feat: Implement customer invitation infrastructure in Authentik
- Added IInvitationSetupService and InvitationSetupService to orchestrate the setup of invitation infrastructure for customers. - Introduced methods for creating groups, enrollment flows, invitation stages, roles, and policies in Authentik. - Updated PostInstanceInitService to call the new invitation setup methods during post-initialization. - Enhanced InstanceService to pass customer name during SAML configuration deployment. - Updated App.axaml.cs to register the new IInvitationSetupService. - Modified settings-custom.php.template to include documentation for SAML authentication configuration with group-based admin assignment. - Added logic to exclude specific groups from being synced to Xibo during group synchronization.
This commit is contained in:
Matt Batchelder
@@ -104,6 +104,10 @@ public class AuthentikService : IAuthentikService
|
||||
// ── 5b. Ensure property mappings are attached (required for valid SAML responses) ──
|
||||
await EnsureProviderHasPropertyMappingsAsync(client, providerId, ct);
|
||||
|
||||
// ── 5c. Ensure usertypeid property mapping is created and attached ──
|
||||
// (for admin group assignment via SAML)
|
||||
await EnsureUserTypeidMappingAsync(client, providerId, ct);
|
||||
|
||||
// ── 6. Fetch and parse metadata ───────────────────────────────────
|
||||
var config = await FetchAndParseMetadataAsync(client, baseUrl, providerId, ct);
|
||||
config.ApplicationSlug = slug;
|
||||
@@ -182,13 +186,46 @@ public class AuthentikService : IAuthentikService
|
||||
{
|
||||
var (_, client) = await CreateAuthenticatedClientAsync(overrideUrl, overrideApiKey);
|
||||
|
||||
// Authentik has moved the groups endpoint between versions.
|
||||
// Try each known path until one succeeds.
|
||||
var endpoints = new[]
|
||||
{
|
||||
"/api/v3/core/groups/",
|
||||
"/api/v3/groups/",
|
||||
"/api/v3/core/group/",
|
||||
};
|
||||
|
||||
string? workingEndpoint = null;
|
||||
foreach (var ep in endpoints)
|
||||
{
|
||||
var probe = await client.GetAsync($"{ep}?page_size=1", ct);
|
||||
if (probe.IsSuccessStatusCode)
|
||||
{
|
||||
workingEndpoint = ep;
|
||||
_logger.LogDebug("[Authentik] Groups endpoint resolved: {Endpoint}", ep);
|
||||
break;
|
||||
}
|
||||
_logger.LogDebug("[Authentik] Groups endpoint {Endpoint} returned HTTP {Status}", ep, (int)probe.StatusCode);
|
||||
}
|
||||
|
||||
if (workingEndpoint == null)
|
||||
{
|
||||
_logger.LogWarning("[Authentik] No working groups endpoint found — tried: {Endpoints}",
|
||||
string.Join(", ", endpoints));
|
||||
return new List<AuthentikGroupItem>();
|
||||
}
|
||||
|
||||
var groups = new List<AuthentikGroupItem>();
|
||||
var nextUrl = "/api/v3/core/groups/?page_size=200";
|
||||
var nextUrl = $"{workingEndpoint}?page_size=200";
|
||||
|
||||
while (!string.IsNullOrEmpty(nextUrl))
|
||||
{
|
||||
var resp = await client.GetAsync(nextUrl, ct);
|
||||
resp.EnsureSuccessStatusCode();
|
||||
if (!resp.IsSuccessStatusCode)
|
||||
{
|
||||
_logger.LogWarning("[Authentik] Groups page request failed (HTTP {Status})", (int)resp.StatusCode);
|
||||
break;
|
||||
}
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
@@ -223,7 +260,7 @@ public class AuthentikService : IAuthentikService
|
||||
nextUrl = root.TryGetProperty("pagination", out var pagination) &&
|
||||
pagination.TryGetProperty("next", out var nextProp) &&
|
||||
nextProp.ValueKind == JsonValueKind.Number
|
||||
? $"/api/v3/core/groups/?page_size=200&page={nextProp.GetInt32()}"
|
||||
? $"{workingEndpoint}?page_size=200&page={nextProp.GetInt32()}"
|
||||
: null;
|
||||
}
|
||||
|
||||
@@ -561,6 +598,213 @@ public class AuthentikService : IAuthentikService
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Ensures that the SAML property mapping for <c>usertypeid</c> (group-based admin assignment) exists.
