providers/scim: fix SCIM ID incorrectly used as primary key by BeryJu · Pull Request #9557 · goauthentik/authentik

BeryJu · 2024-05-03T13:14:48Z

Details

Previously we incorrectly used the SCIM ID given by the external system as a primary key on the SCIMUser and SCIMGroup objects, causing them to be globally unique. This PR fixes that by adding the scim_id column to hold this value, and set the primary key to a UUID

Checklist

Local tests pass (ak test authentik/)
The code has been formatted (make lint-fix)

If an API change has been made

The API schema has been updated (make gen-build)

If changes to the frontend have been made

The code has been formatted (make web)

If applicable

The documentation has been updated
The documentation has been formatted (make website)

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

netlify · 2024-05-03T13:15:03Z

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	`1cfd568`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/6637956d05296d0008076b5b
😎 Deploy Preview	https://deploy-preview-9557--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

netlify · 2024-05-03T13:15:03Z

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	`1cfd568`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/6637956d55f44f00084ea22e
😎 Deploy Preview	https://deploy-preview-9557--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

codecov · 2024-05-03T13:20:13Z

Codecov Report

Attention: Patch coverage is 94.28571% with 2 lines in your changes are missing coverage. Please review.

Project coverage is 92.52%. Comparing base (49cf10e) to head (1cfd568).
Report is 3 commits behind head on main.

Files	Patch %	Lines
authentik/providers/scim/clients/group.py	83.33%	1 Missing ⚠️
authentik/providers/scim/clients/user.py	83.33%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9557      +/-   ##
==========================================
+ Coverage   92.46%   92.52%   +0.06%     
==========================================
  Files         669      669              
  Lines       32751    32873     +122     
==========================================
+ Hits        30282    30415     +133     
+ Misses       2469     2458      -11

Flag	Coverage Δ
e2e	`50.57% <20.00%> (-0.06%)`	⬇️
integration	`25.93% <20.00%> (-0.06%)`	⬇️
unit	`89.82% <94.28%> (+0.06%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2024-05-03T13:35:47Z

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ghcr.io/goauthentik/dev-server:gh-1cfd56824244d4a4a1f7553d4d0830f57dbbb22f
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

For arm64, use these values:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ghcr.io/goauthentik/dev-server:gh-1cfd56824244d4a4a1f7553d4d0830f57dbbb22f-arm64
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
image:
    repository: ghcr.io/goauthentik/dev-server
    tag: gh-ghcr.io/goauthentik/dev-server:gh-1cfd56824244d4a4a1f7553d4d0830f57dbbb22f

For arm64, use these values:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
image:
    repository: ghcr.io/goauthentik/dev-server
    tag: gh-ghcr.io/goauthentik/dev-server:gh-1cfd56824244d4a4a1f7553d4d0830f57dbbb22f-arm64

Afterwards, run the upgrade commands from the latest release notes.

BeryJu · 2024-05-03T14:01:58Z

/cherry-pick version-2024.4

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

kensternberg-authentik

Looks standard. I'm glad to see the unique_together in the metadata, but should SCIM_ID also be "not empty" or adhere to a pattern for validation?

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* providers/scim: fix SCIM ID incorrectly used as primary key Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix unique together Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add test Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add check for empty scim ID Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io>

…ick #9557) (#9579) providers/scim: fix SCIM ID incorrectly used as primary key (#9557) * providers/scim: fix SCIM ID incorrectly used as primary key * fix unique together * add test * add check for empty scim ID --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens L <jens@goauthentik.io>

