Allow mapping more than one IdP groups to an OIdC identity. This
commit upgrades the kratos version (v0.11.0). Kratos v0.11.0 parses
all id token claims into `raw_claims`. The `raw_claims` can be used in
JsonNet mapper to map non-standard claims like `groups` to identity
traits.
Fixes#109
This also includes:
* Remove verbose bug debug logs
* Removes elasticsearch service from docker compose file
Signed-off-by: Akshay Gaikwad <akgaikwad001@gmail.com>
* Upgrade kratos service to v0.10.1
Signed-off-by: Akshay Gaikwad <akgaikwad001@gmail.com>
* Upgrade kratos-client-go to v0.10.1
Signed-off-by: Akshay Gaikwad <akgaikwad001@gmail.com>
* generate password feature for kratos admin creation
Signed-off-by: Akshay Gaikwad <akgaikwad001@gmail.com>
* Add forceReset property in user spec
Signed-off-by: Akshay Gaikwad <akgaikwad001@gmail.com>
* added forcereset in the init script
Signed-off-by: mabhi <abhijit.mukherjee@infracloud.io>
* Resolve conflicts
Signed-off-by: Akshay Gaikwad <akgaikwad001@gmail.com>
* Stdout default admin password in initialize script
Signed-off-by: Akshay Gaikwad <akgaikwad001@gmail.com>
* setting password for new user and sending default password in create user response
Signed-off-by: mabhi <abhijit.mukherjee@infracloud.io>
* added new endpoint to service force reset flag update after resetting complete outside authz
Signed-off-by: mabhi <abhijit.mukherjee@infracloud.io>
* removed unnecessary overhead in the forcereset endpoint and updated user type proto to remove unused fields
Signed-off-by: mabhi <abhijit.mukherjee@infracloud.io>
Due to the ORY Kratos claims which has no group/groups, and as
discussed regarding mapping idp groups to Claims.Team which is string
type, Added idpGroup to kratos trait which is also string type. Both
Identity idpGroup and Claim.Team can be mapped without fail in mapper
config.
The following could be used as an optimisation when we are filtering
just by user, but decided to omit as of now.
```
usrs, err = dao.ListFilteredUsersWithGroup(ctx, s.db,
[]uuid.UUID{}, groupId, queryOptions.Q, queryOptions.Type,
queryOptions.OrderBy, queryOptions.Order,
int(queryOptions.Limit), int(queryOptions.Offset))
```
The idp_groups is list of groups IdP user belongs to that is returning
in the OIdC providers token response. The flow of Idp Group mapping is
as follows:
OIdC Provider (OP) return custom claim with groups in a token when
authentication event
|
The value of custom claim is mapped to `idp_groups` of identity
traint using JsonNet mapper.
|
On inserting/updating/deleting `identities` table, Postgresql
sends a pg_notification with
`PG_OPERATION,IDENTITY_ID,IDENTITY_TRAIN` as a payload.
|
The `pkg/service/user.UserService.UpdateIdpUserGroupPolicy` update
the casbin policies for each notification based on payload received.
Akshay GaikwadandGitHub
Abhijit MukherjeeandGitHub
Akshay Gaikwad
vivekhiwarkar
Abin Simon
Nirav ParikhandGitHub
niravparikh05
Akshay Gaikwad
Abin SimonandAbin Simon
nirav-rafay