Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix nested groups #188

Merged
merged 3 commits into from
Mar 26, 2024
Merged

Fix nested groups #188

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
10ec6aa
Update sync.go
ChrisPates Mar 26, 2024
9ec6bc5
Update sync.go
ChrisPates Mar 26, 2024
1db3cc1
Update sync.go
ChrisPates Mar 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
154 changes: 78 additions & 76 deletions internal/sync.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -391,7 +391,7 @@
log.Info("creating user")
_, err := s.aws.CreateUser(awsUser)
if err != nil {
errHttp := new(aws.ErrHttpNotOK)

Check failure on line 394 in internal/sync.go

View workflow job for this annotation

GitHub Actions / test 

var errHttp should be errHTTP
if errors.As(err, &errHttp) && errHttp.StatusCode == 409 {
log.WithField("user", awsUser.Username).Warn("user already exists")
continue
Expand Down Expand Up @@ -521,10 +521,31 @@
gUsers := make([]*admin.User, 0)
gGroupsUsers := make(map[string][]*admin.User)
gUserDetailCache := make(map[string]*admin.User)
gGroupDetailCache := make(map[string]*admin.Group)
gUniqUsers := make(map[string]*admin.User)

// For large directories this will reduce execution time and avoid throttling limits
log.Debug("Fetching ALL users from google, to use as cache")
googleUsers, err := s.google.GetUsers("*")
if err != nil {
return nil, nil, nil, err
}
for _, u := range googleUsers {
gUserDetailCache[u.PrimaryEmail] = u
}

log.Debug("Fetching ALL groups from google, to use as cache")
googleGroups, err := s.google.GetGroups("*")
if err != nil {
return nil, nil, nil, err
}
for _, g := range googleGroups {
gGroupDetailCache[g.Email] = g
}

// Fetch Users
log.Debug("get users from google, based on UserMatch, regardless of group membership")
googleUsers, err := s.google.GetUsers(queryUsers)
googleUsers, err = s.google.GetUsers(queryUsers)
if err != nil {
return nil, nil, nil, err
}
Expand Down Expand Up @@ -561,17 +582,6 @@
}
gGroups = filteredGoogleGroups

// For large directories this will reduce execution time and avoid throttling limits
log.Debug("Fetching ALL users from google, to use as cache, when processing the group memberships")
googleUsers, err = s.google.GetUsers("*")
if err != nil {
return nil, nil, nil, err
}

for _, u := range googleUsers {
gUserDetailCache[u.PrimaryEmail] = u
}

log.Debug("for each group retrieve the group members")
for _, g := range gGroups {

Expand All @@ -583,54 +593,13 @@
}

log.Debug("get group members from google")
groupMembers, err := s.google.GetGroupMembers(g)
if err != nil {
return nil, nil, nil, err
}

log.Debug("get users")
membersUsers := make([]*admin.User, 0)

for _, m := range groupMembers {
log.WithField("email", m.Email).Debug("processing member")
// Ignore Owners they aren't relevant in Identity Store
if m.Role == "OWNER" {
log.WithField("id", m.Email).Debug("ignoring owner roles")
continue
}

// Ignore any external members, since they don't have users
// that can be synced
if m.Type == "USER" && m.Status != "ACTIVE" {
log.WithField("id", m.Email).Warn("ignoring external user")
continue
}

// handle nested groups, by adding their membership to the end
// of googleMembers
if m.Type == "GROUP" {
groupMembers = append (groupMembers, s.getGoogleSubGroupMembers(m)...)
continue
}
// Remove any users that should be ignored
if s.ignoreUser(m.Email) {
log.WithField("id", m.Email).Debug("ignoring user")
continue
}

// Find the group member in the cache of UserDetails
_, found := gUserDetailCache[m.Email]
if found {
membersUsers = append(membersUsers, gUserDetailCache[m.Email])
} else {
log.WithField("id", m.Email).Warn("missing user")
continue
}
membersUsers := s.getGoogleUsersInGroup(g, gUserDetailCache, gGroupDetailCache)

// If we've not seen the user email address before add it to the list of unique users
_, ok := gUniqUsers[m.Email]
// If we've not seen the user email address before add it to the list of unique users
for _, m := range membersUsers {
_, ok := gUniqUsers[m.PrimaryEmail]
if !ok {
gUniqUsers[m.Email] = gUserDetailCache[m.Email]
gUniqUsers[m.PrimaryEmail] = gUserDetailCache[m.PrimaryEmail]
}
}
gGroupsUsers[g.Name] = membersUsers
Expand Down Expand Up @@ -809,7 +778,7 @@
if err != nil {
log.WithField("error", err).Warn("Problem performing test query against Identity Store")
return err
} else {

Check failure on line 781 in internal/sync.go

View workflow job for this annotation

GitHub Actions / test 

if block ends with a return statement, so drop this else and outdent its block
log.WithField("Groups", response).Info("Test call for groups successful")

