Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow Azure AAD auth provider to use AAD group ids instead of display name for authn/authz #154

Merged
merged 7 commits into from Jun 20, 2018

Commits on Apr 30, 2018

  1. Add paging to get around directoryObjects.getByIds limit of 1000

    When trying to detailed description of AAD membership groups using API getbyids: https://github.com/microsoftgraph/microsoft-graph-docs/blob/master/api-reference/v1.0/api/directoryobject_getbyids.md if AAD member has more than 1000 group memerships
    
    AAD returns:
        "code": "Request_BadRequest",
        "message": "Number of included identifiers cannot exceed '1000'.",
    
    Therefore, guard needs to do page queries to get details of all groups the user belong to. But getbyids does not support query options like $top and $expand and returns error:
    
        "code": "Request_BadRequest",
        "message": "The following query options are not supported by this request method or cannot be applied to the requested resource: $filter,$expand,$orderby,$count,$inlinecount,$select,$skiptoken,$skip,$top"
    
    So in this case guard cannot rely on AAD to do paging and needs to do paging itself to fetch membership group details from AAD.
    
    Github issue: kubeguard#132
    amanohar committed Apr 30, 2018
    Copy the full SHA
    51c03fe View commit details
    Browse the repository at this point in the history

Commits on May 4, 2018

  1. Some cleanup

    - Avoid re-allocations for groupNames array
    - Simplify the loop over groupIDs
    - glog.Infof appends \n automatically
    tamalsaha committed May 4, 2018
    Copy the full SHA
    b516305 View commit details
    Browse the repository at this point in the history

Commits on Jun 20, 2018

  1. Azure AAD auth provider is using AAD group's displayName instead of u…

    …nique objectId for auth
    
    Azure AAD auth provider is using AAD group's displayName instead of unique objectId for auth
    amanohar committed Jun 20, 2018
    Copy the full SHA
    42fc117 View commit details
    Browse the repository at this point in the history
  2. Copy the full SHA
    e3868cd View commit details
    Browse the repository at this point in the history
  3. Copy the full SHA
    9bcee41 View commit details
    Browse the repository at this point in the history
  4. Update description

    amanohar committed Jun 20, 2018
    Copy the full SHA
    cd422e2 View commit details
    Browse the repository at this point in the history
  5. Copy the full SHA
    dd528d2 View commit details
    Browse the repository at this point in the history