Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Auth: Improve org role sync debugging #85146

Merged
merged 1 commit into from Mar 26, 2024
Merged

Auth: Improve org role sync debugging #85146

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
22 changes: 11 additions & 11 deletions pkg/services/authn/authnimpl/sync/org_sync.go
View file
Open in desktop
Expand Up @@ -33,31 +33,31 @@ func (s *OrgSync) SyncOrgRolesHook(ctx context.Context, id *authn.Identity, _ *a
return nil
}

ctxLogger := s.log.FromContext(ctx)
ctxLogger := s.log.FromContext(ctx).New("id", id.ID, "login", id.Login)

namespace, identifier := id.GetNamespacedID()
if namespace != authn.NamespaceUser {
ctxLogger.Warn("Failed to sync org role, invalid namespace for identity", "id", id.ID, "namespace", namespace)
ctxLogger.Warn("Failed to sync org role, invalid namespace for identity", "namespace", namespace)
return nil
}

userID, err := identity.IntIdentifier(namespace, identifier)
if err != nil {
ctxLogger.Warn("Failed to sync org role, invalid ID for identity", "id", id.ID, "namespace", namespace, "err", err)
ctxLogger.Warn("Failed to sync org role, invalid ID for identity", "namespace", namespace, "err", err)
return nil
}

ctxLogger.Debug("Syncing organization roles", "id", id.ID, "extOrgRoles", id.OrgRoles)
ctxLogger.Debug("Syncing organization roles", "extOrgRoles", id.OrgRoles)
// don't sync org roles if none is specified
if len(id.OrgRoles) == 0 {
ctxLogger.Debug("Not syncing organization roles since external user doesn't have any", "id", id.ID)
ctxLogger.Debug("Not syncing organization roles since external user doesn't have any")
return nil
}

orgsQuery := &org.GetUserOrgListQuery{UserID: userID}
result, err := s.orgService.GetUserOrgList(ctx, orgsQuery)
if err != nil {
ctxLogger.Error("Failed to get user's organizations", "id", id.ID, "error", err)
ctxLogger.Error("Failed to get user's organizations", "error", err)
return nil
}

Expand All @@ -75,7 +75,7 @@ func (s *OrgSync) SyncOrgRolesHook(ctx context.Context, id *authn.Identity, _ *a
// update role
cmd := &org.UpdateOrgUserCommand{OrgID: orga.OrgID, UserID: userID, Role: extRole}
if err := s.orgService.UpdateOrgUser(ctx, cmd); err != nil {
ctxLogger.Error("Failed to update active org user", "id", id.ID, "error", err)
ctxLogger.Error("Failed to update active org user", "error", err)
return err
}
}
Expand All @@ -93,17 +93,17 @@ func (s *OrgSync) SyncOrgRolesHook(ctx context.Context, id *authn.Identity, _ *a
cmd := &org.AddOrgUserCommand{UserID: userID, Role: orgRole, OrgID: orgId}
err := s.orgService.AddOrgUser(ctx, cmd)
if err != nil && !errors.Is(err, org.ErrOrgNotFound) {
ctxLogger.Error("Failed to update active org for user", "id", id.ID, "error", err)
ctxLogger.Error("Failed to update active org for user", "error", err)
return err
}
}

// delete any removed org roles
for _, orgID := range deleteOrgIds {
ctxLogger.Debug("Removing user's organization membership as part of syncing with OAuth login", "id", id.ID, "orgId", orgID)
ctxLogger.Debug("Removing user's organization membership as part of syncing with OAuth login", "orgId", orgID)
cmd := &org.RemoveOrgUserCommand{OrgID: orgID, UserID: userID}
if err := s.orgService.RemoveOrgUser(ctx, cmd); err != nil {
ctxLogger.Error("Failed to remove user from org", "id", id.ID, "orgId", orgID, "error", err)
ctxLogger.Error("Failed to remove user from org", "orgId", orgID, "error", err)
if errors.Is(err, org.ErrLastOrgAdmin) {
continue
}
Expand All @@ -112,7 +112,7 @@ func (s *OrgSync) SyncOrgRolesHook(ctx context.Context, id *authn.Identity, _ *a
}

if err := s.accessControl.DeleteUserPermissions(ctx, orgID, cmd.UserID); err != nil {
ctxLogger.Error("Failed to delete permissions for user", "id", id.ID, "orgId", orgID, "error", err)
ctxLogger.Error("Failed to delete permissions for user", "orgId", orgID, "error", err)
}
}

Expand Down