Auth: Filter out identities, groups and, IdP groups that the requestor cannot view

[markylaing]

This is an oversight from #12914.

• When listing identities, the groups that the identities are a member of should be filtered by what the requestor is able to view.
• When listing groups, the identities that are members and the identity provider groups that are mapped to the groups should be filtered by what the requestor is able to view.
• When listing identity provider groups, the groups that are mapped to it should be filtered by what the requestor is able to view.

[tomponline]

@markylaing does this have the fix to allow partial idp group match? Or is it in a different PR?

[markylaing]

@markylaing does this have the fix to allow partial idp group match? Or is it in a different PR?

No, that will be in the embedded-openfga branch.

[markylaing]

@tomponline this is now rebased and ready for review.

[tomponline]

@markylaing the note for the forthcoming openga server, but can auth.PermissionChecker remain returning only a bool when each call to it could fail with an error (e.g. when consulting the DB)?

[markylaing]

The permission checker will still only return a boolean. Getting the permission checker can fail, but we're not getting one here, just passing one in.

[tomponline]

ok cool - so this remains true even with openfga?

[markylaing]

Yeah the OpenFGA does a ListObjects to get the entities of a given type that the identity is related to via a given entitlement. When calling the permission checker, we just check if the given URL is in the list. Getting the list can fail but once it's in scope, checking if something is in the list is just a shared.ValueInSlice.