diff --git a/apps/console/src/hooks/graph/SAMLConfigurationGraph.ts b/apps/console/src/hooks/graph/SAMLConfigurationGraph.ts index 4e3767fa3..5df137a64 100644 --- a/apps/console/src/hooks/graph/SAMLConfigurationGraph.ts +++ b/apps/console/src/hooks/graph/SAMLConfigurationGraph.ts @@ -30,7 +30,6 @@ const createSAMLConfigurationMutation = graphql` attributeFirstname attributeLastname attributeRole - defaultRole autoSignupEnabled createdAt updatedAt @@ -61,7 +60,6 @@ const updateSAMLConfigurationMutation = graphql` attributeFirstname attributeLastname attributeRole - defaultRole autoSignupEnabled createdAt updatedAt diff --git a/apps/console/src/hooks/graph/__generated__/OrganizationGraph_ViewQuery.graphql.ts b/apps/console/src/hooks/graph/__generated__/OrganizationGraph_ViewQuery.graphql.ts index 846b7d3b9..1b707dc87 100644 --- a/apps/console/src/hooks/graph/__generated__/OrganizationGraph_ViewQuery.graphql.ts +++ b/apps/console/src/hooks/graph/__generated__/OrganizationGraph_ViewQuery.graphql.ts @@ -1,5 +1,5 @@ /** - * @generated SignedSource<<220f85396d6d4c5c04f730d07aaa42e1>> + * @generated SignedSource<<11a62d34dafa502e3a464b91e12728ea>> * @lightSyntaxTransform * @nogrep */ @@ -621,13 +621,6 @@ return { "name": "attributeRole", "storageKey": null }, - { - "alias": null, - "args": null, - "kind": "ScalarField", - "name": "defaultRole", - "storageKey": null - }, { "alias": null, "args": null, @@ -648,12 +641,12 @@ return { ] }, "params": { - "cacheID": "782dc2328cea4f0c350427bda92a5615", + "cacheID": "a44a7b84f5f4c569d028f1d88deadb99", "id": null, "metadata": {}, "name": "OrganizationGraph_ViewQuery", "operationKind": "query", - "text": "query OrganizationGraph_ViewQuery(\n $organizationId: ID!\n) {\n node(id: $organizationId) {\n __typename\n ... on Organization {\n id\n name\n ...SettingsPageFragment\n }\n id\n }\n}\n\nfragment DomainSettingsTabFragment on Organization {\n id\n customDomain {\n id\n domain\n sslStatus\n dnsRecords {\n type\n name\n value\n ttl\n purpose\n }\n createdAt\n updatedAt\n sslExpiresAt\n }\n}\n\nfragment GeneralSettingsTabFragment on Organization {\n id\n name\n logoUrl\n horizontalLogoUrl\n description\n websiteUrl\n email\n headquarterAddress\n createdAt\n updatedAt\n}\n\nfragment MembersSettingsTabInvitationsFragment on Organization {\n invitations(first: 20, orderBy: {direction: ASC, field: CREATED_AT}) {\n totalCount\n edges {\n node {\n id\n fullName\n email\n role\n status\n createdAt\n expiresAt\n acceptedAt\n __typename\n }\n cursor\n }\n pageInfo {\n endCursor\n hasNextPage\n hasPreviousPage\n startCursor\n }\n }\n id\n}\n\nfragment MembersSettingsTabMembershipsFragment on Organization {\n memberships(first: 20, orderBy: {direction: ASC, field: CREATED_AT}) {\n totalCount\n edges {\n node {\n id\n fullName\n emailAddress\n role\n authMethod\n createdAt\n __typename\n }\n cursor\n }\n pageInfo {\n endCursor\n hasNextPage\n hasPreviousPage\n startCursor\n }\n }\n id\n}\n\nfragment SAMLSettingsTabFragment on Organization {\n id\n name\n samlConfigurations {\n id\n enabled\n emailDomain\n enforcementPolicy\n domainVerified\n domainVerificationToken\n domainVerifiedAt\n spEntityId\n spAcsUrl\n spMetadataUrl\n testLoginUrl\n idpEntityId\n idpSsoUrl\n idpCertificate\n idpMetadataUrl\n attributeEmail\n attributeFirstname\n attributeLastname\n attributeRole\n defaultRole\n autoSignupEnabled\n }\n}\n\nfragment SettingsPageFragment on Organization {\n id\n name\n ...GeneralSettingsTabFragment\n ...MembersSettingsTabMembershipsFragment\n ...MembersSettingsTabInvitationsFragment\n ...DomainSettingsTabFragment\n ...SAMLSettingsTabFragment\n}\n" + "text": "query OrganizationGraph_ViewQuery(\n $organizationId: ID!\n) {\n node(id: $organizationId) {\n __typename\n ... on Organization {\n id\n name\n ...SettingsPageFragment\n }\n id\n }\n}\n\nfragment DomainSettingsTabFragment on Organization {\n id\n customDomain {\n id\n domain\n sslStatus\n dnsRecords {\n type\n name\n value\n ttl\n purpose\n }\n createdAt\n updatedAt\n sslExpiresAt\n }\n}\n\nfragment GeneralSettingsTabFragment on Organization {\n id\n name\n logoUrl\n horizontalLogoUrl\n description\n websiteUrl\n email\n headquarterAddress\n createdAt\n updatedAt\n}\n\nfragment MembersSettingsTabInvitationsFragment on Organization {\n invitations(first: 20, orderBy: {direction: ASC, field: CREATED_AT}) {\n totalCount\n edges {\n node {\n id\n fullName\n email\n role\n status\n createdAt\n expiresAt\n acceptedAt\n __typename\n }\n cursor\n }\n pageInfo {\n endCursor\n