Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add preferredEmailDomain config option for GitHub connector #2740

Merged
merged 6 commits into from
Dec 22, 2022
Merged

Add preferredEmailDomain config option for GitHub connector #2740

merged 6 commits into from
Dec 22, 2022

Conversation

nobuyo
Copy link
Contributor

@nobuyo nobuyo commented Nov 15, 2022 •
edited

Overview

This PR is a revamped version of #1298.
It allows identifying users by verified company email without marking it as primary.

What this PR does / why we need it

This PR adds new preferredEmailDomain config option for GitHub connector.
If set, an email address with the specified domain takes precedence over the primary email.

When a user is logged into a service that uses Dex, such as ArgoCD, via GitHub, the user is identified by the account's primary email address.

However, in a company, we have the following needs:

  • Identify employees by their company domain email address
  • Allow employees to use their own(not-for-only-work) GitHub account

To satisfy these, we need an option that can return a specific domain email address as the user's email address.

Special notes for your reviewer

N/A

Does this PR introduce a user-facing change?

Add new `preferredEmailDomain` config option for GitHub connector.

@nobuyo
Add preferredEmailDomain config option for GitHub connector
f3120df 
Signed-off-by: nobuyo <longzechangsheng@gmail.com>
@nobuyo
Copy link
Contributor Author

nobuyo commented Dec 1, 2022

@sagikazarmark @nabokihms would it be ok if i ask you to review about this?

nabokihms
nabokihms requested changes Dec 13, 2022
View reviewed changes
Copy link
Member

@nabokihms nabokihms left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello, @nobuyo. Sorry for the long delay. I left some comments. Please take a look when you have time.

connector/github/github.go Show resolved Hide resolved
connector/github/github.go Outdated Show resolved Hide resolved
connector/github/github.go Outdated Show resolved Hide resolved
connector/github/github.go Outdated Show resolved Hide resolved
connector/github/github.go Outdated Show resolved Hide resolved
@nabokihms nabokihms added the release-note/enhancement Release note: Enhancements label Dec 13, 2022
@nabokihms nabokihms added this to the v2.36.0 milestone Dec 13, 2022
@nobuyo
Support glob pattern for preferredEmailDomain config option and refactor
1495c91 
Signed-off-by: nobuyo <longzechangsheng@gmail.com>
@nobuyo nobuyo force-pushed the add-preferred-email-option-to-github-connector branch from b509f95 to 1495c91 Compare December 14, 2022 13:04
@nobuyo
Copy link
Contributor Author

nobuyo commented Dec 14, 2022

Thank you for your review! I've updated this PR.

nabokihms
nabokihms requested changes Dec 19, 2022
View reviewed changes
Copy link
Member

@nabokihms nabokihms left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you. Overall, everything looks good to me. I have only one suggestion regarding the regex part. Please take a look when you have time.

connector/github/github.go Outdated Show resolved Hide resolved
connector/github/github.go Outdated Show resolved Hide resolved
connector/github/github.go Outdated Show resolved Hide resolved
nobuyo and others added 4 commits December 20, 2022 09:04
@nobuyo @nabokihms
Use userEmail.Email to comparison to avoid empty struct declaration
41f0286 
Co-authored-by: Maksim Nabokikh <max.nabokih@gmail.com>
Signed-off-by: Nobuo Takizawa <nobuyo@users.noreply.github.com>
@nobuyo @nabokihms
Use MatchString instead of Match([]byte(...))
b6dd9d5 
Co-authored-by: Maksim Nabokikh <max.nabokih@gmail.com>
Signed-off-by: Nobuo Takizawa <nobuyo@users.noreply.github.com>
@nobuyo
Simplify matching logic for PreferredEmailDomain
0a4a1b4 
Signed-off-by: nobuyo <longzechangsheng@gmail.com>
@nobuyo
Add check for PreferredEmailDomain config is not ended with *
3575fd1 
Make an error if the setting value ends with `*` because:
- Just `*` makes the setting meaningless.
- It's not realistic to cover all TLDs with same name (e.g. example.com , example.net, example.jp, ...).