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

…#9384) * providers/google: initial account sync to google workspace Signed-off-by: Jens Langhammer <jens@goauthentik.io> * start separating scim sync client Signed-off-by: Jens Langhammer <jens@goauthentik.io> * generalize more...ish Signed-off-by: Jens Langhammer <jens@goauthentik.io> * set dispatch_uid Signed-off-by: Jens Langhammer <jens@goauthentik.io> * start generalizing task Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fully separate tasks Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix more Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix signals...? Signed-off-by: Jens Langhammer <jens@goauthentik.io> * start google dedupe Signed-off-by: Jens Langhammer <jens@goauthentik.io> * drawing the rest of the owl Signed-off-by: Jens Langhammer <jens@goauthentik.io> * more Signed-off-by: Jens Langhammer <jens@goauthentik.io> * juse use a whole lot less magic Signed-off-by: Jens Langhammer <jens@goauthentik.io> * member sync, better implement conflict/retry-able exceptions Signed-off-by: Jens Langhammer <jens@goauthentik.io> * max wizards taller Signed-off-by: Jens Langhammer <jens@goauthentik.io> * gen api, basic UI Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix some bugs Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix a bunch more bugs Signed-off-by: Jens Langhammer <jens@goauthentik.io> * generalize sync status API Signed-off-by: Jens Langhammer <jens@goauthentik.io> * rework sync chart Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add slugify to evaluator Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add test property mappings Signed-off-by: Jens Langhammer <jens@goauthentik.io> * rename to google workspace Signed-off-by: Jens Langhammer <jens@goauthentik.io> * handle existing objects Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix credential render Signed-off-by: Jens Langhammer <jens@goauthentik.io> * verify email has correct domain before syncing user Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix missing docstring Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix lock not being used Signed-off-by: Jens Langhammer <jens@goauthentik.io> * abstract more common stuff away Signed-off-by: Jens Langhammer <jens@goauthentik.io> * backport time limit fix #9546 Signed-off-by: Jens Langhammer <jens@goauthentik.io> * start discovery Signed-off-by: Jens Langhammer <jens@goauthentik.io> * implement discover for google Signed-off-by: Jens Langhammer <jens@goauthentik.io> * prevent same issue as with #9557 Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix sync status Signed-off-by: Jens Langhammer <jens@goauthentik.io> * make group name unique in API Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix reference to old wrapper Signed-off-by: Jens Langhammer <jens@goauthentik.io> * start adding tests man this api client is awful Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add SkipObject Signed-off-by: Jens Langhammer <jens@goauthentik.io> * dont use weak ref Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add group tests Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add user and group delete options Signed-off-by: Jens Langhammer <jens@goauthentik.io> * set user agent Signed-off-by: Jens Langhammer <jens@goauthentik.io> * if the api's testing tools are awful, let's just make our own Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add more tests and already fix some more bugs Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add discover Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add preview banner Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add group import test Signed-off-by: Jens Langhammer <jens@goauthentik.io> * only import users/groups in the correct parent group Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix conflicting args Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix missing schedule Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix web ui Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add default_group_email_domain Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io>

providers/scim: fix SCIM ID incorrectly used as primary key

e526f7d

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

BeryJu requested a review from a team as a code owner May 3, 2024 13:14

fix unique together

1997439

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

add test

04d2e62

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

kensternberg-authentik approved these changes May 3, 2024

View reviewed changes

add check for empty scim ID

1cfd568

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

BeryJu merged commit 3c54e94 into main May 5, 2024

BeryJu deleted the providers/scim/fix-incorrect-pk branch May 5, 2024 15:32

gcp-cherry-pick-bot bot mentioned this pull request May 5, 2024

providers/scim: fix SCIM ID incorrectly used as primary key (cherry-pick #9557) #9579

Merged

BeryJu added a commit that referenced this pull request May 6, 2024

prevent same issue as with #9557

aa08097

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

providers/scim: fix SCIM ID incorrectly used as primary key#9557

providers/scim: fix SCIM ID incorrectly used as primary key#9557
BeryJu merged 4 commits intomainfrom
providers/scim/fix-incorrect-pk

BeryJu commented May 3, 2024 •

edited

Loading

Uh oh!

netlify bot commented May 3, 2024 •

edited

Loading

Uh oh!

netlify bot commented May 3, 2024 •

edited

Loading

Uh oh!

codecov bot commented May 3, 2024 •

edited

Loading

Uh oh!

github-actions bot commented May 3, 2024 •

edited

Loading

Uh oh!

BeryJu commented May 3, 2024

Uh oh!

kensternberg-authentik left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

BeryJu commented May 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Checklist

Uh oh!

netlify bot commented May 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-storybook ready!

Uh oh!

netlify bot commented May 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-docs ready!

Uh oh!

codecov bot commented May 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented May 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BeryJu commented May 3, 2024

Uh oh!

kensternberg-authentik left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

BeryJu commented May 3, 2024 •

edited

Loading

netlify bot commented May 3, 2024 •

edited

Loading

netlify bot commented May 3, 2024 •

edited

Loading

codecov bot commented May 3, 2024 •

edited

Loading

github-actions bot commented May 3, 2024 •

edited

Loading