fix: requested changes

backend/src/ee/routes/v1/oidc-router.ts

@@ -165,7 +165,7 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
         }
       ],
       querystring: z.object({
-        orgSlug: z.string().trim().describe(OidcSSo.GET_CONFIG.orgSlug)
+        organizationId: z.string().trim().describe(OidcSSo.GET_CONFIG.organizationId)
       }),
       response: {
         200: SanitizedOidcConfigSchema.pick({
@@ -189,9 +189,8 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const { orgSlug } = req.query;
       const oidc = await server.services.oidc.getOidc({
-        orgSlug,
+        organizationId: req.query.organizationId,
         type: "external",
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -252,7 +251,7 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
             .describe(OidcSSo.UPDATE_CONFIG.jwtSignatureAlgorithm)
         })
         .partial()
-        .merge(z.object({ orgSlug: z.string() })),
+        .merge(z.object({ organizationId: z.string().describe(OidcSSo.UPDATE_CONFIG.organizationId) })),
       response: {
         200: SanitizedOidcConfigSchema.pick({
           id: true,
@@ -329,7 +328,7 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
           clientId: z.string().trim().describe(OidcSSo.CREATE_CONFIG.clientId),
           clientSecret: z.string().trim().describe(OidcSSo.CREATE_CONFIG.clientSecret),
           isActive: z.boolean().describe(OidcSSo.CREATE_CONFIG.isActive),
-          orgSlug: z.string().trim().describe(OidcSSo.CREATE_CONFIG.orgSlug),
+          organizationId: z.string().trim().describe(OidcSSo.CREATE_CONFIG.organizationId),
           manageGroupMemberships: z
             .boolean()
             .optional()

backend/src/ee/services/oidc/oidc-config-service.ts

@@ -107,34 +107,26 @@ export const oidcConfigServiceFactory = ({
   kmsService
 }: TOidcConfigServiceFactoryDep) => {
   const getOidc = async (dto: TGetOidcCfgDTO) => {
-    const org = await orgDAL.findOne({ slug: dto.orgSlug });
-    if (!org) {
+    const oidcCfg = await oidcConfigDAL.findOne({
+      orgId: dto.organizationId
+    });
+    if (!oidcCfg) {
       throw new NotFoundError({
-        message: `Organization with slug '${dto.orgSlug}' not found`,
-        name: "OrgNotFound"
+        message: `OIDC configuration for organization with ID '${dto.organizationId}' not found`
       });
     }
+
     if (dto.type === "external") {
       const { permission } = await permissionService.getOrgPermission(
         dto.actor,
         dto.actorId,
-        org.id,
+        dto.organizationId,
         dto.actorAuthMethod,
         dto.actorOrgId
       );
       ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Sso);
     }
 
-    const oidcCfg = await oidcConfigDAL.findOne({
-      orgId: org.id
-    });
-
-    if (!oidcCfg) {
-      throw new NotFoundError({
-        message: `OIDC configuration for organization with slug '${dto.orgSlug}' not found`
-      });
-    }
-
     const { decryptor } = await kmsService.createCipherPairWithDataKey({
       type: KmsDataKey.Organization,
       orgId: oidcCfg.orgId
@@ -465,7 +457,7 @@ export const oidcConfigServiceFactory = ({
   };
 
   const updateOidcCfg = async ({
-    orgSlug,
+    organizationId,
     allowedEmailDomains,
     configurationType,
     discoveryURL,
@@ -484,13 +476,11 @@ export const oidcConfigServiceFactory = ({
     manageGroupMemberships,
     jwtSignatureAlgorithm
   }: TUpdateOidcCfgDTO) => {
-    const org = await orgDAL.findOne({
-      slug: orgSlug
-    });
+    const org = await orgDAL.findOne({ id: organizationId });
 
     if (!org) {
       throw new NotFoundError({
-        message: `Organization with slug '${orgSlug}' not found`
+        message: `Organization with ID '${organizationId}' not found`
       });
     }
 
@@ -555,7 +545,7 @@ export const oidcConfigServiceFactory = ({
   };
 
   const createOidcCfg = async ({
-    orgSlug,
+    organizationId,
     allowedEmailDomains,
     configurationType,
     discoveryURL,
@@ -574,12 +564,10 @@ export const oidcConfigServiceFactory = ({
     manageGroupMemberships,
     jwtSignatureAlgorithm
   }: TCreateOidcCfgDTO) => {
-    const org = await orgDAL.findOne({
-      slug: orgSlug
-    });
+    const org = await orgDAL.findOne({ id: organizationId });
     if (!org) {
       throw new NotFoundError({
-        message: `Organization with slug '${orgSlug}' not found`
+        message: `Organization with ID '${organizationId}' not found`
       });
     }
 