Signed-off-by: nobuyo <longzechangsheng@gmail.com>
nabokihms
nabokihms approved these changes Dec 22, 2022
View reviewed changes
Copy link
Member

@nabokihms nabokihms left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thank you for your work, @nobuyo!

@nabokihms nabokihms merged commit c91b87f into dexidp:master Dec 22, 2022
@nobuyo nobuyo deleted the add-preferred-email-option-to-github-connector branch December 22, 2022 23:39
@nabokihms nabokihms mentioned this pull request Feb 17, 2023
Closed
xtremerui pushed a commit to concourse/dex that referenced this pull request May 25, 2023
upstream dex release: v2.36.0
2ab05af 
The official container image for this release can be pulled from
```
ghcr.io/dexidp/dex:v2.36.0
```

<!-- Release notes generated using configuration in .github/release.yml at v2.36.0 -->

## What's Changed
### Enhancements 🚀
* TLS configure for OIDC connector by @xtremerui in dexidp#1632
* Add icon for gitea by @pinpox in dexidp#2733
* fix: Do not use connector data from the refresh token field by @nabokihms in dexidp#2729
* Add preferredEmailDomain config option for GitHub connector by @nobuyo in dexidp#2740
* Move unique functionality into getGroups to reduce calls to google by @snuggie12 in dexidp#2628
* fix: prevent server-side request forgery using Kubernetes storage by @nabokihms in dexidp#2479
* fix: return 401 if password is invalid by @nabokihms in dexidp#2796
* feat: Add default robots.txt by @nabokihms in dexidp#2834
* Skip redirection to approval when it is not required (dexidp#2686) by @nobuyo in dexidp#2805
* feat: Bump dependencies and Makefile refactoring by @nabokihms in dexidp#2844
### Bug Fixes 🐛
* Make admin email optional when no service account path is configured by @sagikazarmark in dexidp#2695
* Only initialize google admin service if necessary by @sagikazarmark in dexidp#2700
### Dependency Updates ⬆️
* build(deps): bump golang from 1.19.1-alpine3.16 to 1.19.2-alpine3.16 by @dependabot in dexidp#2697
* fix: Update gomplate version to 3.11.3 fix CVE-2022-27665 by @nabokihms in dexidp#2705
* build(deps): bump github.com/spf13/cobra from 1.5.0 to 1.6.0 by @dependabot in dexidp#2708
* build(deps): bump github.com/stretchr/testify from 1.8.0 to 1.8.1 by @dependabot in dexidp#2715
* build(deps): bump google.golang.org/api from 0.98.0 to 0.101.0 by @dependabot in dexidp#2720
* build(deps): bump github.com/mattn/go-sqlite3 from 1.14.15 to 1.14.16 by @dependabot in dexidp#2721
* build(deps): bump aquasecurity/trivy-action from 0.7.1 to 0.8.0 by @dependabot in dexidp#2723
* build(deps): bump github.com/spf13/cobra from 1.6.0 to 1.6.1 by @dependabot in dexidp#2718
* build(deps): bump golang from 1.19.2-alpine3.16 to 1.19.3-alpine3.16 by @dependabot in dexidp#2724
* build(deps): bump alpine from 3.16.2 to 3.17.0 by @dependabot in dexidp#2746
* build(deps): bump github.com/prometheus/client_golang from 1.13.0 to 1.14.0 by @dependabot in dexidp#2735
* build(deps): bump go.etcd.io/etcd/client/pkg/v3 from 3.5.5 to 3.5.6 by @dependabot in dexidp#2744
* build(deps): bump github.com/Masterminds/sprig/v3 from 3.2.2 to 3.2.3 by @dependabot in dexidp#2751
* build(deps): bump golang from 1.19.3-alpine3.16 to 1.19.4-alpine3.16 by @dependabot in dexidp#2750
* build(deps): bump golang.org/x/crypto from 0.3.0 to 0.4.0 by @dependabot in dexidp#2755
* build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.5 to 3.5.6 by @dependabot in dexidp#2743
* build(deps): bump github.com/go-sql-driver/mysql from 1.6.0 to 1.7.0 by @dependabot in dexidp#2754
* build(deps): bump helm/kind-action from 1.4.0 to 1.5.0 by @dependabot in dexidp#2758
* build(deps): bump google.golang.org/grpc from 1.50.1 to 1.51.0 by @dependabot in dexidp#2741
* build(deps): bump google.golang.org/api from 0.101.0 to 0.104.0 by @dependabot in dexidp#2753
* build(deps): bump google.golang.org/grpc from 1.49.0 to 1.51.0 in /api/v2 by @dependabot in dexidp#2742
* build(deps): bump golang.org/x/net from 0.3.0 to 0.4.0 by @dependabot in dexidp#2761
* build(deps): bump entgo.io/ent from 0.11.3 to 0.11.4 by @dependabot in dexidp#2725