hasNextPage\n hasPreviousPage\n startCursor\n }\n }\n id\n}\n\nfragment MembersSettingsTabMembershipsFragment on Organization {\n memberships(first: 20, orderBy: {direction: ASC, field: CREATED_AT}) {\n totalCount\n edges {\n node {\n id\n fullName\n emailAddress\n role\n authMethod\n createdAt\n __typename\n }\n cursor\n }\n pageInfo {\n endCursor\n hasNextPage\n hasPreviousPage\n startCursor\n }\n }\n id\n}\n\nfragment SAMLSettingsTabFragment on Organization {\n id\n name\n samlConfigurations {\n id\n enabled\n emailDomain\n enforcementPolicy\n domainVerified\n domainVerificationToken\n domainVerifiedAt\n spEntityId\n spAcsUrl\n spMetadataUrl\n testLoginUrl\n idpEntityId\n idpSsoUrl\n idpCertificate\n idpMetadataUrl\n attributeEmail\n attributeFirstname\n attributeLastname\n attributeRole\n autoSignupEnabled\n }\n}\n\nfragment SettingsPageFragment on Organization {\n id\n name\n ...GeneralSettingsTabFragment\n ...MembersSettingsTabMembershipsFragment\n ...MembersSettingsTabInvitationsFragment\n ...DomainSettingsTabFragment\n ...SAMLSettingsTabFragment\n}\n" } }; })(); diff --git a/apps/console/src/hooks/graph/__generated__/SAMLConfigurationGraphCreateMutation.graphql.ts b/apps/console/src/hooks/graph/__generated__/SAMLConfigurationGraphCreateMutation.graphql.ts index 89a1ee911..4cefd9a42 100644 --- a/apps/console/src/hooks/graph/__generated__/SAMLConfigurationGraphCreateMutation.graphql.ts +++ b/apps/console/src/hooks/graph/__generated__/SAMLConfigurationGraphCreateMutation.graphql.ts @@ -1,5 +1,5 @@ /** - * @generated SignedSource<<9232c5fa755e56b6a1ecdcdd51ad83db>> + * @generated SignedSource<<96f7708613cbb65e52114d120499ed46>> * @lightSyntaxTransform * @nogrep */ @@ -16,7 +16,6 @@ export type CreateSAMLConfigurationInput = { attributeLastname?: string | null | undefined; attributeRole?: string | null | undefined; autoSignupEnabled?: boolean | null | undefined; - defaultRole?: string | null | undefined; emailDomain: string; enforcementPolicy: SAMLEnforcementPolicy; idpCertificate?: string | null | undefined; @@ -40,7 +39,6 @@ export type SAMLConfigurationGraphCreateMutation$data = { readonly attributeRole: string; readonly autoSignupEnabled: boolean; readonly createdAt: any; - readonly defaultRole: string; readonly emailDomain: string; readonly enabled: boolean; readonly enforcementPolicy: SAMLEnforcementPolicy; @@ -205,13 +203,6 @@ v1 = [ "name": "attributeRole", "storageKey": null }, - { - "alias": null, - "args": null, - "kind": "ScalarField", - "name": "defaultRole", - "storageKey": null - }, { "alias": null, "args": null, @@ -258,16 +249,16 @@ return { "selections": (v1/*: any*/) }, "params": { - "cacheID": "71d5f80565cc8bc4cef0382c315b8cb1", + "cacheID": "1ee756f7dd01d0faf7f23b8291f70c20", "id": null, "metadata": {}, "name": "SAMLConfigurationGraphCreateMutation", "operationKind": "mutation", - "text": "mutation SAMLConfigurationGraphCreateMutation(\n $input: CreateSAMLConfigurationInput!\n) {\n createSAMLConfiguration(input: $input) {\n samlConfiguration {\n id\n enabled\n emailDomain\n enforcementPolicy\n spEntityId\n spAcsUrl\n spMetadataUrl\n testLoginUrl\n idpEntityId\n idpSsoUrl\n idpCertificate\n idpMetadataUrl\n attributeEmail\n attributeFirstname\n attributeLastname\n attributeRole\n defaultRole\n autoSignupEnabled\n createdAt\n updatedAt\n }\n }\n}\n" + "text": "mutation SAMLConfigurationGraphCreateMutation(\n $input: CreateSAMLConfigurationInput!\n) {\n createSAMLConfiguration(input: $input) {\n samlConfiguration {\n id\n enabled\n emailDomain\n enforcementPolicy\n spEntityId\n spAcsUrl\n spMetadataUrl\n testLoginUrl\n idpEntityId\n idpSsoUrl\n idpCertificate\n idpMetadataUrl\n attributeEmail\n attributeFirstname\n attributeLastname\n attributeRole\n autoSignupEnabled\n createdAt\n updatedAt\n }\n }\n}\n" } }; })(); -(node as any).hash = "04237f5ad3588264149310798d6137f2"; +(node as any).hash = "43058268e0b04e8b8a83ce91b8908bf7"; export default node; diff --git a/apps/console/src/hooks/graph/__generated__/SAMLConfigurationGraphUpdateMutation.graphql.ts b/apps/console/src/hooks/graph/__generated__/SAMLConfigurationGraphUpdateMutation.graphql.ts index 0067b1aa7..a1c569f91 100644 --- a/apps/console/src/hooks/graph/__generated__/SAMLConfigurationGraphUpdateMutation.graphql.ts +++ b/apps/console/src/hooks/graph/__generated__/SAMLConfigurationGraphUpdateMutation.graphql.ts @@ -1,5 +1,5 @@ /** - * @generated SignedSource<<694befcb248cbb23e66b9555626f223b>> + * @generated SignedSource<<700f12180d1cfa94050704af029b84d7>> * @lightSyntaxTransform * @nogrep */ @@ -16,7 +16,6 @@ export type UpdateSAMLConfigurationInput = { attributeLastname?: string | null | undefined; attributeRole?: string | null | undefined; autoSignupEnabled?: boolean | null | undefined; - defaultRole?: string | null | undefined; enabled?: boolean | null | undefined; enforcementPolicy?: SAMLEnforcementPolicy | null | undefined; id: string; @@ -39,7 +38,6 @@ export type SAMLConfigurationGraphUpdateMutation$data = { readonly attributeRole: string; readonly autoSignupEnabled: boolean; readonly createdAt: any; - readonly defaultRole: string; readonly emailDomain: string; readonly enabled: boolean; readonly enforcementPolicy: SAMLEnforcementPolicy; @@ -204,13 +202,6 @@ v1 = [ "name": "attributeRole", "storageKey": null }, - { - "alias": null, - "args": null, - "kind": "ScalarField", - "name": "defaultRole", - "storageKey": null - }, { "alias": null, "args": null, @@ -257,16 +248,16 @@ return { "selections": (v1/*: any*/) }, "params": { - "cacheID": "c9e4055888055b109aa71b665c9544ca", + "cacheID": "f8407666643c559232d42e8302c1e917", "id": null, "metadata": {}, "name": "SAMLConfigurationGraphUpdateMutation", "operationKind": "mutation", - "text": "mutation SAMLConfigurationGraphUpdateMutation(\n $input: UpdateSAMLConfigurationInput!\n) {\n updateSAMLConfiguration(input: $input) {\n samlConfiguration {\n id\n enabled\n emailDomain\n enforcementPolicy\n spEntityId\n spAcsUrl\n spMetadataUrl\n testLoginUrl\n idpEntityId\n idpSsoUrl\n idpCertificate\n idpMetadataUrl\n attributeEmail\n attributeFirstname\n attributeLastname\n attributeRole\n defaultRole\n autoSignupEnabled\n createdAt\n updatedAt\n }\n }\n}\n" + "text": "mutation SAMLConfigurationGraphUpdateMutation(\n $input: UpdateSAMLConfigurationInput!\n) {\n updateSAMLConfiguration(input: $input) {\n samlConfiguration {\n id\n enabled\n emailDomain\n enforcementPolicy\n spEntityId\n spAcsUrl\n spMetadataUrl\n testLoginUrl\n idpEntityId\n idpSsoUrl\n idpCertificate\n idpMetadataUrl\n attributeEmail\n attributeFirstname\n attributeLastname\n attributeRole\n autoSignupEnabled\n createdAt\n updatedAt\n }\n }\n}\n" } }; })(); -(node as any).hash = "d572af05811d6a05cdd4446fe175894d"; +(node as any).hash = "c246d5e0bbebabf2bfbba5465e937f44"; export default node; diff --git a/apps/console/src/pages/organizations/settings/SAMLSettingsTab.tsx b/apps/console/src/pages/organizations/settings/SAMLSettingsTab.tsx index 9154eac22..0682daa6d 100644 --- a/apps/console/src/pages/organizations/settings/SAMLSettingsTab.tsx +++ b/apps/console/src/pages/organizations/settings/SAMLSettingsTab.tsx @@ -62,7 +62,6 @@ const samlSettingsTabFragment = graphql` attributeFirstname attributeLastname attributeRole - defaultRole autoSignupEnabled } } @@ -85,7 +84,6 @@ const samlConfigSchema = z.object({ attributeFirstname: z.string().optional(), attributeLastname: z.string().optional(), attributeRole: z.string().optional(), - defaultRole: z.string().optional(), autoSignupEnabled: z.boolean().default(false), }); @@ -157,7 +155,6 @@ export default function SAMLSettingsTab() { attributeFirstname: editingConfig.attributeFirstname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", attributeLastname: editingConfig.attributeLastname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", attributeRole: editingConfig.attributeRole || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role", - defaultRole: editingConfig.defaultRole || "MEMBER", autoSignupEnabled: editingConfig.autoSignupEnabled || false, } : { @@ -171,7 +168,6 @@ export default function SAMLSettingsTab() { attributeFirstname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", attributeLastname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", attributeRole: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role", - defaultRole: "MEMBER", autoSignupEnabled: false, }, }); @@ -189,7 +185,6 @@ export default function SAMLSettingsTab() { attributeFirstname: editingConfig.attributeFirstname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", attributeLastname: editingConfig.attributeLastname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", attributeRole: editingConfig.attributeRole || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role", - defaultRole: editingConfig.defaultRole || "MEMBER", autoSignupEnabled: editingConfig.autoSignupEnabled || false, }); initiateForm.reset({ @@ -207,7 +202,6 @@ export default function