Implement shadow user creation by org manager #4113

svkrieger · 2024-11-28T11:32:40Z

A short explanation of the proposed change:

Implementation of the shadow user creation by org managers according to the RFC https://github.com/cloudfoundry/community/blob/main/toc/rfc/rfc-0033-user-creation-by-org-managers.md

Links to any other associated PRs

Add configuration to CAPI release: cloudfoundry/capi-release#491

I have reviewed the contributing guide
I have viewed, signed, and submitted the Contributor License Agreement
I have made this pull request to the main branch
I have run all the unit tests using bundle exec rake
I have run CF Acceptance Tests

app/controllers/v3/roles_controller.rb

lib/tasks/spec.rake

…dow user using username and origin

…/users

…/roles

svkrieger · 2025-01-07T14:04:57Z

To make sure that we don't break the behaviour before introducing this new feature the following table shows relevant scenarios before the change and the same scenarios after the change when the feature is disabled and no client is configured.

Test catalog before change

/v3/users endpoint

Privileges	User exists in UAA?	Origin	Request Method	Request path	data	Response Code	Response Body
admin	NO	!= uaa	POST	/v3/users	`'{"username":"[email protected]","origin":"keycloak.local"}'`	422 - Unprocessable Entity	`"Unknown field(s): 'username', 'origin', Guid must be a string, Guid must be between 1 and 200 characters"`
others	NO	!= uaa	POST	/v3/users	same	403 Forbidden	`"You are not authorized to perform the requested action"`
admin	NO	uaa	POST	/v3/users	`'{"username":"[email protected]","origin":"uaa"}'`	422 - Unprocessable Entity	`"Unknown field(s): 'username', 'origin', Guid must be a string, Guid must be between 1 and 200 characters"`
others	NO	uaa	POST	/v3/users	same	403 Forbidden	`"You are not authorized to perform the requested action"`
admin	NO	-	POST	/v3/users	`'{"guid":"some-guid"}'`	201 Created (this only creates a DB entry in CCDB)	user object (origin null, username null)
others	NO	-	POST	/v3/users	same	403 Forbidden	`"You are not authorized to perform the requested action"`
admin	YES	-	POST	/v3/users	`'{"guid":"some-guid"}'`	201 Created	user object (origin and username is set and comes from UAA)
others	YES	-	POST	/v3/users	same	403 Forbidden	`"You are not authorized to perform the requested action"`

/v3/roles endpoint

Privileges	User exists in UAA?	Origin	Request Method	Request path	data	Response Code	Response Body
admin	NO	uaa	POST	/v3/roles	org guid + username + origin + org auditor	422 Unprocessable Entity	`"No user exists with the username '[email protected]' and origin 'uaa'."`
org manager	NO	uaa	POST	/v3/roles	org guid + username + origin + org auditor	422 Unprocessable Entity	`"No user exists with the username '[email protected]' and origin 'uaa'."`
admin	NO	!= uaa	POST	/v3/roles	org guid + username + origin + org auditor	422 Unprocessable Entity	`"No user exists with the username '[email protected]' and origin 'keycloak.local'."`
org manager	NO	!= uaa	POST	/v3/roles	org guid + username + origin + org auditor	422 Unprocessable Entity	`"No user exists with the username '[email protected]' and origin 'keycloak.local'."`
others	NO	uaa	POST	/v3/roles	org guid + username + origin + org auditor	403 Forbidden	`"You are not authorized to perform the requested action"`
admin	YES	uaa	POST	/v3/roles	org guid + username + origin + org auditor	201 Created	role object
org manager	YES	uaa	POST	/v3/roles	org guid + username + origin + org auditor	201 Created	role object
admin	YES	!= uaa	POST	/v3/roles	org guid + username + origin + org auditor	201 Created	role object
org manager	YES	!= uaa	POST	/v3/roles	org guid + username + origin + org auditor	201 Created	role object

Test catalog after change when feature is disabled and no client config present

/v3/users endpoint

Privileges	User exists in UAA?	Origin	Request Method	Request path	data	Response Code	Response Body
admin	NO	!= uaa	POST	/v3/users	`'{"username":"[email protected]","origin":"keycloak.local"}'`	500 - Internal Server Error	`"An unknown error occurred."`
others	NO	!= uaa	POST	/v3/users	same	403 Forbidden	`"You are not authorized to perform the requested action"`
admin	NO	uaa	POST	/v3/users	`'{"username":"[email protected]","origin":"uaa"}'`	422 - Unprocessable Entity	`"Origin cannot be 'uaa' when creating a user by username"`
others	NO	uaa	POST	/v3/users	same	403 Forbidden	`"You are not authorized to perform the requested action"`
admin	NO	-	POST	/v3/users	`'{"guid":"some-guid"}'`	201 Created (this only creates a DB entry in CCDB)	user object (origin null, username null)
others	NO	-	POST	/v3/users	same	403 Forbidden	`"You are not authorized to perform the requested action"`
admin	YES	-	POST	/v3/users	`'{"guid":"some-guid"}'`	201 Created	user object (origin and username is set and comes from UAA)
others	YES	-	POST	/v3/users	same	403 Forbidden	`"You are not authorized to perform the requested action"`