* build(deps): bump google.golang.org/api from 0.104.0 to 0.105.0 by @dependabot in dexidp#2760
* build(deps): bump golang.org/x/net from 0.4.0 to 0.5.0 by @dependabot in dexidp#2774
* build(deps): bump google.golang.org/api from 0.105.0 to 0.106.0 by @dependabot in dexidp#2772
* build(deps): bump github.com/coreos/go-oidc/v3 from 3.4.0 to 3.5.0 by @dependabot in dexidp#2770
* build(deps): bump golang.org/x/crypto from 0.4.0 to 0.5.0 by @dependabot in dexidp#2773
* build(deps): bump golang.org/x/oauth2 from 0.3.0 to 0.4.0 by @dependabot in dexidp#2777
* build(deps): bump entgo.io/ent from 0.11.4 to 0.11.5 by @dependabot in dexidp#2779
* build(deps): bump alpine from 3.17.0 to 3.17.1 by @dependabot in dexidp#2780
* build(deps): bump mheap/github-action-required-labels from 2 to 3 by @dependabot in dexidp#2769
* build(deps): bump google.golang.org/api from 0.106.0 to 0.107.0 by @dependabot in dexidp#2788
* build(deps): bump golang from 1.19.4-alpine3.16 to 1.19.5-alpine3.16 by @dependabot in dexidp#2782
* build(deps): bump google.golang.org/grpc from 1.51.0 to 1.52.0 by @dependabot in dexidp#2783
* build(deps): bump google.golang.org/api from 0.107.0 to 0.108.0 by @dependabot in dexidp#2793
* build(deps): bump google.golang.org/grpc from 1.51.0 to 1.52.0 in /api/v2 by @dependabot in dexidp#2784
* chore: Upgrade golangci-lint to v1.50.1 from v1.46.0 by @dlipovetsky in dexidp#2790
* ci: Use go 1.19 by @dlipovetsky in dexidp#2791
* build(deps): bump go.etcd.io/etcd/client/v3 from 3.5.6 to 3.5.7 by @dependabot in dexidp#2798
* build(deps): bump docker/build-push-action from 3 to 4 by @dependabot in dexidp#2807
* build(deps): bump golang from 1.19.5-alpine3.16 to 1.20.0-alpine3.16 by @dependabot in dexidp#2811
* build(deps): bump aquasecurity/trivy-action from 0.8.0 to 0.9.0 by @dependabot in dexidp#2810
* build(deps): bump alpine from 3.17.1 to 3.17.2 by @dependabot in dexidp#2821
* build(deps): bump aquasecurity/trivy-action from 0.9.0 to 0.9.1 by @dependabot in dexidp#2822
* build(deps): bump entgo.io/ent from 0.11.5 to 0.11.8 by @dependabot in dexidp#2823
* build(deps): bump golang.org/x/crypto from 0.5.0 to 0.6.0 by @dependabot in dexidp#2818
* build(deps): bump golang.org/x/net from 0.5.0 to 0.7.0 by @dependabot in dexidp#2828
* build(deps): bump golang.org/x/net from 0.4.0 to 0.7.0 in /api/v2 by @dependabot in dexidp#2832
* build(deps): bump golang.org/x/sys from 0.0.0-20220114195835-da31bd327af9 to 0.1.0 in /examples by @dependabot in dexidp#2837
* build(deps): bump golang.org/x/net from 0.0.0-20220114011407-0dd24b26b47d to 0.7.0 in /examples by @dependabot in dexidp#2846
* build(deps): bump golang from 1.20.0-alpine3.16 to 1.20.1-alpine3.16 by @dependabot in dexidp#2827
* build(deps): bump aquasecurity/trivy-action from 0.9.1 to 0.9.2 by @dependabot in dexidp#2850
* build(deps): bump golang from 1.20.1-alpine3.16 to 1.20.2-alpine3.16 by @dependabot in dexidp#2849
* feat: Bump gomplate 3.11.4 by @nabokihms in dexidp#2840
* build(deps): bump golang.org/x/crypto from 0.6.0 to 0.7.0 by @dependabot in dexidp#2856
* build(deps): bump golang.org/x/oauth2 from 0.4.0 to 0.6.0 by @dependabot in dexidp#2847
* build(deps): bump google.golang.org/api from 0.108.0 to 0.112.0 by @dependabot in dexidp#2853
* build(deps): bump google.golang.org/api from 0.112.0 to 0.114.0 by @dependabot in dexidp#2869
* build(deps): bump actions/setup-go from 3 to 4 by @dependabot in dexidp#2863
* build(deps): bump github.com/russellhaering/goxmldsig from 1.2.0 to 1.3.0 by @dependabot in dexidp#2862
* build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.30.0 by @dependabot in dexidp#2866
* build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.30.0 in /api/v2 by @dependabot in dexidp#2867
* build(deps): bump golang.org/x/crypto from 0.0.0-20220112180741-5e0467b6c7ce to 0.1.0 in /examples by @dependabot in dexidp#2845
* build(deps): bump google.golang.org/grpc from 1.52.0 to 1.53.0 in /api/v2 by @dependabot in dexidp#2816
* chore: upgrade tools by @sagikazarmark in dexidp#2870
### Other Changes
* Bump image in examples/k8s/dex.yaml to v2.32.0 by @stealthybox in dexidp#2569

