Add role sync feature for IdP group-to-role mapping #413
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Allows automatic synchronization of user roles based on IdP group memberships. Supports OIDC, SAML, and LDAP with three sync modes: FULL_SYNC, ADDITIVE, and FIRST_LOGIN_ONLY. Includes admin UI for configuring mappings and Keycloak setup documentation.
Askir
force-pushed
the
feature/role-sync
branch
from
b632774 to
c42edf7
Compare
![ellipsis-dev[bot]](https://avatars.githubusercontent.com/in/64358?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Caution
Changes requested ❌
Reviewed everything up to b632774 in 1 minute and 37 seconds. Click for details.
- Reviewed
1531lines of code in17files - Skipped
0files when reviewing. - Skipped posting
6draft comments. View those below. - Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.
1. backend/src/main/kotlin/dev/kviklet/kviklet/controller/RoleSyncConfigController.kt:70
- Draft comment:
Controller code is clear and uses appropriate annotations. Consider adding logging for update and delete operations for easier debugging. - Reason this comment was not posted:
Confidence changes required:50%<= threshold50%None
2. backend/src/main/kotlin/dev/kviklet/kviklet/db/RoleSyncConfig.kt:60
- Draft comment:
Ensure that the unique constraint on 'idp_group_name' aligns with business logic. Duplicate mappings will fail. - Reason this comment was not posted:
Comment looked like it was already resolved.
3. backend/src/main/kotlin/dev/kviklet/kviklet/security/saml/SamlLoginSuccessHandler.kt:72
- Draft comment:
Hard-coded port ':5173' in getBaseUrl may not be appropriate in production. Consider making it configurable. - Reason this comment was not posted:
Comment was not on a location in the diff, so it can't be submitted as a review comment.
4. frontend/src/hooks/roleSyncConfig.ts:20
- Draft comment:
Consider error handling improvements (e.g., try-catch) or leveraging a data-fetching library to simplify state management. - Reason this comment was not posted:
Confidence changes required:50%<= threshold50%None
5. frontend/src/routes/settings/RoleSyncSettings.tsx:140
- Draft comment:
In the groups attribute input, updateConfig is called onChange and onBlur. Confirm if immediate updates on every keystroke are desired. - Reason this comment was not posted:
Comment did not seem useful. Confidence is useful =0%<= threshold50%The comment is asking the PR author to confirm their intention regarding the use ofupdateConfigononChangeandonBlur. This violates the rule against asking the author to confirm their intention or ensure behavior is intended.
6. frontend/src/routes/settings/Settings.tsx:130
- Draft comment:
Sidebar tabs correctly disable enterprise features when license is invalid. Verify that route paths used (e.g., '/roles/new') are consistent with app routing. - Reason this comment was not posted:
Confidence changes required:30%<= threshold50%None
Workflow ID: wflow_HU3VBVnOaMEjdTKl
You can customize 
| .mapNotNull { mapping -> | ||
| try { | ||
| roleAdapter.findById(RoleId(mapping.roleId)) | ||
| } catch (e: EntityNotFound) { |
Contributor
There was a problem hiding this comment.
Silently ignoring missing roles in the catch block may hide configuration issues. Consider logging a warning with exception details.
Contributor
There was a problem hiding this comment.
Important
Looks good to me! 👍
Reviewed c42edf7 in 37 seconds. Click for details.
- Reviewed
1513lines of code in17files - Skipped
0files when reviewing. - Skipped posting
2draft comments. View those below. - Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.
1. backend/src/main/kotlin/dev/kviklet/kviklet/db/RoleSyncConfig.kt:63
- Draft comment:
Verify the unique constraint on idp_group_name. It prevents mapping the same IdP group to multiple roles. - Reason this comment was not posted:
Comment did not seem useful. Confidence is useful =0%<= threshold50%The comment is asking the author to verify a unique constraint, which is similar to asking them to double-check something. This violates the rule against asking the author to confirm or verify intentions. The comment does not provide a specific suggestion or point out a clear issue with the code.
2. backend/src/main/kotlin/dev/kviklet/kviklet/security/saml/SamlLoginSuccessHandler.kt:72
- Draft comment:
Hardcoded port ':5173' in getBaseUrl may not reflect actual serverPort. Consider using the dynamic serverPort value. - Reason this comment was not posted:
Comment was not on a location in the diff, so it can't be submitted as a review comment.
Workflow ID: wflow_jPClt2peDPVAndoz
You can customize
Contributor
There was a problem hiding this comment.
Important
Looks good to me! 👍
Reviewed d37f2ca in 31 seconds. Click for details.
- Reviewed
13lines of code in1files - Skipped
0files when reviewing. - Skipped posting
1draft comments. View those below. - Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.
1. frontend/src/routes/settings/RoleSyncSettings.tsx:106
- Draft comment:
Good use of an arrow function to wrap the async handler. Consider handling errors within handleToggleEnabled (e.g., try/catch) so that any update failures are logged or communicated to the user. - Reason this comment was not posted:
Confidence changes required:33%<= threshold50%None
Workflow ID: wflow_wpdnyjvQSXuvdl8B
You can customize
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Implements automatic role synchronization between identity providers (SAML, OIDC, LDAP) and Kviklet roles based on IdP group memberships.
FULL_SYNC- Roles exactly match IdP group mappings (removes unmapped roles)ADDITIVE- IdP groups add roles without removing existing onesFIRST_LOGIN_ONLY- Roles only set on first login, not updated on subsequent loginsArchitecture
All IdP services (OidcUserService, SamlUserService, LdapUserDetailsService) extract groups from their respective attributes and pass them to
UserAuthService.findOrCreateUser(), which delegates toRoleSyncServicefor role resolution.Key Files
Backend:
RoleSyncService.kt- Core sync logicRoleSyncConfigService.kt+RoleSyncConfigController.kt- Config CRUDRoleSyncConfig.kt(db/) - Entities and repositoryUserAuthService.kt- Integration point for all IdPsFrontend:
RoleSyncSettings.tsx- Settings UIRoleSyncConfigApi.ts- API clientroleSyncConfig.ts- HookTest plan
./gradlew test -ifor backend testsnpm test && npx tscfor frontendImportant
Add role synchronization feature for IdP group-to-role mapping with backend services and frontend UI.
FULL_SYNC,ADDITIVE, andFIRST_LOGIN_ONLYsync modes.RoleSyncServicefor role resolution andRoleSyncConfigServicefor configuration management.RoleSyncConfigController.ktfor API endpoints.UserAuthService.kt,LdapUserDetailsService.kt,OidcUserService.kt, andSamlUserService.ktto integrate role sync.036-add-role-sync-config.yamlfor new tables.RoleSyncSettings.tsxfor the settings UI.RoleSyncConfigApi.tsand hook inroleSyncConfig.ts.keycloak-role-sync-setup.mdfor Keycloak configuration guide.This description was created by
for d37f2ca. You can customize this summary. It will automatically update as commits are pushed.