}
Expand Down Expand Up @@ -888,7 +857,7 @@
return awsGroups, nil
}

func ListGroupsPagesCallbackFn(page *identitystore.ListGroupsOutput, lastPage bool) bool {

Check failure on line 860 in internal/sync.go

View workflow job for this annotation

GitHub Actions / test 

exported function ListGroupsPagesCallbackFn should have comment or be unexported
// Loop through each Group returned
for _, group := range page.Groups {
// Convert to native Group object
Expand Down Expand Up @@ -920,7 +889,7 @@
return awsUsers, nil
}

func ListUsersPagesCallbackFn(page *identitystore.ListUsersOutput, lastPage bool) bool {

Check failure on line 892 in internal/sync.go

View workflow job for this annotation

GitHub Actions / test 

exported function ListUsersPagesCallbackFn should have comment or be unexported
// Loop through each User in ListUsersOutput and convert to native User object
for _, user := range page.Users {
awsUsers = append(awsUsers, ConvertSdkUserObjToNative(user))
Expand All @@ -928,7 +897,7 @@
return !lastPage
}

func ConvertSdkUserObjToNative(user *identitystore.User) *aws.User {

Check failure on line 900 in internal/sync.go

View workflow job for this annotation

GitHub Actions / test 

exported function ConvertSdkUserObjToNative should have comment or be unexported
// Convert emails into native Email object
userEmails := make([]aws.UserEmail, 0)

Expand Down Expand Up @@ -972,7 +941,7 @@
}
}

func CreateUserIDtoUserObjMap(awsUsers []*aws.User) map[string]*aws.User {

Check failure on line 944 in internal/sync.go

View workflow job for this annotation

GitHub Actions / test 

exported function CreateUserIDtoUserObjMap should have comment or be unexported
awsUsersMap := make(map[string]*aws.User)

for _, awsUser := range awsUsers {
Expand All @@ -982,7 +951,7 @@
return awsUsersMap
}

var ListGroupMembershipPagesCallbackFn func(page *identitystore.ListGroupMembershipsOutput, lastPage bool) bool

Check failure on line 954 in internal/sync.go

View workflow job for this annotation

GitHub Actions / test 

exported var ListGroupMembershipPagesCallbackFn should have comment or be unexported

func (s *syncGSuite) GetGroupMembershipsLists(awsGroups []*aws.Group, awsUsersMap map[string]*aws.User) (map[string][]*aws.User, error) {
awsGroupsUsers := make(map[string][]*aws.User)
Expand Down Expand Up @@ -1067,26 +1036,59 @@
return nil
}

func (s *syncGSuite) getGoogleSubGroupMembers(m *admin.Member) []*admin.Member {
log.WithField("Email", m.Email).Debug("getGoogleSubGroupMembers()")
// retrieve the members of a group
g, err := s.google.GetGroups("email="+ m.Email)
if err != nil {
log.WithField("error:", err).Error("failed to retrieve group")
return nil
}
func (s *syncGSuite) getGoogleUsersInGroup(group *admin.Group, userCache map[string]*admin.User, groupCache map[string]*admin.Group) []*admin.User {
log.WithField("Email:", group.Email).Debug("getGoogleGroupMembers()")

// retrieve the members of the group
groupMembers, err := s.google.GetGroupMembers(group)
if err != nil {
return nil
}
membersUsers := make([]*admin.User, 0)

// process the members of the group
for _, m := range groupMembers {
log.WithField("email", m.Email).Debug("processing member")
// Ignore Owners they aren't relevant in Identity Store
if m.Role == "OWNER" {
log.WithField("id", m.Email).Debug("ignoring owner roles")
continue
}

// Ignore any external members, since they don't have users
// that can be synced
if m.Type == "USER" && m.Status != "ACTIVE" {
log.WithField("id", m.Email).Warn("ignoring external user")
continue
}

if len(g) == 1 {
log.WithField("Id", g).Debug("fetch members")
// handle nested groups, by adding their membership to the end
// of googleMembers
if m.Type == "GROUP" {
log.WithField("Email:", m.Email).Debug("calling getGoogleGroupMembers() for nested group")
_, found := groupCache[m.Email]
if found {
membersUsers = append (membersUsers, s.getGoogleUsersInGroup(groupCache[m.Email], userCache, groupCache)...)
} else {
log.WithField("id", m.Email).Warn("missing nested group")
}
continue
}
// Remove any users that should be ignored
if s.ignoreUser(m.Email) {
log.WithField("id", m.Email).Debug("ignoring user")
continue
}

groupMembers, err := s.google.GetGroupMembers(g[0])
if err != nil {
log.WithField("error:", err).Error("get group Members failed")
return nil
// Find the group member in the cache of UserDetails
_, found := userCache[m.Email]
if found {
membersUsers = append(membersUsers, userCache[m.Email])
} else {
log.WithField("id", m.Email).Warn("missing user")
continue
}
return groupMembers
} else {
log.Error("No group found")
}
return nil

return membersUsers
}
Loading