Codestin Search App

alexmt · 2018-11-14T23:47:31Z

PR contains a subset of changes implemented in #1184. Original PR had been closed without merging since it accumulated too many changes and authors decided to maintain a fork.

This change unblocks an important use case: give read-only access to anyone and give extra privileges to users which belongs to the specified group.

…en no org is specified

alexmt · 2018-11-14T23:49:07Z

PS:

We are using Dex to get seamless SSO in https://github.com/argoproj/argo-cd . Dex saved us a lot of time. Thank you for maintaining it!

srenatus · 2018-11-15T12:53:10Z

We are using Dex to get seamless SSO in https://github.com/argoproj/argo-cd . Dex saved us a lot of time. Thank you for maintaining it!

😄 That's nice! The more, the merrier, so, if you or someone else wants to join maintaining Dex, please don't hesitate 😉 #1281 is still dangling, but that shouldn't block anyone.

srenatus

Solid work, thank you! Some nitpicks and questions inline 👇 🙃

srenatus · 2018-11-15T12:56:46Z

 	return nil, nil
 }

+// formatTeamName return unique team name: prgs might have the same team names team name should be prefixed with org name to make team names unique across orgs.


[nit] Could you add a line break, and maybe some punctuation? 😉

Sure, fixed.

srenatus · 2018-11-15T12:58:23Z

 	return groups, fmt.Errorf("github: user %q not in required orgs or teams", userName)
 }

+func (c *githubConnector) userGroups(ctx context.Context, client *http.Client) (groups []string, err error) {


[nit] I hate named returns. Do you cling to them? (It's a bit of a controversial thing, I guess, and it's difficult to get these matters smoothed across the code base...)

I don't really like named returns as well. Fixed.

srenatus · 2018-11-15T13:00:51Z

+func (c *githubConnector) userGroups(ctx context.Context, client *http.Client) (groups []string, err error) {
+	orgs, err := c.userOrgs(ctx, client)
+	if err != nil {
+		return groups, err


[nit] How about return nil, err? A lot less "huh, what's groups?" when reading this 😉

srenatus · 2018-11-15T13:01:01Z

+
+	orgTeams, err := c.userOrgTeams(ctx, client)
+	if err != nil {
+		return groups, err


[nit] see above

srenatus · 2018-11-15T13:01:42Z

+		}
+	}
+
+	return groups, err


[nit] return groups, nil, maybe? Just for clarity

Agree. Fixed

srenatus · 2018-11-15T13:02:05Z

+
+// userOrgs retrieves list of current user orgs
+func (c *githubConnector) userOrgs(ctx context.Context, client *http.Client) ([]string, error) {
+	apiURL, groups := c.apiURL+"/user/orgs", []string{}


[nit] I guess it wouldn't hurt to use two lines here 😉

srenatus · 2018-11-15T13:04:20Z

+			return nil, fmt.Errorf("github: get orgs: %v", err)
+		}
+
+		for _, org := range orgs {


[nit] we're shadowing the type org here, can we use some other name? I suppose for _, o := range orgs { would't be too terrible, either

Renamed to o

srenatus · 2018-11-15T13:04:54Z

+			return nil, fmt.Errorf("github: get teams: %v", err)
+		}
+
+		for _, team := range teams {


[nit] see above, team variable vs team struct type

Renamed to t

srenatus · 2018-11-15T13:07:23Z

+	if !reflect.DeepEqual(a, b) {
+		t.Errorf("Expected %+v to equal %+v", a, b)
+	}
+}


❓ Am I just not seeing it or is it missing: Can we have a test that ensures the pagination for {} loops work as they should? https://github.com/dexidp/dex/pull/1340/files#diff-de977d377b738d6060529d91926d264bR432 and https://github.com/dexidp/dex/pull/1340/files#diff-de977d377b738d6060529d91926d264bR406 -- right now, I think we're only doing one iteration of each. (Not sure where we stand with the existing code and this question, either.)

You are right. Updated test to validate pagination.

Thank you!

Would you mind fixing the comment on getPagination? It's a bit confusing (it's not returning a boolean at all, is it?) and you surely have all the context right now... 😃

Sure. Done: a9f71e3

…ination

alexmt · 2018-11-15T16:19:50Z

Thank you for quick review @srenatus ! Addressed your comments. Please take another look.

srenatus

Thanks. Just one tiny ask, and then let's get this merged 😄

srenatus · 2018-11-15T16:41:39Z

+	}
+
+	groups := make([]string, 0)
+	for _, org := range orgs {


[nit] we're still shadowing org and team here, but it really doesn't matter that much.

make sense to fix it. Done: e876353

srenatus · 2018-11-15T16:46:36Z

+	if !reflect.DeepEqual(a, b) {
+		t.Errorf("Expected %+v to equal %+v", a, b)
+	}
+}


Thank you!

