feat(rbac): jit saml group membership (#142)

## 📝 Description

Handle group membership for jit saml users based on saml attributes

renderedtext/tasks#7653

## ✅ Checklist
- [x] I have tested this change
- [ ] This change requires documentation update

Author: VeljkoMaksimovic

ee/rbac/lib/rbac/grpc_servers/groups_server.ex

@@ -27,7 +27,7 @@ defmodule Rbac.GrpcServers.GroupsServer do
         Rbac.TempSync.assign_org_member_role(created_group.id, org_id)
 
         Enum.each(group.member_ids, fn member_id ->
-          Rbac.Repo.GroupManagementRequest.create_new_request(member_id, created_group.id, "add")
+          Rbac.Repo.GroupManagementRequest.create_new_request(member_id, created_group.id, :add)
         end)
 
         %Groups.CreateGroupResponse{group: construct_grpc_group(created_group)}
@@ -73,8 +73,8 @@ defmodule Rbac.GrpcServers.GroupsServer do
     with {:ok, _} <- Group.fetch_group(req.group.id),
          {:ok, group} <-
            Group.modify_metadata(req.group.id, req.group.name, req.group.description) do
-      GroupManagementRequest.create_new_request(req.members_to_remove, group.id, "remove")
-      GroupManagementRequest.create_new_request(req.members_to_add, group.id, "add")
+      GroupManagementRequest.create_new_request(req.members_to_remove, group.id, :remove)
+      GroupManagementRequest.create_new_request(req.members_to_add, group.id, :add)
       %Groups.ModifyGroupResponse{group: construct_grpc_group(group)}
     else
       {:error, :not_found} ->

ee/rbac/lib/rbac/okta/saml/jit_provisioner/add_user.ex

@@ -40,6 +40,8 @@ defmodule Rbac.Okta.Saml.JitProvisioner.AddUser do
       {:ok, saml_jit_user} <- SamlJitUser.connect_user(saml_jit_user, user.id),
       {:ok, role_id} <- fetch_role_to_be_assigned(saml_jit_user),
       :ok <- assign_role(user.id, saml_jit_user.org_id, role_id),
+      {:ok, group_ids} <- fetch_groups_to_be_assigned(saml_jit_user),
+      :ok <- assign_groups(user.id, group_ids),
       {:ok, saml_jit_user} <- SamlJitUser.mark_as_processed(saml_jit_user)
     ) do
       info("Provisioning #{saml_jit_user.id} done.")
@@ -125,6 +127,29 @@ defmodule Rbac.Okta.Saml.JitProvisioner.AddUser do
     end
   end
 
+  defp fetch_groups_to_be_assigned(jit_user) do
+    member_of = jit_user.attributes["member"] || []
+    info("[Saml JIT Provisioner] User member groups: #{inspect(member_of)}")
+
+    case Rbac.Okta.IdpGroupMapping.map_groups(jit_user.org_id, member_of) do
+      {:ok, groups, _default_role_id} when is_list(groups) ->
+        info("[Saml JIT Provisioner] Mapped Semaphore groups: #{inspect(groups)}")
+        {:ok, groups}
+
+      e ->
+        info("[Saml JIT Provisioner] Response from IdpGroupMapping.map_groups #{inspect(e)}")
+        {:ok, []}
+    end
+  end
+
+  defp assign_groups(user_id, group_ids) when is_list(group_ids) do
+    Enum.each(group_ids, fn group_id ->
+      Rbac.Repo.GroupManagementRequest.create_new_request(user_id, group_id, :add)
+    end)
+
+    :ok
+  end
+
   defp log_provisioning_error(okta_user, err) do
     inspects = "okta user: #{inspect(okta_user)} error: #{inspect(err)}"
 

ee/rbac/lib/rbac/okta/saml/payload_parser.ex

@@ -44,14 +44,17 @@ defmodule Rbac.Okta.Saml.PayloadParser do
 
   defp construct_attributes_map(attributes) do
     Enum.reduce(attributes, %{}, fn {name, value}, acc ->
-      <<first::utf8, rest::binary>> = name |> Atom.to_string() |> String.trim("/")
-      name = <<String.downcase(<<first::utf8>>)::binary, rest::binary>>
-
-      value = to_string(value)
+      name = name |> Atom.to_string() |> sanitize_string()
+      value = to_string(value) |> sanitize_string()
       Map.update(acc, name, [value], &(&1 ++ [value]))
     end)
   end
 
+  defp sanitize_string(string) do
+    <<first::utf8, rest::binary>> = string |> String.trim("/")
+    <<String.downcase(<<first::utf8>>)::binary, rest::binary>>
+  end
+
   defp validate_assertion(saml, sp) do
     :esaml_sp.validate_assertion(saml, sp)
   end

ee/rbac/lib/rbac/repo/group_management_request.ex

@@ -8,7 +8,7 @@ defmodule Rbac.Repo.GroupManagementRequest do
     field(:state, Ecto.Enum, values: [:pending, :processing, :done, :failed], default: :pending)
     field(:user_id, :binary_id)
     field(:group_id, :binary_id)
-    field(:action, :string)
+    field(:action, Ecto.Enum, values: [:add, :remove])
     field(:retries, :integer, default: 0)
 
     timestamps()

ee/rbac/lib/rbac/repo/okta_user.ex

@@ -71,6 +71,12 @@ defmodule Rbac.Repo.OktaUser do
     end
   end
 
+  def find_by_user_id(user_id) do
+    __MODULE__
+    |> where([u], u.user_id == ^user_id)
+    |> Repo.all()
+  end
+
   @spec list(Rbac.Repo.OktaIntegration.t(), integer(), integer(), [Rbac.Okta.SCIM.Filter.t()]) ::
           any()
   def list(integration, start_index, count, filters) do
@@ -157,6 +163,10 @@ defmodule Rbac.Repo.OktaUser do
     changeset(okta_user, %{user_id: user_id}) |> Repo.update()
   end
 
+  def disconnect_user(okta_user) do
+    changeset(okta_user, %{user_id: nil}) |> Repo.update()
+  end
+
   def reload_with_lock_and_transaction(okta_user_id, fun) do
     Rbac.Repo.transaction(
       fn ->

ee/rbac/lib/rbac/repo/saml_jit_user.ex

@@ -49,8 +49,18 @@ defmodule Rbac.Repo.SamlJitUser do
     end
   end
 
-  def connect_user(%__MODULE__{} = user, user_id) do
-    changeset(user, %{user_id: user_id}) |> Repo.update()
+  def find_by_user_id(user_id) do
+    __MODULE__
+    |> where([u], u.user_id == ^user_id)
+    |> Repo.all()
+  end
+
+  def delete(%__MODULE__{} = saml_jit_user) do
+    Repo.delete(saml_jit_user)
+  end
+
+  def connect_user(%__MODULE__{} = saml_jit_user, user_id) do
+    changeset(saml_jit_user, %{user_id: user_id}) |> Repo.update()
   end
 
   def construct_name(%__MODULE__{} = user) do

ee/rbac/lib/rbac/services/user_deleted.ex

@@ -13,17 +13,17 @@ defmodule Rbac.Services.UserDeleted do
 
       log(event.user_id, "Processing started")
 
-      if Rbac.OIDC.enabled?() do
-        handle_oidc_sync(event.user_id)
-      end
+      delete_oidc_user(event.user_id)
+      disconnect_okta_user(event.user_id)
+      delete_saml_jit_user(event.user_id)
 
       Rbac.Store.RbacUser.delete(event.user_id)
 
       log(event.user_id, "Processing finished")
     end)
   end
 
-  defp handle_oidc_sync(user_id) do
+  defp delete_oidc_user(user_id) do
     case Rbac.Store.OIDCUser.fetch_by_user_id(user_id) do
       {:ok, oidc_user} ->
         log(user_id, "OIDC user exists, deleting")
@@ -35,6 +35,30 @@ defmodule Rbac.Services.UserDeleted do
     end
   end
 
+  defp disconnect_okta_user(user_id) do
+    okta_users = Rbac.Repo.OktaUser.find_by_user_id(user_id)
+
+    if Enum.empty?(okta_users) do
+      log(user_id, "No Okta users found, not syncing")
+    else
+      log(user_id, "Found #{length(okta_users)} Okta users, disconnecting")
+
+      Enum.each(okta_users, fn okta_user ->
+        Rbac.Repo.OktaUser.disconnect_user(okta_user)
+      end)
+    end
+  end
+
+  defp delete_saml_jit_user(user_id) do
+    saml_users = Rbac.Repo.SamlJitUser.find_by_user_id(user_id)
+
+    log(user_id, "Found #{length(saml_users)} SAML JIT users, deleting")
+
+    Enum.each(saml_users, fn saml_user ->
+      Rbac.Repo.SamlJitUser.delete(saml_user)
+    end)
+  end
+
   defp log(level \\ :info, user_id, message) do
     message = "[User Deleted] #{user_id}: #{message}"
 

ee/rbac/lib/rbac/store/group.ex

@@ -115,7 +115,7 @@ defmodule Rbac.Store.Group do
     |> where([_, g], g.org_id == ^org_id)
     |> select([ugb, _], ugb.group_id)
     |> Rbac.Repo.all()
-    |> Enum.each(&Rbac.Repo.GroupManagementRequest.create_new_request(member_id, &1, "remove"))
+    |> Enum.each(&Rbac.Repo.GroupManagementRequest.create_new_request(member_id, &1, :remove))
   end
 
   def modify_metadata(group_id, "", ""), do: fetch_group(group_id)

ee/rbac/lib/rbac/workers/group_management.ex

@@ -26,10 +26,10 @@ defmodule Rbac.Workers.GroupManagement do
         {:ok, group} = Rbac.Store.Group.fetch_group(req.group_id)
 
         case req.action do
-          "add" ->
+          :add ->
             :ok = Rbac.Store.Group.add_to_group(group, req.user_id)
 
-          "remove" ->
+          :remove ->
             :ok = Rbac.Store.Group.remove_from_group(group, req.user_id)
 
           other ->

ee/rbac/test/rbac/grpc_servers/groups_server_test.exs

@@ -248,9 +248,9 @@ defmodule Rbac.GrpcServers.GroupsServer.Test do
       }
 
       {:ok, _} = state.grpc_channel |> Stub.modify_group(request)
-      assert_request_created(user1.id, state.group.id, "add")
-      assert_request_created(user2.id, state.group.id, "add")
-      assert_request_created(user3.id, state.group.id, "remove")
+      assert_request_created(user1.id, state.group.id, :add)
+      assert_request_created(user2.id, state.group.id, :add)
+      assert_request_created(user3.id, state.group.id, :remove)
       assert Rbac.Repo.GroupManagementRequest |> Rbac.Repo.aggregate(:count, :id) == 3
     end
   end