[CX-97] add SAML as default when creating user #24
+152
−20
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
WalkthroughAdds MFA and SAML IDP configuration support to the Tableau connector: new account schema fields, IDP selection logic during account creation, client API to list site IDP configurations, and related model extensions. Changes
Sequence DiagramsequenceDiagram
participant User
participant Connector
participant Client as Tableau API Client
participant Site as Tableau Site
User->>Connector: Request account creation (withMFA?, idpConfigurationName?)
Connector->>Connector: Read withMFA and idpConfigurationName
alt withMFA == true
Connector->>Connector: set authSetting = "TableauIDWithMFA"
else withMFA == false
Connector->>Client: ListIdpConfigurations(ctx)
Client->>Site: GET /sites/{siteId}/site-auth-configurations
Site-->>Client: return idp configurations
Client-->>Connector: list of IdpConfiguration
alt one enabled SAML IDP
Connector->>Connector: choose that IdP id
else idpConfigurationName provided
Connector->>Connector: find matching IdP by name
else multiple IDPs & no name
Connector-->>User: error (specify idpConfigurationName)
end
end
Connector->>Client: AddUserToSite(user{email,siteRole,authSetting?,idpConfigurationId?})
Client->>Site: POST /sites/{siteId}/users
Site-->>Client: user created
Client-->>Connector: success
Connector-->>User: account created / error
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@pkg/connector/user.go`:
- Around line 224-233: The function buildMultipleIDPError builds a dynamic error
message into builder and then calls fmt.Errorf(builder.String()), which is
unsafe for non-constant format strings; replace the final
fmt.Errorf(builder.String()) with errors.New(builder.String()) (or
fmt.Errorf("%s", builder.String())) and add the "errors" import to the file so
the function returns a plain error created from the constructed string;
reference buildMultipleIDPError and the final return statement to locate and
update the code.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@pkg/connector/user.go`:
- Around line 178-195: The code currently returns the sole
enabledSAMLConfigs[0].IdpConfigurationId without honoring idpConfigName; change
the logic in the selection block so that when len(enabledSAMLConfigs) == 1 you
still check idpConfigName: if idpConfigName is empty, return
enabledSAMLConfigs[0].IdpConfigurationId, otherwise call
findIDPByName(enabledSAMLConfigs, idpConfigName) and return an InvalidArgument
error (use uhttp.WrapErrors with buildMultipleIDPError) if the name doesn't
match, otherwise return the matched selectedConfig.IdpConfigurationId; this
preserves current behavior for empty names but surfaces typos/misconfigurations
when a name is provided.
Comment on lines
+178
to
+195
| if len(enabledSAMLConfigs) == 0 { | ||
| return "", fmt.Errorf("baton-tableau: you need to pass the MFA flag since no IDP is configured in Tableau") | ||
| } | ||
|
|
||
| if len(enabledSAMLConfigs) == 1 { | ||
| return enabledSAMLConfigs[0].IdpConfigurationId, nil | ||
| } | ||
|
|
||
| if idpConfigName == "" { | ||
| return "", uhttp.WrapErrors(codes.InvalidArgument, "multiple SAML IDPs available", buildMultipleIDPError(enabledSAMLConfigs)) | ||
| } | ||
|
|
||
| selectedConfig, err := findIDPByName(enabledSAMLConfigs, idpConfigName) | ||
| if err != nil { | ||
| return "", uhttp.WrapErrors(codes.InvalidArgument, fmt.Sprintf("IDP configuration '%s' not found", idpConfigName), buildMultipleIDPError(enabledSAMLConfigs)) | ||
| } | ||
|
|
||
| return selectedConfig.IdpConfigurationId, nil |
There was a problem hiding this comment.
Honor explicit idpConfigurationName even when only one config exists.
If a caller provides idpConfigurationName but there’s only one enabled SAML config, the current logic ignores the name and silently selects the only config. That can mask typos or misconfigurations.
🔧 Suggested adjustment
- if len(enabledSAMLConfigs) == 1 {
- return enabledSAMLConfigs[0].IdpConfigurationId, nil
- }
-
- if idpConfigName == "" {
- return "", uhttp.WrapErrors(codes.InvalidArgument, "multiple SAML IDPs available", buildMultipleIDPError(enabledSAMLConfigs))
- }
-
- selectedConfig, err := findIDPByName(enabledSAMLConfigs, idpConfigName)
- if err != nil {
- return "", uhttp.WrapErrors(codes.InvalidArgument, fmt.Sprintf("IDP configuration '%s' not found", idpConfigName), buildMultipleIDPError(enabledSAMLConfigs))
- }
-
- return selectedConfig.IdpConfigurationId, nil
+ if idpConfigName != "" {
+ selectedConfig, err := findIDPByName(enabledSAMLConfigs, idpConfigName)
+ if err != nil {
+ return "", uhttp.WrapErrors(codes.InvalidArgument, fmt.Sprintf("IDP configuration '%s' not found", idpConfigName), buildMultipleIDPError(enabledSAMLConfigs))
+ }
+ return selectedConfig.IdpConfigurationId, nil
+ }
+
+ if len(enabledSAMLConfigs) == 1 {
+ return enabledSAMLConfigs[0].IdpConfigurationId, nil
+ }
+
+ return "", uhttp.WrapErrors(codes.InvalidArgument, "multiple SAML IDPs available", buildMultipleIDPError(enabledSAMLConfigs))🤖 Prompt for AI Agents
In `@pkg/connector/user.go` around lines 178 - 195, The code currently returns the
sole enabledSAMLConfigs[0].IdpConfigurationId without honoring idpConfigName;
change the logic in the selection block so that when len(enabledSAMLConfigs) ==
1 you still check idpConfigName: if idpConfigName is empty, return
enabledSAMLConfigs[0].IdpConfigurationId, otherwise call
findIDPByName(enabledSAMLConfigs, idpConfigName) and return an InvalidArgument
error (use uhttp.WrapErrors with buildMultipleIDPError) if the name doesn't
match, otherwise return the matched selectedConfig.IdpConfigurationId; this
preserves current behavior for empty names but surfaces typos/misconfigurations
when a name is provided.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Style
✏️ Tip: You can customize this high-level summary in your review settings.