@@ -639,7 +627,7 @@ export const oidcConfigServiceFactory = ({
 
     const oidcCfg = await getOidc({
       type: "internal",
-      orgSlug
+      organizationId: org.id
     });
 
     if (!oidcCfg || !oidcCfg.isActive) {

backend/src/ee/services/oidc/oidc-config-types.ts

@@ -26,11 +26,11 @@ export type TOidcLoginDTO = {
 export type TGetOidcCfgDTO =
   | ({
       type: "external";
-      orgSlug: string;
+      organizationId: string;
     } & TGenericPermission)
   | {
       type: "internal";
-      orgSlug: string;
+      organizationId: string;
     };
 
 export type TCreateOidcCfgDTO = {
@@ -45,7 +45,7 @@ export type TCreateOidcCfgDTO = {
   clientId: string;
   clientSecret: string;
   isActive: boolean;
-  orgSlug: string;
+  organizationId: string;
   manageGroupMemberships: boolean;
   jwtSignatureAlgorithm: OIDCJWTSignatureAlgorithm;
 } & TGenericPermission;
@@ -62,7 +62,7 @@ export type TUpdateOidcCfgDTO = Partial<{
   clientId: string;
   clientSecret: string;
   isActive: boolean;
-  orgSlug: string;
+  organizationId: string;
   manageGroupMemberships: boolean;
   jwtSignatureAlgorithm: OIDCJWTSignatureAlgorithm;
 }> &

