public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SCIM: validate external UID (#105046)

Browse Source 
* SCIM: validate externalUID

* better tests

* add additional test cases

* add externalID as field in fromUserToUserSchema

* fix test case
This commit is contained in:
colin-stuart
2025-05-08 13:59:55 -04:00
committed by GitHub
parent 1716696175
commit a5708105df
2 changed files with 197 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/authnimpl/sync/user_sync.go
+2 -2
View File
@@ -156,8 +156,8 @@ func (s *UserSync) ValidateUserProvisioningHook(ctx context.Context, id *authn.I
// Validate the provisioned user.ExternalUID with the authinfo.ExternalUID
if usr.IsProvisioned {
// The user is provisioned via SAML and the identity is empty, meaning this request is not from the SAML auth flow
if authInfo.AuthModule == login.SAMLAuthModule && authInfo.ExternalUID != "" && id.ExternalUID == "" {
// Allow non-SAML requests for SAML-provisioned users to proceed if incoming ExternalUID is empty (e.g. session access).
if authInfo.AuthModule == login.SAMLAuthModule && id.AuthenticatedBy != login.SAMLAuthModule && authInfo.ExternalUID != "" && id.ExternalUID == "" {
log.Debug("Skipping ExternalUID validation for non-SAML request to SAML-provisioned user")
return nil
}