## New Contributors
* @pinpox made their first contribution in dexidp#2733
* @nobuyo made their first contribution in dexidp#2740
* @dlipovetsky made their first contribution in dexidp#2790
* @seankhliao made their first contribution in dexidp#2812
* @stealthybox made their first contribution in dexidp#2569

**Full Changelog**: dexidp/dex@v2.35.3...v2.36.0
palexster pushed a commit to palexster/dex that referenced this pull request Oct 4, 2023
@nobuyo @nabokihms
Add preferredEmailDomain config option for GitHub connector (dexidp#2740
5e4d027 
)

Signed-off-by: nobuyo <longzechangsheng@gmail.com>
Signed-off-by: Nobuo Takizawa <nobuyo@users.noreply.github.com>
Co-authored-by: Maksim Nabokikh <max.nabokih@gmail.com>
michaelliau pushed a commit to FlockFreight/dex that referenced this pull request Oct 4, 2023
@nobuyo @nabokihms @michaelliau
Add preferredEmailDomain config option for GitHub connector (dexidp#2740
14e6f99 
)

Signed-off-by: nobuyo <longzechangsheng@gmail.com>
Signed-off-by: Nobuo Takizawa <nobuyo@users.noreply.github.com>
Co-authored-by: Maksim Nabokikh <max.nabokih@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nabokihms nabokihms nabokihms approved these changes

Assignees

@nabokihms nabokihms

Labels
area/connector release-note/enhancement Release note: Enhancements
Projects
None yet
Milestone
v2.36.0
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@nobuyo @nabokihms