SAMLSettingsTab() { attributeFirstname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", attributeLastname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", attributeRole: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role", - defaultRole: "MEMBER", autoSignupEnabled: false, }); initiateForm.reset({ @@ -263,7 +257,6 @@ export default function SAMLSettingsTab() { attributeFirstname: data.attributeFirstname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", attributeLastname: data.attributeLastname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", attributeRole: data.attributeRole || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role", - defaultRole: data.defaultRole || "MEMBER", autoSignupEnabled: data.autoSignupEnabled || false, }, }, @@ -286,7 +279,6 @@ export default function SAMLSettingsTab() { attributeFirstname: data.attributeFirstname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", attributeLastname: data.attributeLastname || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", attributeRole: data.attributeRole || "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role", - defaultRole: data.defaultRole || "MEMBER", autoSignupEnabled: data.autoSignupEnabled || false, }, }, @@ -701,23 +693,6 @@ export default function SAMLSettingsTab() { -
-

- {__("Default Role")} -

-
- -

- {__("The IdP must provide roles directly (OWNER, ADMIN, MEMBER, VIEWER). This default role will be used when the role attribute is missing or invalid.")} -

-
-
-
> + * @generated SignedSource<> * @lightSyntaxTransform * @nogrep */ @@ -20,7 +20,6 @@ export type SAMLSettingsTabFragment$data = { readonly attributeLastname: string; readonly attributeRole: string; readonly autoSignupEnabled: boolean; - readonly defaultRole: string; readonly domainVerificationToken: string | null | undefined; readonly domainVerified: boolean; readonly domainVerifiedAt: any | null | undefined; @@ -201,13 +200,6 @@ return { "name": "attributeRole", "storageKey": null }, - { - "alias": null, - "args": null, - "kind": "ScalarField", - "name": "defaultRole", - "storageKey": null - }, { "alias": null, "args": null, @@ -224,6 +216,6 @@ return { }; })(); -(node as any).hash = "691298e053f77bcb6ef13a5869a86579"; +(node as any).hash = "eec380838cfd22d70a504028bb5046b4"; export default node; diff --git a/pkg/auth/saml_configuration_service.go b/pkg/auth/saml_configuration_service.go index 5a7092f59..d1cf6487e 100644 --- a/pkg/auth/saml_configuration_service.go +++ b/pkg/auth/saml_configuration_service.go @@ -38,7 +38,6 @@ type ( AttributeFirstname string AttributeLastname string AttributeRole string - DefaultRole string AutoSignupEnabled bool } @@ -54,7 +53,6 @@ type ( AttributeFirstname *string AttributeLastname *string AttributeRole *string - DefaultRole *string AutoSignupEnabled *bool } ) @@ -64,18 +62,8 @@ func (s TenantAuthService) CreateSAMLConfiguration( req CreateSAMLConfigurationRequest, ) (*coredata.SAMLConfiguration, error) { // Validate only the IdP configuration (user-provided data) - validationErrors := ValidateIdPConfiguration( - req.IdPEntityID, - req.IdPSsoURL, - req.IdPCertificate, - ) - - if len(validationErrors) > 0 { - var errMsgs []string - for _, err := range validationErrors { - errMsgs = append(errMsgs, err.Error()) - } - return nil, fmt.Errorf("SAML configuration validation failed: %s", strings.Join(errMsgs, "; ")) + if err := ValidateIdPConfiguration(req.IdPEntityID, req.IdPSsoURL, req.IdPCertificate); err != nil { + return nil, fmt.Errorf("SAML configuration validation failed: %w", err) } var config *coredata.SAMLConfiguration @@ -105,7 +93,6 @@ func (s TenantAuthService) CreateSAMLConfiguration( AttributeFirstname: req.AttributeFirstname, AttributeLastname: req.AttributeLastname, AttributeRole: req.AttributeRole, - DefaultRole: req.DefaultRole, AutoSignupEnabled: req.AutoSignupEnabled, CreatedAt: now, UpdatedAt: now, @@ -169,9 +156,6 @@ func (s TenantAuthService) UpdateSAMLConfiguration( if req.AttributeRole != nil { cfg.AttributeRole = *req.AttributeRole } - if req.DefaultRole != nil { - cfg.DefaultRole = *req.DefaultRole - } if req.AutoSignupEnabled != nil { cfg.AutoSignupEnabled = *req.AutoSignupEnabled } diff --git a/pkg/auth/saml_mapper.go b/pkg/auth/saml_mapper.go index 69c95a9e3..1aa69b558 100644 --- a/pkg/auth/saml_mapper.go +++ b/pkg/auth/saml_mapper.go @@ -74,16 +74,13 @@ func ExtractEmailDomain(email string) (string, error) { return domain, nil } -func MapSAMLRoleToSystemRole(samlRole string, defaultRole string) (string, error) { +func MapSAMLRoleToSystemRole(samlRole string) string { if samlRole != "" && isValidRole(samlRole) { - return