMethod) => superAdminUser.authMethods?.includes(authMethod)
)
)
) {
) ||
isUserSamlAccessEnabled ||
isUserOidcAccessEnabled;
if (!canServerAdminAccessAfterApply) {
throw new BadRequestError({
message: "You must configure at least one auth method to prevent account lockout"
});