backend/src/lib/api-docs/constants.ts

@@ -2656,30 +2656,30 @@ export const SecretScanningConfigs = {
 
 export const OidcSSo = {
   GET_CONFIG: {
-    orgSlug: "The slug of the organization to get the OIDC config for."
+    organizationId: "The ID of the organization to get the OIDC config for."
   },
   UPDATE_CONFIG: {
-    orgSlug: "The slug of the organization to update the OIDC config for.",
+    organizationId: "The ID of the organization to update the OIDC config for.",
     allowedEmailDomains:
-      "A list of allowed email domains that users can use to authenticate with. This field is comma separated.",
+      "A list of allowed email domains that users can use to authenticate with. This field is comma separated. Example: 'example.com,acme.com'",
     discoveryURL: "The URL of the OIDC discovery endpoint.",
     configurationType: "The configuration type to use for the OIDC configuration.",
     issuer:
       "The issuer for the OIDC configuration. This is only supported when the OIDC configuration type is set to 'custom'.",
     authorizationEndpoint:
-      "The authorization endpoint to use for OIDC authorization. This is only supported when the OIDC configuration type is set to 'custom'.",
+      "The endpoint to use for OIDC authorization. This is only supported when the OIDC configuration type is set to 'custom'.",
     jwksUri: "The URL of the OIDC JWKS endpoint.",
     tokenEndpoint: "The token endpoint to use for OIDC token exchange.",
     userinfoEndpoint: "The userinfo endpoint to get user information from the OIDC provider.",
     clientId: "The client ID to use for OIDC authentication.",
     clientSecret: "The client secret to use for OIDC authentication.",
-    isActive: "Whether the OIDC configuration is active.",
+    isActive: "Whether to enable or disable this OIDC configuration.",
     manageGroupMemberships:
-      "Whether to manage group memberships for the OIDC configuration. If enabled, users will automatically be assigned groups when they sign in or are added to a group in the OIDC provider.",
+      "Whether to manage group memberships for the OIDC configuration. If enabled, users will automatically be assigned groups when they sign in, based on which groups they are a member of in the OIDC provider.",
     jwtSignatureAlgorithm: "The algorithm to use for JWT signature verification."
   },
   CREATE_CONFIG: {
-    orgSlug: "The slug of the organization to create the OIDC config for.",
+    organizationId: "The ID of the organization to create the OIDC config for.",
     allowedEmailDomains:
       "A list of allowed email domains that users can use to authenticate with. This field is comma separated.",
     discoveryURL: "The URL of the OIDC discovery endpoint.",
@@ -2693,9 +2693,9 @@ export const OidcSSo = {
     userinfoEndpoint: "The userinfo endpoint to get user information from the OIDC provider.",
     clientId: "The client ID to use for OIDC authentication.",
     clientSecret: "The client secret to use for OIDC authentication.",
-    isActive: "Whether the OIDC configuration is active.",
+    isActive: "Whether to enable or disable this OIDC configuration.",
     manageGroupMemberships:
-      "Whether to manage group memberships for the OIDC configuration. If enabled, users will automatically be assigned groups when they sign in or are added to a group in the OIDC provider.",
+      "Whether to manage group memberships for the OIDC configuration. If enabled, users will automatically be assigned groups when they sign in, based on which groups they are a member of in the OIDC provider.",
     jwtSignatureAlgorithm: "The algorithm to use for JWT signature verification."
   }
 };
@@ -2707,7 +2707,7 @@ export const SamlSso = {
   UPDATE_CONFIG: {
     organizationId: "The ID of the organization to update the SAML config for.",
     authProvider: "The authentication provider to use for SAML authentication.",
-    isActive: "Whether the SAML configuration is active.",
+    isActive: "Whether to enable or disable this SAML configuration.",
     entryPoint:
       "The entry point for the SAML authentication. This is the URL that the user will be redirected to after they have authenticated with the SAML provider.",
     issuer: "The SAML provider issuer URL or entity ID.",
@@ -2716,7 +2716,7 @@ export const SamlSso = {
   CREATE_CONFIG: {
     organizationId: "The ID of the organization to create the SAML config for.",
     authProvider: "The authentication provider to use for SAML authentication.",
-    isActive: "Whether the SAML configuration is active.",
+    isActive: "Whether to enable or disable this SAML configuration.",
     entryPoint:
       "The entry point for the SAML authentication. This is the URL that the user will be redirected to after they have authenticated with the SAML provider.",
     issuer: "The SAML provider issuer URL or entity ID.",
@@ -2730,24 +2730,24 @@ export const LdapSso = {
   },
   CREATE_CONFIG: {
     organizationId: "The ID of the organization to create the LDAP config for.",
-    isActive: "Whether the LDAP configuration is active.",
+    isActive: "Whether to enable or disable this LDAP configuration.",
     url: "The LDAP server to connect to such as `ldap://ldap.your-org.com`, `ldaps://ldap.myorg.com:636` (for connection over SSL/TLS), etc.",
     bindDN:
-      "The distinguished name of object to bind when performing the user search such as `cn=infisical,ou=Users,dc=acme,dc=com`",
+      "The distinguished name of the object to bind when performing the user search such as `cn=infisical,ou=Users,dc=acme,dc=com`",
     bindPass: "The password to use along with Bind DN when performing the user search.",
     searchBase: "The base DN to use for the user search such as `ou=Users,dc=acme,dc=com`",
     uniqueUserAttribute:
       "The attribute to use as the unique identifier of LDAP users such as `sAMAccountName`, `cn`, `uid`, `objectGUID`. If left blank, defaults to uidNumber",
     searchFilter:
-      "Template used to construct the LDAP user search filter such as `(uid={{username}})` uses literal `{{username}}` to have the given username used in the search. The default is `(uid={{username}})` which is compatible with several common directory schemas.",
+      "The template used to construct the LDAP user search filter such as `(uid={{username}})` uses literal `{{username}}` to have the given username used in the search. The default is `(uid={{username}})` which is compatible with several common directory schemas.",
     groupSearchBase: "LDAP search base to use for group membership search such as `ou=Groups,dc=acme,dc=com`",
     groupSearchFilter:
-      " Template used when constructing the group membership query such as `(&(objectClass=posixGroup)(memberUid={{.Username}}))`. The template can access the following context variables: `[UserDN, UserName]`. The default is `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))` which is compatible with several common directory schemas.",
+      "The template used when constructing the group membership query such as `(&(objectClass=posixGroup)(memberUid={{.Username}}))`. The template can access the following context variables: `[UserDN, UserName]`. The default is `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))` which is compatible with several common directory schemas.",
     caCert: "The CA certificate to use when verifying the LDAP server certificate."
   },
   UPDATE_CONFIG: {
     organizationId: "The ID of the organization to update the LDAP config for.",
-    isActive: "Whether the LDAP configuration is active.",
+    isActive: "Whether to enable or disable this LDAP configuration.",
     url: "The LDAP server to connect to such as `ldap://ldap.your-org.com`, `ldaps://ldap.myorg.com:636` (for connection over SSL/TLS), etc.",
     bindDN:
       "The distinguished name of object to bind when performing the user search such as `cn=infisical,ou=Users,dc=acme,dc=com`",
@@ -2755,11 +2755,11 @@ export const LdapSso = {
     uniqueUserAttribute:
       "The attribute to use as the unique identifier of LDAP users such as `sAMAccountName`, `cn`, `uid`, `objectGUID`. If left blank, defaults to uidNumber",
     searchFilter:
-      "Template used to construct the LDAP user search filter such as `(uid={{username}})` uses literal `{{username}}` to have the given username used in the search. The default is `(uid={{username}})` which is compatible with several common directory schemas.",
+      "The template used to construct the LDAP user search filter such as `(uid={{username}})` uses literal `{{username}}` to have the given username used in the search. The default is `(uid={{username}})` which is compatible with several common directory schemas.",
     searchBase: "The base DN to use for the user search such as `ou=Users,dc=acme,dc=com`",
     groupSearchBase: "LDAP search base to use for group membership search such as `ou=Groups,dc=acme,dc=com`",
     groupSearchFilter:
-      " Template used when constructing the group membership query such as `(&(objectClass=posixGroup)(memberUid={{.Username}}))`. The template can access the following context variables: `[UserDN, UserName]`. The default is `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))` which is compatible with several common directory schemas.",
+      "The template used when constructing the group membership query such as `(&(objectClass=posixGroup)(memberUid={{.Username}}))`. The template can access the following context variables: `[UserDN, UserName]`. The default is `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))` which is compatible with several common directory schemas.",
     caCert: "The CA certificate to use when verifying the LDAP server certificate."
   }
 };