rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Open OIDC child session when assuming organization

Browse Source 
OIDC login dropped organization_id before the provider redirect, so
callbacks with an existing matching root session never created an org
child session. Persist organization_id in OIDC state, open the child
session on callback, and forward the parameter from the sign-in UI.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-06-17 18:16:47 +02:00
parent ee1439656b
commit 2c8ae26ea1
7 changed files with 202 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
pkg/coredata/migrations/20260617T120000Z.sql Normal file
View File

@@ -0,0 +1,15 @@
-- Copyright (c) 2026 Probo Inc <hello@probo.com>.
--
-- Permission to use, copy, modify, and/or distribute this software for any
-- purpose with or without fee is hereby granted, provided that the above
-- copyright notice and this permission notice appear in all copies.
--
-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-- PERFORMANCE OF THIS SOFTWARE.
ALTER TABLE iam_oidc_states ADD COLUMN organization_id TEXT;

37
pkg/coredata/oidc_state.go
View File

@@ -22,32 +22,35 @@ import (
"github.com/jackc/pgx/v5"
"go.gearno.de/kit/pg"
"go.probo.inc/probo/pkg/gid"
)
type OIDCState struct {
ID string `db:"id"`
Provider OIDCProvider `db:"provider"`
Nonce string `db:"nonce"`
CodeVerifier string `db:"code_verifier"`
ContinueURL string `db:"continue_url"`
CreatedAt time.Time `db:"created_at"`
ExpiresAt time.Time `db:"expires_at"`
ID string `db:"id"`
Provider OIDCProvider `db:"provider"`
Nonce string `db:"nonce"`
CodeVerifier string `db:"code_verifier"`
ContinueURL string `db:"continue_url"`
OrganizationID *gid.GID `db:"organization_id"`
CreatedAt time.Time `db:"created_at"`
ExpiresAt time.Time `db:"expires_at"`
}
func (s *OIDCState) Insert(ctx context.Context, conn pg.Tx) error {
query := `
INSERT INTO iam_oidc_states (id, provider, nonce, code_verifier, continue_url, created_at, expires_at)
VALUES (@id, @provider, @nonce, @code_verifier, @continue_url, @created_at, @expires_at)
INSERT INTO iam_oidc_states (id, provider, nonce, code_verifier, continue_url, organization_id, created_at, expires_at)
VALUES (@id, @provider, @nonce, @code_verifier, @continue_url, @organization_id, @created_at, @expires_at)
`
args := pgx.StrictNamedArgs{
"id": s.ID,
"provider": s.Provider,
"nonce": s.Nonce,
"code_verifier": s.CodeVerifier,
"continue_url": s.ContinueURL,
"created_at": s.CreatedAt,
"expires_at": s.ExpiresAt,
"id": s.ID,
"provider": s.Provider,
"nonce": s.Nonce,
"code_verifier": s.CodeVerifier,
"continue_url": s.ContinueURL,
"organization_id": s.OrganizationID,
"created_at": s.CreatedAt,
"expires_at": s.ExpiresAt,
}
_, err := conn.Exec(ctx, query, args)
@@ -60,7 +63,7 @@ VALUES (@id, @provider, @nonce, @code_verifier, @continue_url, @created_at, @exp
func (s *OIDCState) LoadByIDForUpdate(ctx context.Context, conn pg.Tx, id string) error {
query := `
SELECT id, provider, nonce, code_verifier, continue_url, created_at, expires_at
SELECT id, provider, nonce, code_verifier, continue_url, organization_id, created_at, expires_at
FROM iam_oidc_states
WHERE id = @id
FOR UPDATE