SAML Support; user groups; External IDP-authoritative entitlements#3998

Open

timfrazee wants to merge 67 commits intodocker/digital-oceanfrom

Commits on Mar 19, 2026

[F] Add env config

Tim Standen
authored and
timfrazee
committed
[C] Move saml configs to anyway config folder

Tim Standen
authored and
timfrazee
committed
[F] Add SAML Attributes

Tim Standen
authored and
timfrazee
committed
[F] Integrate saml providers into identity record

Tim Standen
authored and
timfrazee
committed
[B] Remove validations for now to work around flaky errors

Tim Standen
authored and
timfrazee
committed
[C] Add Omniauth CSRF gem
timfrazee
committed
[E] Add security and claims to SAML provider
timfrazee
committed
[E] Add route for SAML callback
timfrazee
committed
[C] Add test SAML env for dev
timfrazee
committed
[F] User group scaffold
timfrazee
committed
[B] Fix user group entitleable filename and inverse reference
timfrazee
committed
[F] Add external identifier model

Tim Standen
authored and
timfrazee
committed
[F] Add external identifier attribute to relevant strong params
timfrazee
committed
[E] Add unique index to external_identifiers#identifier
timfrazee
committed
[F] Add CSRF handling for OmniAuth requests
timfrazee
committed
[E] Add externally identifiable scope
timfrazee
committed
[F] Add user group and entitlement parsing on OAuth callback
timfrazee
committed
[F] Add authentication settings to settings payload
timfrazee
committed
[E] Add Oauth redirect route
timfrazee
committed
[F] Add routes + controller for user_group_membership

1aurend
authored and
timfrazee
committed
[F] Add user group entitleable controller
timfrazee
committed
[B] Fix oauth CSRF cookie generation
timfrazee
committed
[F] Add support for post-oauth redirect and cookie-based token retrieval
timfrazee
committed
[B] Fix external identifier identifiable relation
timfrazee
committed
[B] Fix user group membership source relation
timfrazee
committed
[E] Update tests; finalize identity-based group/entitlement management
timfrazee
committed
[B] Fix omniauth callback route
timfrazee
committed
[F] Add user_group_serializer + minor fixes for #index

1aurend
authored and
timfrazee
committed
[F] Setup includes for user_group#show

1aurend
authored and
timfrazee
committed
[F] Add initial admin routes + UI for user groups

1aurend
authored and
timfrazee
committed
[F] Scaffold user group users list UI

1aurend
authored and
timfrazee
committed
[F] Scaffold login changes

1aurend
authored and
timfrazee
committed
[F] Add externalId to projects + journals

1aurend
authored and
timfrazee
committed
[F] Add simple UserGroupRow

1aurend
authored and
timfrazee
committed
[F] Wire up user group CRUD

1aurend
authored and
timfrazee
committed
[B] Ensure list refreshes on add

1aurend
authored and
timfrazee
committed
[C] Remove unused file

1aurend
authored and
timfrazee
committed
[E] Expose external_identifier for user_group/project/journal

1aurend
authored and
timfrazee
committed
[F] Wire up external identifier fields

1aurend
authored and
timfrazee
committed
[F] Read IDP values from settings

1aurend
authored and
timfrazee
committed
[F] Finish setting up user_group_membership endpoints

1aurend
authored and
timfrazee
committed
[F] Wire up CRD user group memberships

1aurend
authored and
timfrazee
committed
[F] Finish setting up user_group_entitleable endpoints

1aurend
authored and
timfrazee
committed
[F] Add UI + wire up user group entitlements

1aurend
authored and
timfrazee
committed
[E] Add i18n keys + various clean up

1aurend
authored and
timfrazee
committed
[C] Push updated lockfile

1aurend
authored and
timfrazee
committed
[F] Scaffold oauth redirect route

1aurend
authored and
timfrazee
committed
[E] Update defaultIDP handling to match settings structure

1aurend
authored and
timfrazee
committed
[B] Fix error param check

1aurend
authored and
timfrazee
committed
[F] Move Oauth auth token from session to cookie
timfrazee
committed
[F] Update FE oauth redirect cookie name and redirect parsing
timfrazee
committed
[B] Fix assignment and serialization of external identifiers
timfrazee
committed
[B] Fix provider login button styles

1aurend
authored and
timfrazee
committed
[B] Ensure homepage projects refetch on login/out

1aurend
authored and
timfrazee
committed
[E] Use SAML IDP display name for button
timfrazee
committed
[E] Limit oauth cookie to domain
timfrazee
committed
[B] Fix lookup of existing external identifiers for managed entitlements
timfrazee
committed
[C] Update oauth tests
timfrazee
committed
[F] Add ability to hide SAML providers but remain enabled
timfrazee
committed
[B] Fix default login link URL
timfrazee
committed
[B] Add amd64/linux platform to lockfile
timfrazee
committed
[C] Lint
timfrazee
committed
[B] Add null check on UserRow memberIds

1aurend
authored and
timfrazee
committed
[B] Remove duplicate index in structure.sql
timfrazee
committed
[B] Fix deprecated syntax for parsing CSS rulesets
timfrazee
committed
[C] Update and fix failing tests
timfrazee
committed
[C] Lint
timfrazee
committed