/v3/roles endpoint

Privileges	User exists in UAA?	Origin	Request Method	Request path	data	Response Code	Response Body
admin	NO	uaa	POST	/v3/roles	org guid + username + origin + org auditor	422 Unprocessable Entity	`"No user exists with the username '[email protected]' and origin 'uaa'."`
org manager	NO	uaa	POST	/v3/roles	org guid + username + origin + org auditor	422 Unprocessable Entity	`"No user exists with the username '[email protected]' and origin 'uaa'."`
admin	NO	!= uaa	POST	/v3/roles	org guid + username + origin + org auditor	422 Unprocessable Entity	`"No user exists with the username '[email protected]' and origin 'keycloak.local'."`
org manager	NO	!= uaa	POST	/v3/roles	org guid + username + origin + org auditor	422 Unprocessable Entity	`"No user exists with the username '[email protected]' and origin 'keycloak.local'."`
others	NO	uaa	POST	/v3/roles	org guid + username + origin + org auditor	403 Forbidden	`"You are not authorized to perform the requested action"`
admin	YES	uaa	POST	/v3/roles	org guid + username + origin + org auditor	201 Created	role object
org manager	YES	uaa	POST	/v3/roles	org guid + username + origin + org auditor	201 Created	role object
admin	YES	!= uaa	POST	/v3/roles	org guid + username + origin + org auditor	201 Created	role object
org manager	YES	!= uaa	POST	/v3/roles	org guid + username + origin + org auditor	201 Created	role object

Changes in cloud_controller_ng: - Implement shadow user creation by org manager PR: cloudfoundry/cloud_controller_ng#4113 Author: Sven Krieger <[email protected]>

svkrieger mentioned this pull request Nov 28, 2024

Add config for shadow user creation cloudfoundry/capi-release#491

Merged

3 tasks

stephanme mentioned this pull request Nov 28, 2024

[RFC0033] User Creation by Org Managers cloudfoundry/community#1006

Open

svkrieger force-pushed the implement-shadow-user-creation-by-org-manager branch 5 times, most recently from 49439ba to 2c99e5d Compare December 2, 2024 13:27

svkrieger added the needs_review label Dec 2, 2024

jochenehret reviewed Dec 2, 2024

View reviewed changes

app/controllers/v3/roles_controller.rb Show resolved Hide resolved

svkrieger force-pushed the implement-shadow-user-creation-by-org-manager branch from 2c99e5d to 39a4b2a Compare December 3, 2024 09:57

svkrieger commented Dec 3, 2024

View reviewed changes

lib/tasks/spec.rake Outdated Show resolved Hide resolved

jochenehret previously approved these changes Dec 3, 2024

View reviewed changes

svkrieger dismissed jochenehret’s stale review via f7f2b3c December 5, 2024 14:45

svkrieger force-pushed the implement-shadow-user-creation-by-org-manager branch 2 times, most recently from 6a27ed1 to 626f8e6 Compare December 18, 2024 08:35

svkrieger added 14 commits January 7, 2025 13:41

Add username and origin to user create message

48d2226

Add uaa client for creating shadow users

c97ae1f

Enable UAA shadow user creation for POST /v3/users

d5cb693

Add error handling in case UAA is unavailable

9e28d7a

Disallow using origin 'uaa' when creating user by username

6c9f266

Allow org managers to create users by username

c37a438

Add config flag

9ae68a2

Adjust error handling and add unit tests

19ca8bb

Implement shadow user creation in /v3/roles endpoint

7625e65

Allow empty array in config for uaa->clients

3fc639c

Prevent calling UAA twice when creating new user through /v3/users

6841621

Add unit test for scenario feature off but admin can still create sha…

0b8be7d

…dow user using username and origin

First check whether user exists in UAA before trying to create in /v3…

3319199

…/users

First check whether user exists in UAA before trying to create in /v3…

2968960

…/roles

svkrieger force-pushed the implement-shadow-user-creation-by-org-manager branch from 626f8e6 to 2968960 Compare January 7, 2025 12:41

Improve user-create-message error messages

0e5ec31

svkrieger mentioned this pull request Jan 7, 2025

Add shadow user creation to docs #4164

Merged

5 tasks

svkrieger requested a review from jochenehret January 8, 2025 09:12

jochenehret approved these changes Jan 9, 2025

View reviewed changes

svkrieger merged commit 4e53164 into main Jan 9, 2025
8 checks passed

svkrieger deleted the implement-shadow-user-creation-by-org-manager branch January 9, 2025 10:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement shadow user creation by org manager #4113

Implement shadow user creation by org manager #4113

svkrieger commented Nov 28, 2024 •

edited

Loading

svkrieger commented Jan 7, 2025 •

edited

Loading

Implement shadow user creation by org manager #4113

Implement shadow user creation by org manager #4113

Conversation

svkrieger commented Nov 28, 2024 • edited Loading

A short explanation of the proposed change:

Links to any other associated PRs

svkrieger commented Jan 7, 2025 • edited Loading

Test catalog before change

/v3/users endpoint

/v3/roles endpoint

Test catalog after change when feature is disabled and no client config present

/v3/users endpoint

/v3/roles endpoint

svkrieger commented Nov 28, 2024 •

edited

Loading

svkrieger commented Jan 7, 2025 •

edited

Loading