[PS-1213] GSuite: Preflat groups using includeDerivedMembership flag. #280
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Type of change
Objective
Since Bitwarden doesn't have nested groups the function
flattenUsersToGroups
is used to flatten nested groups into one list of users. GSuite SDK supportsincludeDerivedMembership
which already pre-flattens the user list while fetching if from the GSuite API. (It also returns all intermediate groups, but at that point we can safely ignore them.)The motivation is that if we ignore some intermediate groups (because we don't want them in BW) the flattening function cannot fetch members of that group. So either we have to include all intermediate groups or we won't get all nested users.
Example:
GSuite group "BW Admins" has one member group "GS Admins".
GSuite group "GS Admins" has one member account "admin@company.org".
I want to import group "BW Admins" with one member "admin@company.org".
Currently I need to import also the group "GS Admins", otherwise this tool doesn't resolve members of the intermediate group (because it is excluded).
Potential breaking change?
This might be breaking, because someone might be relying on the exclusion of the intermediate groups, but I think this is more a bug than a feature.
If it is breaking I can also introduce new sync config option to have it as opt-in.
Code changes
I've added
includeDerivedMembership: true
parameter to member.list GSuite SDK call, which does flattening of nested groups in GSuite rather than in the code.Also we can safely ignore all groups return by this call, since it is only used for nested group flattening.
https://developers.google.com/admin-sdk/directory/reference/rest/v1/members/list#query-parameters
Testing requirements
Before you submit
npm run lint
) (required)