Release 2020 10 05 #1214
Merged
Release 2020 10 05 #1214
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
documentation
Before this PR, scim tokens could only be added to teams that already had exactly one SAML IdP. Now, we also allow SAML-less teams to have SCIM provisioning. This is an alternative to onboarding via team-settings and produces user accounts that are authenticated with email and password. (Phone may or may not work, but is not officially supported.)
The way this works is different from team-settings: we don't send invites, but we create active users immediately the moment the SCIM user post is processed. The new thing is that the created user has neither email nor phone nor a SAML identity, nor a password.
How does this work?
email: If no SAML IdP is present, SCIM user posts must contain an externalId that is an email address. This email address is not added to the newly created user, because it has not been validated. Instead, the flow for changing an email address is triggered in brig: an email is sent to the address containing a validation key, and once the user completes the flow, brig will add the email address to the user. We had to add very little code for this in this PR, it's all an old feature.
When SCIM user gets are processed, in order to reconstruct the externalId from the user spar is retrieving from brig, we introduce a new json object for the sso_id field that looks like this: {'scim_external_id': '[email protected]'}.
In order to find users that have email addresses pending validation, we introduce a new table in spar's cassandra called scim_external_ids, in analogy to user. We have tried to use brig's internal GET /i/user&email=..., but that also finds pending email addresses, and there are corner cases when changing email addresses and waiting for the new address to be validated and the old to be removed... that made this approach seem infeasible.
password: once the user has validated their email address, they need to trigger the "forgot password" flow -- also old code.
That's the gist of it!
* New brig internal end-points.
* Support for email/password-authenticated scim users.
* Fix: spar's notion of brig's api.
- use internal end-points
- return 'UserAccount' (contains status) instead of 'User'.
- more transparent error handling.
* Fix: allow UserSSOId in brig to carry scim external ids.
* Fix: UserSSOId parsing in spar.
* Fix: store RichInfo in brig if it changes.
* Fix: do not support setting passwords in SCIM
* Fix: update sso_id in brig correctly.
* Fix: do not pull users with email pending validation.
* Refactor: functions for handler-, email-based scim user lookup.
* Give externalIds that are emails their own lookup table in spar.
* Fix: check if email address is available (even without idp).
* Fix: scim-delete if there is no saml idp.
* Refactor: reduce integration test setup time.
* Fix: do not use email address as saml subject if no uref is found.
* Add at least a few lines of docs.
* Assert that deleteUser returns 204
Co-authored-by: Arian van Putten <[email protected]>
We will probably make it less verbose again in the future, but at the moment this is helpful for debugging issues caused by switching to amazonka. * cargohold: log more AWS errors * add comments to amazonka log level mapping Copied from other services. Might be nice to unify this?
If testing against S3, minio, and others, this allows to run ``` cd services/cargohold make compat-minio make compat-s3 ... ``` Requires a `compat` folder (currently symlinked to a private repository containing some credentials)
* Remove unused scim_user table * update cabal file. * update cassandra dump. * Fix test descriptions. Co-authored-by: Matthias Fischmann <[email protected]>
* Added failing test * Haddocks. * Fix: when looking for uref fails, try email. * Fix name. Co-authored-by: Matthias Fischmann <[email protected]>
* Bump alpine to 3.12 for GHC * Install GHC using ghcup * Add ncurses-dev to prebuilder * Parametrize builder image using the same way as others * Upgrade to LTS 16.14, GHC 8.8.4 * Use upstream master branch of HaskelNet-SSL * Use merge-request branch of wai-predicates * Use merge-request branch of redis-io * Upgrade saml2-web-sso to support GHC 8.8 * Upgrade our fork of bloodhound to support GHC 8.8 * Replace 'mapM' with 'sequence $ map ...' in bonanza tests Bug report in GHC: https://gitlab.haskell.org/ghc/ghc/-/issues/18730 * Tidy up stack.yaml
…unt of servers … (#1206) limit list of SFT servers to 6, independent of the amount of servers in the SRV record. Co-authored-by: Akshay Mankar <[email protected]>
* Use mutable content for non-voip notifications and update limits Co-authored-by: Matthias Fischmann <[email protected]>
fisx
approved these changes
Oct 5, 2020
There was a problem hiding this comment.
https://github.com/zinfra/backend-issues/issues/1780 was indeed due to the team size limit, so this can go ahead! 👍
|
CI failures relate only to this flaky test: https://github.com/zinfra/backend-issues/issues/1789 (and general CI's kubernetes cluster being unwell) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
2020-10-05
Release Notes
With this release, the
setCookieDomainconfiguration (underbrig/config.optSettings) no longer has any effect, and can be removed.Security improvements
Bug Fixes
New Features
Internal changes