oidc: use federated login service to sync quay teams (PROJQUAY-6741) (q…

…uay#2724)

* oidc: use federated login service to sync quay teams (PROJQUAY-6741)

* adding more logs to oidc team sync

* Adding tests

data/users/externaloidc.py

@@ -58,21 +58,24 @@ def query_users(self, query, limit):
         """
         No way to query users so returning empty list
         """
-        return ([], self.federated_service, None)
+        return ([], self._federated_service, "Not supported")
 
-    def sync_oidc_groups(self, user_groups, user_obj, service_name):
+    def sync_oidc_groups(self, user_groups, user_obj):
         """
         Adds user to quay teams that have team sync enabled with an OIDC group
         """
         if user_groups is None:
+            logger.debug(
+                f"External OIDC Group Sync: Found no oidc groups for user: {user_obj.username}"
+            )
             return
 
         for oidc_group in user_groups:
             # fetch TeamSync row if exists, for the oidc_group synced with the login service
-            synced_teams = team.get_oidc_team_from_groupname(oidc_group, service_name)
+            synced_teams = team.get_oidc_team_from_groupname(oidc_group, self._federated_service)
             if len(synced_teams) == 0:
                 logger.debug(
-                    f"OIDC group: {oidc_group} is either not synced with a team in quay or is not synced with the {service_name} service"
+                    f"External OIDC Group Sync: OIDC group: {oidc_group} is either not synced with a team in quay or is not synced with the {self._federated_service} service"
                 )
                 continue
 
@@ -81,14 +84,17 @@ def sync_oidc_groups(self, user_groups, user_obj, service_name):
                 team_name = team_synced.team.name
                 org_name = team_synced.team.organization.username
                 if not team_name or not org_name:
-                    logger.debug(f"Cannot retrieve team for the oidc group: {oidc_group}")
+                    logger.debug(
+                        f"External OIDC Group Sync: Cannot retrieve quay team synced with the oidc group: {oidc_group}"
+                    )
 
                 # add user to team
                 try:
-                    # team_obj = team.get_organization_team(org_name, team_name)
                     team.add_user_to_team(user_obj, team_synced.team)
                 except InvalidTeamException as err:
-                    logger.exception(err)
+                    logger.exception(
+                        f"External OIDC Group Sync: Exception occurred when adding user: {user_obj.username} to quay team: {team_synced.team} as {err}"
+                    )
                 except UserAlreadyInTeam:
                     # Ignore
                     pass
@@ -100,13 +106,16 @@ def ping(self):
         """
         return (True, None)
 
-    def resync_quay_teams(self, user_groups, user_obj, login_service_name):
+    def resync_quay_teams(self, user_groups, user_obj):
         """
         Fetch quay teams that user is a member of.
         Remove user from teams that are synced with an OIDC group but group does not exist in "user_groups"
         """
         # fetch user's quay teams that have team sync enabled
-        existing_user_teams = team.get_federated_user_teams(user_obj, login_service_name)
+        existing_user_teams = team.get_federated_user_teams(user_obj, self._federated_service)
+        logger.debug(
+            f"External OIDC Group Sync: For user {user_obj.username} re-syncing {len(existing_user_teams)} quay teams"
+        )
         user_groups = user_groups or []
         for user_team in existing_user_teams:
             try:
@@ -119,17 +128,18 @@ def resync_quay_teams(self, user_groups, user_obj, login_service_name):
                     org_name = user_team.teamsync.team.organization.username
                     team.remove_user_from_team(org_name, user_team.name, user_obj.username, None)
                     logger.debug(
-                        f"Successfully removed user: {user_obj.username} from team: {user_team.name} in organization: {org_name}"
+                        f"External OIDC Group Sync: Successfully removed user: {user_obj.username} from team: {user_team.name} in organization: {org_name}"
                     )
             except Exception as err:
-                logger.exception(err)
+                logger.exception(
+                    f"External OIDC Group Sync: Exception occurred for user {user_obj.username} when removing membership from quay team: {user_team.name} as {err}"
+                )
         return
 
     def sync_user_groups(self, user_groups, user_obj, login_service):
         if not user_obj:
             return
 