Would you mind fixing the comment on getPagination? It's a bit confusing (it's not returning a boolean at all, is it?) and you surely have all the context right now... 😃

srenatus · 2018-11-15T16:59:52Z

@alexmt Thanks for all the work. Could you make your changes reflect in the connector docs? It would really round this off, I'd think 😄

…l user groups

alexmt · 2018-11-15T17:28:30Z

Thank you for reminding about docs! While updating it I've noticed a bug: teamNameField was not taken into account.
Updated documentation and fixed bug as well (ce3cd53 )

PTAL

alexmt · 2018-11-15T17:32:05Z

I don't have permissions to merge. @srenatus please merge it if everything looks good to you.

srenatus · 2018-11-15T18:05:06Z

@alexmt I'll give this a final look and push the button first thing tomorrow morning. Hope that's OK

alexmt · 2018-11-15T18:14:32Z

Sure, there is no rush. Thank you !

vito · 2018-11-15T21:03:25Z

Sweet, happy to see this alive again! I work with the original submitter of #1184 on Concourse. We're planning to submit PRs for our other changes soon. We don't intend to sit on our fork forever. 🙂

alexmt · 2018-11-15T22:10:06Z

Thanks for working on original PR, @vito ! I think 94cb3da would be very useful!

…team_name

alexmt · 2018-11-15T22:16:04Z

@srenatus , I've added one more last-minute change: 20bc6cd

I believe this proposal is correct: #1102 (comment) . Full claims list should include user teams (in org:team format) as well as org names. E.g.

[
    "org-1",
    "org-1:team-1",
    "org-1:team-2",
    "org-1:team-3",
    "org-2",
    "org-2:team-4",
    "org-3"
]

This make it possible for application which uses dex to match org as well as team.

srenatus · 2018-11-16T07:37:57Z

@alexmt @vito While code-wise, this looks good to merge, I'm a bit conflicted about attribution now. Can you help me clarify? It looks like some of the connector code is by @pivotal-jwinters, but given

I work with the original submitter of #1184 on Concourse.

I trust that @pivotal-jwinters is OK with that. Anyways, a quick thumbs-up would be appreciated, @pivotal-jwinters.

We're planning to submit PRs for our other changes soon. We don't intend to sit on our fork forever.

Also, I'm glad to hear that 😄

Issue dexidp#1184 - Github connector now returns a full group list when no org is specified

Issue dexidp#1184 - Github connector now returns a full group list wh…

51d9b3d

…en no org is specified

srenatus reviewed Nov 15, 2018

View reviewed changes

Apply reviewer notes: style changes, make sure unit test verifies pag…

e10b823

…ination

srenatus approved these changes Nov 15, 2018

View reviewed changes

Update getPagination method comment

a9f71e3

Alexander Matyushentsev added 3 commits November 15, 2018 09:00

Rename variables to stop shadowing package name

e876353

Bug fix: take into account 'teamNameField' settings while fetching al…

ce3cd53

…l user groups

Update github connector documentation

e5ebcf5

Full list of groups should include group names as well as group_name:…

20bc6cd

…team_name

alexmt force-pushed the 1184-github-groups branch from 3f3f56d to 20bc6cd Compare November 15, 2018 22:13

srenatus merged commit 2425c6e into dexidp:master Nov 16, 2018

alexmt deleted the 1184-github-groups branch November 18, 2018 21:28

This was referenced Nov 19, 2018

Issue #1102 - Add config to explicitly enable loading all github groups #1349

Merged

SSO should support readonly for all authorized github users argoproj/argo-cd#811

Closed

mmrath pushed a commit to mmrath/dex that referenced this pull request Sep 2, 2019

Merge pull request dexidp#1340 from alexmt/1184-github-groups

15df56e

Issue dexidp#1184 - Github connector now returns a full group list when no org is specified

Conversation

alexmt commented Nov 14, 2018

Uh oh!

alexmt commented Nov 14, 2018

Uh oh!

srenatus commented Nov 15, 2018

Uh oh!

srenatus left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexmt commented Nov 15, 2018

Uh oh!

srenatus left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

srenatus commented Nov 15, 2018

Uh oh!

alexmt commented Nov 15, 2018

Uh oh!

alexmt commented Nov 15, 2018

Uh oh!

srenatus commented Nov 15, 2018

Uh oh!

alexmt commented Nov 15, 2018

Uh oh!

vito commented Nov 15, 2018

Uh oh!

alexmt commented Nov 15, 2018

Uh oh!

alexmt commented Nov 15, 2018

Uh oh!

srenatus commented Nov 16, 2018

Uh oh!

Reviewers