Repository navigation
feat(sso): the admin group makes its members admins in one organisation - #322
Merged
Merged
Conversation
…on (#321) FRANK_SSO_ADMIN_GROUP and FRANK_SSO_ADMIN_ORGANISATION (both or neither; the organisation must exist at start). The ID token's groups claim is read into the identity. At every sign-in, before the session: a member without a role, or with the one the group gave, is moved to the admin organisation and made admin; a user who has left the group loses that role and goes back to FRANK_SSO_ORGANISATION. Roles set by hand are never touched, and setting one by hand clears the mark. The marks live in a new table, sso_roles, added like ADR-017's tables. Audit lines role_granted and role_revoked, by sso. ADR-026 supersedes ADR-020 decision 5's "SSO never grants a role" for this one mapping; spec 012 requirement 9; README; deploy/stackit takes sso_admin_group and sso_admin_organisation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
make mcdc-obligations: the decisions in sso.rs and participants.rs moved. make test-mcdc: 48/48 decisions of two or more conditions covered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
FRANK_SSO_ADMIN_GROUP, e.g. Oktafrank-admins) are admins in one organisation (FRANK_SSO_ADMIN_ORGANISATION, e.g.sbp), from their first sign-in; leaving the group takes back the role it gave.email_verified: false, so linking a pre-created user is refused; with the group nobody has to be created in advance.Changes
Added
sso.rs: the two settings (both or neither, and only with the other SSO settings); the ID token'sgroupsclaim; the callback applies the group before the session starts and auditsrole_granted/role_revoked.store/participants.rs:sync_admin_group(split intogroup_may_change,grant_admin,revoke_adminfor CCN); tablesso_roles, created in files that lack it.serve.rs,cli.rs:--sso-admin-group,--sso-admin-organisation; the organisation must exist at start.deploy/stackit:sso_admin_group,sso_admin_organisation, with a precondition.Changed
set_roleclears the group's mark: a role set by hand is the command line's.remove_userclears it too.Changelog
FRANK_SSO_ADMIN_GROUPandFRANK_SSO_ADMIN_ORGANISATION, members of that provider group are admins in that organisation from their first sign-in; leaving the group takes back the role it gave. Roles set with the command line are never touched. Audit linesrole_grantedandrole_revoked.deploy/stackit:sso_admin_groupandsso_admin_organisation.Testing
tests/sso.rs): a signed ID token withgroups→core+ admin; without → back to the partner organisation, role gone; audit linesmake lint,make test,make check-assurance, lizard CCN ≤ 15 on the changed filesdeploy/stackit:tofu validate, template rendered with the admin groupRelated Issues
Closes #321
🤖 Generated with Claude Code