-        service_name = login_service.service_id()
-        self.sync_oidc_groups(user_groups, user_obj, service_name)
-        self.resync_quay_teams(user_groups, user_obj, service_name)
+        self.sync_oidc_groups(user_groups, user_obj)
+        self.resync_quay_teams(user_groups, user_obj)
         return

test/test_external_oidc.py

@@ -64,11 +64,11 @@ def test_sync_for_empty_oidc_groups(self):
         assert model.team.add_user_to_team(user_obj, team_2)
 
         user_teams_before_sync = TeamMember.select().where(TeamMember.user == user_obj).count()
-        self.oidc_instance.sync_oidc_groups([], user_obj, "oidc")
+        self.oidc_instance.sync_oidc_groups([], user_obj)
         user_teams_after_sync = TeamMember.select().where(TeamMember.user == user_obj).count()
         assert user_teams_before_sync == user_teams_after_sync
 
-        self.oidc_instance.sync_oidc_groups(None, user_obj, "oidc")
+        self.oidc_instance.sync_oidc_groups(None, user_obj)
         user_teams_after_sync = TeamMember.select().where(TeamMember.user == user_obj).count()
         assert user_teams_before_sync == user_teams_after_sync
 
@@ -103,7 +103,7 @@ def test_sync_for_non_empty_oidc_groups(self):
             "wrong_group_name",
         ]
         user_teams_before_sync = TeamMember.select().where(TeamMember.user == user_obj).count()
-        self.oidc_instance.sync_oidc_groups(user_groups, user_obj, "oidc")
+        self.oidc_instance.sync_oidc_groups(user_groups, user_obj)
 
         user_teams_after_sync = TeamMember.select().where(TeamMember.user == user_obj).count()
 
@@ -113,7 +113,7 @@ def test_resync_for_empty_quay_teams(self):
         user_obj = model.user.get_user("devtable")
 
         user_teams_before_sync = TeamMember.select().where(TeamMember.user == user_obj).count()
-        self.oidc_instance.resync_quay_teams([], user_obj, "oidc")
+        self.oidc_instance.resync_quay_teams([], user_obj)
         user_teams_after_sync = TeamMember.select().where(TeamMember.user == user_obj).count()
         assert user_teams_before_sync == user_teams_after_sync
 
@@ -130,7 +130,7 @@ def test_resync_for_empty_quay_teams(self):
         assert model.team.add_user_to_team(user_obj, team_2)
 
         user_teams_before_sync = TeamMember.select().where(TeamMember.user == user_obj).count()
-        self.oidc_instance.resync_quay_teams([], user_obj, "oidc")
+        self.oidc_instance.resync_quay_teams([], user_obj)
         user_teams_after_sync = TeamMember.select().where(TeamMember.user == user_obj).count()
         assert user_teams_before_sync == user_teams_after_sync
 
@@ -155,16 +155,29 @@ def test_resync_for_non_empty_quay_teams(self):
         assert model.team.set_team_syncing(team_2, "oidc", {"group_name": "test_org_2_team_1"})
         assert model.team.add_user_to_team(user_obj, team_2)
 
-        user_groups = ["test_org_1_team_1", "another_group"]
+        # add user to another team that has team sync enabled with oidc login service
+        team_3 = model.team.create_team("team_2", test_org_2, "member")
+        assert model.team.set_team_syncing(team_3, "oidc", {"group_name": "test_org_2_team_2"})
+        assert model.team.add_user_to_team(user_obj, team_3)
+
+        user_groups = ["test_org_1_team_1", "another_group", "test_org_2_team_2"]
         # user should be removed from team_2
-        self.oidc_instance.resync_quay_teams(user_groups, user_obj, "oidc")
+        self.oidc_instance.resync_quay_teams(user_groups, user_obj)
         assert (
             TeamMember.select()
             .where(TeamMember.user == user_obj, TeamMember.team == team_2)
             .count()
             == 0
         )
 
+        # user should part of team_1 and team_3
+        assert (
+            TeamMember.select()
+            .where(TeamMember.user == user_obj, TeamMember.team << [team_1, team_3])
+            .count()
+            == 2
+        )
+
     def test_sync_user_groups_for_empty_user_obj(self):
         assert self.oidc_instance.sync_user_groups([], None, self.oidc_login_service) is None
         assert self.oidc_instance.sync_user_groups(None, None, self.oidc_login_service) is None
@@ -213,3 +226,9 @@ def test_verify_credentials(self):
             error_msg
             == "Unsupported login option. Please sign in with the configured oidc provider"
         )
+
+    def test_query_users(self):
+        result, service, error_msg = self.oidc_instance.query_users("some_query_here", None)
+        assert len(result) == 0
+        assert service == "oidc"
+        assert error_msg == "Not supported"