samlRole, nil + return samlRole } - if !isValidRole(defaultRole) { - return "", fmt.Errorf("invalid default role %q", defaultRole) - } - - return defaultRole, nil + // Default to MEMBER role if SAML role is missing or invalid + return "MEMBER" } func isValidRole(role string) bool { diff --git a/pkg/auth/saml_service.go b/pkg/auth/saml_service.go index 863aff2fb..427ec1843 100644 --- a/pkg/auth/saml_service.go +++ b/pkg/auth/saml_service.go @@ -547,10 +547,7 @@ func (s *SAMLService) HandleSAMLAssertion( return nil, fmt.Errorf("email domain mismatch: assertion contains email with domain %s but SAML config is for domain %s", actualEmailDomain, config.EmailDomain) } - systemRole, err := MapSAMLRoleToSystemRole(samlRole, config.DefaultRole) - if err != nil { - return nil, ErrCannotMapRole{Err: err} - } + systemRole := MapSAMLRoleToSystemRole(samlRole) samlSubject := "" if assertion.Subject != nil && assertion.Subject.NameID != nil { diff --git a/pkg/auth/service.go b/pkg/auth/service.go index 6adfb86b8..8d055e74f 100644 --- a/pkg/auth/service.go +++ b/pkg/auth/service.go @@ -1155,7 +1155,6 @@ func (s Service) InitiateDomainVerification( AttributeFirstname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", AttributeLastname: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", AttributeRole: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role", - DefaultRole: "MEMBER", AutoSignupEnabled: false, CreatedAt: now, UpdatedAt: now, diff --git a/pkg/coredata/migrations/20251029T185308Z.sql b/pkg/coredata/migrations/20251029T185308Z.sql new file mode 100644 index 000000000..07b825ff7 --- /dev/null +++ b/pkg/coredata/migrations/20251029T185308Z.sql @@ -0,0 +1,5 @@ +-- Remove default_role column from auth_saml_configurations +-- The default role is now hardcoded to 'MEMBER' in the application code +-- when the SAML role attribute is missing or invalid + +ALTER TABLE auth_saml_configurations DROP COLUMN default_role; diff --git a/pkg/coredata/saml_configuration.go b/pkg/coredata/saml_configuration.go index 8143c1318..68e435730 100644 --- a/pkg/coredata/saml_configuration.go +++ b/pkg/coredata/saml_configuration.go @@ -39,7 +39,6 @@ type SAMLConfiguration struct { AttributeFirstname string `db:"attribute_firstname"` AttributeLastname string `db:"attribute_lastname"` AttributeRole string `db:"attribute_role"` - DefaultRole string `db:"default_role"` AutoSignupEnabled bool `db:"auto_signup_enabled"` DomainVerified bool `db:"domain_verified"` DomainVerificationToken *string `db:"domain_verification_token"` @@ -70,7 +69,6 @@ SELECT attribute_firstname, attribute_lastname, attribute_role, - default_role, auto_signup_enabled, domain_verified, domain_verification_token, @@ -130,7 +128,6 @@ SELECT attribute_firstname, attribute_lastname, attribute_role, - default_role, auto_signup_enabled, domain_verified, domain_verification_token, @@ -186,7 +183,6 @@ INSERT INTO auth_saml_configurations ( attribute_firstname, attribute_lastname, attribute_role, - default_role, auto_signup_enabled, domain_verified, domain_verification_token, @@ -208,7 +204,6 @@ INSERT INTO auth_saml_configurations ( @attribute_firstname, @attribute_lastname, @attribute_role, - @default_role, @auto_signup_enabled, @domain_verified, @domain_verification_token, @@ -233,7 +228,6 @@ INSERT INTO auth_saml_configurations ( "attribute_firstname": s.AttributeFirstname, "attribute_lastname": s.AttributeLastname, "attribute_role": s.AttributeRole, - "default_role": s.DefaultRole, "auto_signup_enabled": s.AutoSignupEnabled, "domain_verified": s.DomainVerified, "domain_verification_token": s.DomainVerificationToken, @@ -268,7 +262,6 @@ SET attribute_firstname = @attribute_firstname, attribute_lastname = @attribute_lastname, attribute_role = @attribute_role, - default_role = @default_role, auto_signup_enabled = @auto_signup_enabled, domain_verified = @domain_verified, domain_verification_token = @domain_verification_token, @@ -293,7 +286,6 @@ WHERE "attribute_firstname": s.AttributeFirstname, "attribute_lastname": s.AttributeLastname, "attribute_role": s.AttributeRole, - "default_role": s.DefaultRole, "auto_signup_enabled": s.AutoSignupEnabled, "domain_verified": s.DomainVerified, "domain_verification_token": s.DomainVerificationToken, @@ -357,7 +349,6 @@ SELECT attribute_firstname, attribute_lastname, attribute_role, - default_role, auto_signup_enabled, domain_verified, domain_verification_token, @@ -417,7 +408,6 @@ SELECT attribute_firstname, attribute_lastname, attribute_role, - default_role, auto_signup_enabled, domain_verified, domain_verification_token, diff --git a/pkg/server/api/console/v1/schema.graphql b/pkg/server/api/console/v1/schema.graphql index b8448ccfd..6569341bd 100644 --- a/pkg/server/api/console/v1/schema.graphql +++ b/pkg/server/api/console/v1/schema.graphql @@ -4880,9 +4880,6 @@ type SAMLConfiguration implements Node { attributeLastname: String! attributeRole: String! - # Default role for users when role attribute is missing or invalid - defaultRole: String! - # Auto-signup autoSignupEnabled: Boolean! @@ -4927,7 +4924,6 @@ input CreateSAMLConfigurationInput { attributeLastname: String attributeRole: String - defaultRole: String autoSignupEnabled: Boolean } @@ -4946,7 +4942,6 @@ input UpdateSAMLConfigurationInput { attributeFirstname: String attributeLastname: String attributeRole: String - defaultRole: String autoSignupEnabled: Boolean } diff --git a/pkg/server/api/console/v1/schema/schema.go b/pkg/server/api/console/v1/schema/schema.go index b67bab5b5..a5e259b28 100644 --- a/pkg/server/api/console/v1/schema/schema.go +++ b/pkg/server/api/console/v1/schema/schema.go @@ -1238,7 +1238,6 @@ type ComplexityRoot struct { AttributeRole func(childComplexity int) int AutoSignupEnabled func(childComplexity int) int CreatedAt func(childComplexity int) int - DefaultRole func(childComplexity int) int DomainVerificationToken func(childComplexity int) int DomainVerified func(childComplexity int) int DomainVerifiedAt func(childComplexity int) int @@ -7502,13 +7501,6 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin return e.complexity.SAMLConfiguration.CreatedAt(childComplexity), true - case "SAMLConfiguration.defaultRole": - if e.complexity.SAMLConfiguration.DefaultRole == nil { - break - } - - return e.complexity.SAMLConfiguration.DefaultRole(childComplexity), true - case "SAMLConfiguration.domainVerificationToken": if e.complexity.SAMLConfiguration.DomainVerificationToken == nil { break @@ -14628,9 +14620,6 @@ type SAMLConfiguration implements Node { attributeLastname: String! attributeRole: String! - # Default role for users when role attribute is missing or invalid - defaultRole: String! - # Auto-signup autoSignupEnabled: Boolean! @@ -14675,7 +14664,6 @@ input CreateSAMLConfigurationInput { attributeLastname: String attributeRole: String - defaultRole: String autoSignupEnabled: Boolean } @@ -14694,7 +14682,6 @@ input UpdateSAMLConfigurationInput { attributeFirstname: String attributeLastname: String attributeRole: String - defaultRole: String autoSignupEnabled: Boolean } @@ -29048,8 +29035,6 @@ func (ec *executionContext) fieldContext_CreateSAMLConfigurationPayload_samlConf return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field) case "attributeRole": return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field) - case "defaultRole": - return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field) case "autoSignupEnabled": return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field) case "testLoginUrl": @@ -33183,8 +33168,6 @@ func (ec *executionContext) fieldContext_DisableSAMLPayload_samlConfiguration(_ return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field) case "attributeRole": return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field) - case "defaultRole": - return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field) case "autoSignupEnabled": return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field) case "testLoginUrl": @@ -35701,8 +35684,6 @@ func (ec *executionContext) fieldContext_EnableSAMLPayload_samlConfiguration(_ c return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field) case "attributeRole": return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field) - case "defaultRole": - return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field) case "autoSignupEnabled": return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field) case "testLoginUrl": @@ -37939,8 +37920,6 @@ func (ec *executionContext) fieldContext_InitiateDomainVerificationPayload_samlC return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field) case "attributeRole": return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field) - case "defaultRole": - return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field) case "autoSignupEnabled": return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field) case "testLoginUrl": @@ -51814,8 +51793,6 @@ func (ec *executionContext) fieldContext_Organization_samlConfigurations(_ conte return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field) case "attributeRole": return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field) - case "defaultRole": - return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field) case "autoSignupEnabled": return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field) case "testLoginUrl": @@ -57480,50 +57457,6 @@ func (ec *executionContext) fieldContext_SAMLConfiguration_attributeRole(_ conte return fc, nil } -func (ec *executionContext) _SAMLConfiguration_defaultRole(ctx context.Context, field graphql.CollectedField, obj *types.SAMLConfiguration) (ret graphql.Marshaler) { - fc, err := ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field) - if err != nil { - return graphql.Null - } - ctx = graphql.WithFieldContext(ctx, fc) - defer func() { - if r := recover(); r != nil { - ec.Error(ctx, ec.Recover(ctx, r)) - ret = graphql.Null - } - }() - resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) { - ctx = rctx // use context from middleware stack in children - return obj.DefaultRole, nil - }) - if err != nil { - ec.Error(ctx, err) - return graphql.Null - } - if resTmp == nil { - if !graphql.HasFieldError(ctx, fc) { - ec.Errorf(ctx, "must not be null") - } - return graphql.Null - } - res := resTmp.(string) - fc.Result = res - return ec.marshalNString2string(ctx, field.Selections, res) -} - -func (ec *executionContext) fieldContext_SAMLConfiguration_defaultRole(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) { - fc = &graphql.FieldContext{ - Object: "SAMLConfiguration", - Field: field, - IsMethod: false, - IsResolver: false, - Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) { - return nil, errors.New("field of type String does not have child fields") - }, - } - return fc, nil -} - func (ec *executionContext) _SAMLConfiguration_autoSignupEnabled(ctx context.Context, field graphql.CollectedField, obj *types.SAMLConfiguration) (ret graphql.Marshaler) { fc, err := ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field) if err != nil { @@ -64303,8 +64236,6 @@ func (ec *executionContext) fieldContext_UpdateSAMLConfigurationPayload_samlConf return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field) case "attributeRole": return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field) - case "defaultRole": - return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field) case "autoSignupEnabled": return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field) case "testLoginUrl": @@ -71053,8 +70984,6 @@ func (ec *executionContext) fieldContext_VerifyDomainPayload_samlConfiguration(_ return ec.fieldContext_SAMLConfiguration_attributeLastname(ctx, field) case "attributeRole": return ec.fieldContext_SAMLConfiguration_attributeRole(ctx, field) - case "defaultRole": - return ec.fieldContext_SAMLConfiguration_defaultRole(ctx, field) case "autoSignupEnabled": return ec.fieldContext_SAMLConfiguration_autoSignupEnabled(ctx, field) case "testLoginUrl": @@ -75174,7 +75103,7 @@ func (ec *executionContext) unmarshalInputCreateSAMLConfigurationInput(ctx conte asMap[k] = v } - fieldsInOrder := [...]string{"organizationId", "emailDomain", "enforcementPolicy", "spCertificate", "spPrivateKey", "idpMetadataXml", "idpEntityId", "idpSsoUrl", "idpCertificate", "idpMetadataUrl", "attributeEmail", "attributeFirstname", "attributeLastname", "attributeRole", "defaultRole", "autoSignupEnabled"} + fieldsInOrder := [...]string{"organizationId", "emailDomain", "enforcementPolicy", "spCertificate", "spPrivateKey", "idpMetadataXml", "idpEntityId", "idpSsoUrl", "idpCertificate", "idpMetadataUrl", "attributeEmail", "attributeFirstname", "attributeLastname", "attributeRole", "autoSignupEnabled"} for _, k := range fieldsInOrder { v, ok := asMap[k] if !ok { @@ -75279,13 +75208,6 @@ func (ec *executionContext) unmarshalInputCreateSAMLConfigurationInput(ctx conte return it, err } it.AttributeRole = data - case "defaultRole": - ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("defaultRole")) - data, err := ec.unmarshalOString2ᚖstring(ctx, v) - if err != nil { - return it, err - } - it.DefaultRole = data case "autoSignupEnabled": ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("autoSignupEnabled")) data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v) @@ -79763,7 +79685,7 @@ func (ec *executionContext) unmarshalInputUpdateSAMLConfigurationInput(ctx conte asMap[k] = v } - fieldsInOrder := [...]string{"id", "enabled", "enforcementPolicy", "spCertificate", "spPrivateKey", "idpEntityId", "idpSsoUrl", "idpCertificate", "idpMetadataUrl", "attributeEmail", "attributeFirstname", "attributeLastname", "attributeRole", "defaultRole", "autoSignupEnabled"} + fieldsInOrder := [...]string{"id", "enabled", "enforcementPolicy", "spCertificate", "spPrivateKey", "idpEntityId", "idpSsoUrl", "idpCertificate", "idpMetadataUrl", "attributeEmail", "attributeFirstname", "attributeLastname", "attributeRole", "autoSignupEnabled"} for _, k := range fieldsInOrder { v, ok := asMap[k] if !ok { @@ -79861,13 +79783,6 @@ func (ec *executionContext) unmarshalInputUpdateSAMLConfigurationInput(ctx conte return it, err } it.AttributeRole = data - case "defaultRole": - ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("defaultRole")) - data, err := ec.unmarshalOString2ᚖstring(ctx, v) - if err != nil { - return it, err - } - it.DefaultRole = data case "autoSignupEnabled": ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("autoSignupEnabled")) data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v) @@ -93233,11 +93148,6 @@ func (ec *executionContext) _SAMLConfiguration(ctx context.Context, sel ast.Sele if out.Values[i] == graphql.Null { atomic.AddUint32(&out.Invalids, 1) } - case "defaultRole": - out.Values[i] = ec._SAMLConfiguration_defaultRole(ctx, field, obj) - if out.Values[i] == graphql.Null { - atomic.AddUint32(&out.Invalids, 1) - } case "autoSignupEnabled": out.Values[i] = ec._SAMLConfiguration_autoSignupEnabled(ctx, field, obj) if out.Values[i] == graphql.Null { diff --git a/pkg/server/api/console/v1/types/saml_configuration.go b/pkg/server/api/console/v1/types/saml_configuration.go index 297cb290d..e7793c465 100644 --- a/pkg/server/api/console/v1/types/saml_configuration.go +++ b/pkg/server/api/console/v1/types/saml_configuration.go @@ -37,7 +37,6 @@ func NewSAMLConfigurationWithURLs(c *coredata.SAMLConfiguration, spEntityID, spA AttributeFirstname: c.AttributeFirstname, AttributeLastname: c.AttributeLastname, AttributeRole: c.AttributeRole, - DefaultRole: c.DefaultRole, AutoSignupEnabled: c.AutoSignupEnabled, CreatedAt: c.CreatedAt, UpdatedAt: c.UpdatedAt, diff --git a/pkg/server/api/console/v1/types/types.go b/pkg/server/api/console/v1/types/types.go index 81e238b8d..94340d7a6 100644 --- a/pkg/server/api/console/v1/types/types.go +++ b/pkg/server/api/console/v1/types/types.go @@ -520,7 +520,6 @@ type CreateSAMLConfigurationInput struct { AttributeFirstname *string `json:"attributeFirstname,omitempty"` AttributeLastname *string `json:"attributeLastname,omitempty"` AttributeRole *string `json:"attributeRole,omitempty"` - DefaultRole *string `json:"defaultRole,omitempty"` AutoSignupEnabled *bool `json:"autoSignupEnabled,omitempty"` } @@ -1659,7 +1658,6 @@ type SAMLConfiguration struct { AttributeFirstname string `json:"attributeFirstname"` AttributeLastname string `json:"attributeLastname"` AttributeRole string `json:"attributeRole"` - DefaultRole string `json:"defaultRole"` AutoSignupEnabled bool `json:"autoSignupEnabled"` TestLoginURL string `json:"testLoginUrl"` CreatedAt time.Time `json:"createdAt"` @@ -2076,7 +2074,6 @@ type UpdateSAMLConfigurationInput struct { AttributeFirstname *string `json:"attributeFirstname,omitempty"` AttributeLastname *string `json:"attributeLastname,omitempty"` AttributeRole *string `json:"attributeRole,omitempty"` - DefaultRole *string `json:"defaultRole,omitempty"` AutoSignupEnabled *bool `json:"autoSignupEnabled,omitempty"` } diff --git a/pkg/server/api/console/v1/v1_resolver.go b/pkg/server/api/console/v1/v1_resolver.go index ca4e202e4..4bf4b0105 100644 --- a/pkg/server/api/console/v1/v1_resolver.go +++ b/pkg/server/api/console/v1/v1_resolver.go @@ -3665,11 +3665,6 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty attributeRole = *input.AttributeRole } - defaultRole := "MEMBER" - if input.DefaultRole != nil { - defaultRole = *input.DefaultRole - } - autoSignupEnabled := false if input.AutoSignupEnabled != nil { autoSignupEnabled = *input.AutoSignupEnabled @@ -3687,7 +3682,6 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty AttributeFirstname: attributeFirstname, AttributeLastname: attributeLastname, AttributeRole: attributeRole, - DefaultRole: defaultRole, AutoSignupEnabled: autoSignupEnabled, }) if err != nil { @@ -3725,7 +3719,6 @@ func (r *mutationResolver) UpdateSAMLConfiguration(ctx context.Context, input ty AttributeFirstname: input.AttributeFirstname, AttributeLastname: input.AttributeLastname, AttributeRole: input.AttributeRole, - DefaultRole: input.DefaultRole, AutoSignupEnabled: input.AutoSignupEnabled, }) if err != nil {