k-space/dex
Archived
10
0
Fork 0
Code Issues Pull Requests Packages Projects Activity

fix(connector/google): make admin email optional for default creds

Browse Source 
Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
This commit is contained in:
Mark Sagi-Kazar 2022-10-04 08:55:57 +02:00
parent 19b3aab323
commit 261adee26b
No known key found for this signature in database
GPG Key ID: 31AB0439F4C5C90E
2 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
connector/google/google.go
View File

@ -283,7 +283,9 @@ func (c *googleConnector) getGroups(email string, fetchTransitiveGroupMembership
// the google admin api. If no serviceAccountFilePath is defined, the application default credential // the google admin api. If no serviceAccountFilePath is defined, the application default credential
// is used. // is used.
func createDirectoryService(serviceAccountFilePath, email string, logger log.Logger) (*admin.Service, error) { func createDirectoryService(serviceAccountFilePath, email string, logger log.Logger) (*admin.Service, error) {
if email == "" { // We know impersonation is required when using a service account credential
// TODO: or is it?
if email == "" && serviceAccountFilePath != "" {
return nil, fmt.Errorf("directory service requires adminEmail") return nil, fmt.Errorf("directory service requires adminEmail")
} }
@ -308,7 +310,12 @@ func createDirectoryService(serviceAccountFilePath, email string, logger log.Log
if err != nil { if err != nil {
return nil, fmt.Errorf("unable to parse credentials to config: %v", err) return nil, fmt.Errorf("unable to parse credentials to config: %v", err)
} }
// Only attempt impersonation when there is a user configured
if email != "" {
config.Subject = email config.Subject = email
}
return admin.NewService(ctx, option.WithHTTPClient(config.Client(ctx))) return admin.NewService(ctx, option.WithHTTPClient(config.Client(ctx)))
} }

1
connector/google/google_test.go
View File

@ -78,6 +78,7 @@ func TestOpen(t *testing.T) {
ClientSecret: "testSecret", ClientSecret: "testSecret",
RedirectURI: ts.URL + "/callback", RedirectURI: ts.URL + "/callback",
Scopes: []string{"openid", "groups"}, Scopes: []string{"openid", "groups"},
ServiceAccountFilePath: serviceAccountFilePath,
}, },
expectedErr: "requires adminEmail", expectedErr: "requires adminEmail",
}, },