feat(auth): Multi-tenancy support for Google Cloud Identity Platform by bojeil-google · Pull Request #628 · firebase/firebase-admin-node

bojeil-google · 2019-08-20T23:49:27Z

Merge all changes to master.

RELEASE NOTE: Added multi-tenancy support to the authentication service (Google Cloud Identity Platform project required). Tenant related APIs are exposed via tenantManager() on the admin.auth interface.
RELEASE NOTE: Added tenant management APIs authForTenant(), getTenant(), listTenants(), deleteTenant(), createTenant() and updateTenant() to the newly defined TenantManager.
RELEASE NOTE: Defined TenantAwareAuth interface retrieved via TenantManager#authForTenant() for managing users, configuring SAML/OIDC providers, generating email links for password reset, email verification, etc for specific tenants.

* Starts defining multi-tenancy APIs. This includes: - Defining type definitions. - Adding tenantId to UserRecord and UserImportBuilder. - Adding new errors associated with tenant operations. - Defines the Tenant object. As the changes are quite large. This will be split into multiple PRs. * Minor fixes and tweaks. * Addresses comments from review. * Addresses review comments.

* Defines BaseFirebaseAuthRequestHandler class for sending Auth requests related to user management APIs and SAML/OIDC config mgmt APIs, link generation, etc. Defines FirebaseAuthRequestHandler which extends the base class for project level only calls and which will also be extended to include tenant mgmt APIs. Defines FirebaseTenantRequestHandler which extends the base class for tenant level only calls. Unit tests have been modified to run tests on both subclasses. * Addresses review comments. * Comment clean up. * Address more comments.

* Defines TenantAwareAuth and its user management APIs, email action link APIs, OIDC/SAML provider config mgmt APIs. * Throws error when tenantId is provided in createUser and updateUser Auth API requests. Adds detailed tenant mismatch error for uploadAccount on tenant Id mismatch for TenantAwareAuth. * Addresses comments. * Added missing mapping to client error of MISSING_DISPLAY_NAME error.

* Defines tenant management API on AuthRequestHandler. * Adds unit test for confirming an error is thrown on createTenant request with no type. * Address review comments.

* Adds tenant management APIs to developer facing Auth instance. This includes getTenant, deleteTenant, listTenants, createTenant and updateTenant. This expects TenantServerResponse to be returned for createTenant and updateTenant. Expected results have not been confirmed. A followup PR will add integration tests for the above. * Addresses review comments. Adds missing backend errors. * Addresses review comments.

* Adds integration tests for tenant management APIs. These tests are skipped by default as multi-tenancy is a paid feature on Google Cloud Identity Platform. To run these tests, --testMultiTenancy flag has to be added. Adds default email provider config when backend Auth server returns undefined for emailSignInConfig. * Updates listTenants integration test.

* Defines Auth multi-tenancy references in index.d.ts. * Addresses review comments.

…xt: (#584) * Adds basic integration tests for the following in multi-tenancy context: - User management - Custom claims - Import users - List users - Token revocation - Email link generation (skipped due to backend bug) - OIDC/SAML management APIs. * Removes email link sign-in generation test for now.

All tenants are now created in lightweight state by default.

* Defines the TenantManager class and its underlying methods. Adds unit tests for this new class. Unit tests were copied from the exising auth.spec.ts file.

) * Removes tenant management methods and `forTenant` from Auth class. Defines Auth#tenantManager(). Updates unit and integration tests. Updates index.d.ts type definitions.

- Enables email action link generation tests after backend bug was fixed. - Adds email link sign-in test case. - Fixes issues with nested multi-tenancy tests not being skipped when they are supposed to.

wuyanna · 2019-08-21T03:46:33Z

test/unit/auth/tenant.spec.ts

+    const serverRequestCopy: TenantServerResponse = deepCopy(serverRequest);
+    it('should return the expected object representation of a tenant', () => {
+      expect(new Tenant(serverRequestCopy).toJSON()).to.deep.equal({
+        tenantId: 'TENANT_ID',


wuyanna · 2019-08-21T03:46:52Z

test/unit/auth/tenant.spec.ts

+    it('should return the expected object representation of a tenant', () => {
+      expect(new Tenant(serverRequestCopy).toJSON()).to.deep.equal({
+        tenantId: 'TENANT_ID',
+        displayName: 'TENANT_DISPLAY_NAME',


TENANT-DISPLAY-NAME

wuyanna · 2019-08-21T03:47:02Z

test/unit/auth/user-import-builder.spec.ts

        },
      ],
      customClaims: {admin: true},
+      tenantId: 'TENANT_ID',


wuyanna · 2019-08-21T03:47:16Z

test/unit/auth/user-record.spec.ts

+    });
+
+    it('should return expected tenantId', () => {
+      const resp = deepCopy(getValidUserResponse('TENANT_ID'));


wuyanna · 2019-08-21T03:47:29Z

test/unit/auth/user-record.spec.ts

+      expect(() => {
+        const resp = deepCopy(getValidUserResponse('TENANT_ID'));
+        const tenantUserRecord = new UserRecord(resp);
+        (tenantUserRecord as any).tenantId = 'OTHER_TENANT_ID';


OTHER-TENANT-ID

wuyanna

Overall LGTM. There are a few places that are still using underscore in tenant id and tenant display name in tests, it would be best if we can change them to dash to be consistent.

bojeil-google and others added 15 commits May 23, 2019 15:29

Defines tenant management API on AuthRequestHandler. (#559)

5a36d39

* Defines tenant management API on AuthRequestHandler. * Adds unit test for confirming an error is thrown on createTenant request with no type. * Address review comments.

Merged with master

835e08f

Defines Auth multi-tenancy references in index.d.ts. (#572)

6158b1f

* Defines Auth multi-tenancy references in index.d.ts. * Addresses review comments.

Removes all usage of tenant types. (#611)

f5d8163

All tenants are now created in lightweight state by default.

Defines the TenantManager class and its underlying methods. (#617)

904e118

* Defines the TenantManager class and its underlying methods. Adds unit tests for this new class. Unit tests were copied from the exising auth.spec.ts file.

Removes tenant management methods and forTenant from Auth class. (#619

1124348

) * Removes tenant management methods and `forTenant` from Auth class. Defines Auth#tenantManager(). Updates unit and integration tests. Updates index.d.ts type definitions.

Updates multi-tenancy integration tests. (#623)

83aea9b

- Enables email action link generation tests after backend bug was fixed. - Adds email link sign-in test case. - Fixes issues with nested multi-tenancy tests not being skipped when they are supposed to.

Merge branch 'master' into temp-multi-tenancy

664cf1f

Merge branch 'master' into temp-multi-tenancy

c437e0a

bojeil-google added the release-note label Aug 21, 2019

bojeil-google requested review from hiranya911 and wuyanna August 21, 2019 00:20

bojeil-google assigned hiranya911 and wuyanna Aug 21, 2019

wuyanna reviewed Aug 21, 2019

View reviewed changes

wuyanna approved these changes Aug 21, 2019

View reviewed changes

bojeil-google added 3 commits August 20, 2019 21:29

Addresses review comments.

e67d4eb

Merge branch 'master' into temp-multi-tenancy

da7d073

Sync to head.

9110c8a

bojeil-google merged commit 123538d into master Sep 4, 2019

bojeil-google deleted the temp-multi-tenancy branch September 4, 2019 19:24

Jeremip11 mentioned this pull request Nov 27, 2023

[Snyk] Fix for 15 vulnerabilities Jeremip11/firebase-admin-node#17

Open

takeratta mentioned this pull request Nov 29, 2023

[Snyk] Fix for 19 vulnerabilities takeratta/firebase-admin-node#30

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

feat(auth): Multi-tenancy support for Google Cloud Identity Platform#628

feat(auth): Multi-tenancy support for Google Cloud Identity Platform#628
bojeil-google merged 18 commits intomasterfrom
temp-multi-tenancy

bojeil-google commented Aug 20, 2019

Uh oh!

wuyanna Aug 21, 2019

Uh oh!

bojeil-google Aug 21, 2019

Uh oh!

wuyanna Aug 21, 2019

Uh oh!

bojeil-google Aug 21, 2019

Uh oh!

wuyanna Aug 21, 2019

Uh oh!

bojeil-google Aug 21, 2019

Uh oh!

wuyanna Aug 21, 2019

Uh oh!

bojeil-google Aug 21, 2019

Uh oh!

wuyanna Aug 21, 2019

Uh oh!

bojeil-google Aug 21, 2019

Uh oh!

wuyanna left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

Conversation

bojeil-google commented Aug 20, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wuyanna left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants