From 56c2c1cfe2421a8817d5bdde6e5b9f97806b2b1b Mon Sep 17 00:00:00 2001
From: Misi <mgyongyosi@users.noreply.github.com>
Date: Wed, 19 Nov 2025 09:48:09 +0100
Subject: [PATCH] IAM: Add validation to ExternalGroupMapping (#113957)

* Add validation before ExternalGroupMapping creation

* Add FIXME to implement team lookup

* Lint
---
 .../apis/iam/externalgroupmapping/validate.go | 22 +++++++++++++++++++
 pkg/registry/apis/iam/register.go             |  3 +++
 2 files changed, 25 insertions(+)
 create mode 100644 pkg/registry/apis/iam/externalgroupmapping/validate.go

diff --git a/pkg/registry/apis/iam/externalgroupmapping/validate.go b/pkg/registry/apis/iam/externalgroupmapping/validate.go
new file mode 100644
index 00000000000..851b77d8bd5
--- /dev/null
+++ b/pkg/registry/apis/iam/externalgroupmapping/validate.go
@@ -0,0 +1,22 @@
+package externalgroupmapping
+
+import (
+	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+)
+
+func ValidateOnCreate(obj *iamv0alpha1.ExternalGroupMapping) error {
+	if obj == nil {
+		return apierrors.NewBadRequest("object must not be nil")
+	}
+	if obj.Spec.TeamRef.Name == "" {
+		return apierrors.NewBadRequest("teamRef.name is required")
+	}
+
+	// FIXME: Add the ability to verify that the team exists in a follow up PR
+
+	if obj.Spec.ExternalGroupId == "" {
+		return apierrors.NewBadRequest("externalGroupId is required")
+	}
+	return nil
+}
diff --git a/pkg/registry/apis/iam/register.go b/pkg/registry/apis/iam/register.go
index e6b58f3c536..cc229f2ed4b 100644
--- a/pkg/registry/apis/iam/register.go
+++ b/pkg/registry/apis/iam/register.go
@@ -29,6 +29,7 @@ import (
 	grafanaregistry "github.com/grafana/grafana/pkg/apiserver/registry/generic"
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/registry/apis/iam/externalgroupmapping"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/noopstorage"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/resourcepermission"
@@ -490,6 +491,8 @@ func (b *IdentityAccessManagementAPIBuilder) Validate(ctx context.Context, a adm
 			return teambinding.ValidateOnCreate(ctx, typedObj)
 		case *iamv0.ResourcePermission:
 			return resourcepermission.ValidateCreateAndUpdateInput(ctx, typedObj)
+		case *iamv0.ExternalGroupMapping:
+			return externalgroupmapping.ValidateOnCreate(typedObj)
 		}
 		return nil
 	case admission.Update: