feat(fiat/google-groups): expand indirect google groups for emails#1213
feat(fiat/google-groups): expand indirect google groups for emails#1213jasonmcintosh merged 1 commit intospinnaker:masterfrom himanhsugusain:master
Conversation
|
The following commits need their title changed:
Please format your commit title into the form:
This allows us to easily generate changelogs & determine semantic version numbers when cutting releases. You can read more about commit conventions here. |
...t/groovy/com/netflix/spinnaker/fiat/roles/google/GoogleDirectoryUserRolesProviderSpec.groovy
Outdated
Show resolved
Hide resolved
...t/groovy/com/netflix/spinnaker/fiat/roles/google/GoogleDirectoryUserRolesProviderSpec.groovy
Outdated
Show resolved
Hide resolved
|
Thanks for the PR @himanhsugusain! Can you add some info about the impact of this change? Like, before this PR a user who is a member of ABC groups isn't authorized for XYZ, but is afterwards (or whatever the impact actually is)? |
|
Also, since this is a feature, it'd be great to have the PR against the monorepo. |
|
@dbyron-sf Made the recommended fix to test. You can review once more. |
Google groups list api does not return the groups that the user is indirectly part of.
This change recursively traverse each group and get its parent group, we also keep track of already visited groups and not query it again.
Google groups does not allow one group to be in subgroup of itself, so that case check is not needed.
Eg.
User A if member of Group G1 and G1 is member of G2, so A is member of G2 indireclty.
Before:
Access provided to group G2 will not be inherited by A.
After
Access provided to G2 will be inherited by A.
PS: This is how Google own permission model work. Too bad they don't provide a direct api for it.
This also updates
com.google.api.client.googleapis.auth.oauth2.GoogleCredential(deprecated)tocom.google.auth.oauth2.GoogleCredentials