|
||||
/// Creates it if missing and attaches it to the provider.
|
||||
/// The mapping returns "1" (super-admin) for users in the "OTS IT" group, empty string otherwise.
|
||||
/// </summary>
|
||||
private async Task EnsureUserTypeidMappingAsync(
|
||||
HttpClient client, int providerId, CancellationToken ct)
|
||||
{
|
||||
try
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Ensuring usertypeid property mapping exists for provider {Id}", providerId);
|
||||
|
||||
// ── 1. Try to find existing mapping by name ────────────────────────
|
||||
var mappingId = await TryFindUserTypeidMappingAsync(client, ct);
|
||||
if (!string.IsNullOrEmpty(mappingId))
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Found existing usertypeid mapping: {Id}", mappingId);
|
||||
}
|
||||
else
|
||||
{
|
||||
// ── 2. Create new mapping ────────────────────────────────────
|
||||
mappingId = await CreateUserTypeidMappingAsync(client, ct);
|
||||
if (string.IsNullOrEmpty(mappingId))
|
||||
{
|
||||
_logger.LogWarning("[Authentik] Could not create usertypeid mapping");
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
// ── 3. Attach mapping to provider ────────────────────────────────
|
||||
await AttachUserTypeidMappingToProviderAsync(client, providerId, mappingId, ct);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogWarning(ex, "[Authentik] Could not ensure usertypeid mapping for provider {Id}", providerId);
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Looks for an existing SAML property mapping named "saml-usertypeid".
|
||||
/// Returns its ID if found, null otherwise.
|
||||
/// </summary>
|
||||
private async Task<string?> TryFindUserTypeidMappingAsync(HttpClient client, CancellationToken ct)
|
||||
{
|
||||
try
|
||||
{
|
||||
var endpoints = new[]
|
||||
{
|
||||
"/api/v3/propertymappings/provider/saml/?page_size=200",
|
||||
"/api/v3/propertymappings/saml/?page_size=200",
|
||||
};
|
||||
|
||||
foreach (var endpoint in endpoints)
|
||||
{
|
||||
try
|
||||
{
|
||||
var resp = await client.GetAsync(endpoint, ct);
|
||||
if (!resp.IsSuccessStatusCode) continue;
|
||||
|
||||
var json = await resp.Content.ReadFromJsonAsync<AuthentikListResponse<AuthentikPropertyMapping>>(cancellationToken: ct);
|
||||
var match = json?.Results?.FirstOrDefault(m =>
|
||||
string.Equals(m.Name, "saml-usertypeid", StringComparison.OrdinalIgnoreCase));
|
||||
|
||||
if (match != null)
|
||||
{
|
||||
_logger.LogDebug("[Authentik] Found usertypeid mapping: {Id} ({Name})", match.Pk, match.Name);
|
||||
return match.Pk;
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogDebug(ex, "[Authentik] Error searching property mappings at {Endpoint}", endpoint);
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogDebug(ex, "[Authentik] Could not search for existing usertypeid mapping");
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Creates a new SAML property mapping named "saml-usertypeid" that returns "1"
|
||||
/// for users in the "OTS IT" group and empty string otherwise.
|
||||
/// </summary>
|
||||
private async Task<string?> CreateUserTypeidMappingAsync(HttpClient client, CancellationToken ct)
|
||||
{
|
||||
try
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Creating usertypeid property mapping");
|
||||
|
||||
var expression = @"return ""1"" if user.groups.all() | selectattr(""name"", ""equalto"", ""OTS IT"") else """"";
|
||||
|
||||
var payload = new Dictionary<string, object>
|
||||
{
|
||||
["name"] = "saml-usertypeid",
|
||||
["saml_name"] = "usertypeid",
|
||||
["expression"] = expression,
|
||||
};
|
||||
|
||||
var jsonBody = JsonSerializer.Serialize(payload);
|
||||
var content = new StringContent(jsonBody, Encoding.UTF8, "application/json");
|
||||
|
||||
var resp = await client.PostAsync("/api/v3/propertymappings/provider/saml/", content, ct);
|
||||
|
||||
if (!resp.IsSuccessStatusCode)
|
||||
{
|
||||
var errorBody = await resp.Content.ReadAsStringAsync(ct);
|
||||
_logger.LogWarning("[Authentik] Failed to create usertypeid mapping (HTTP {Status}): {Error}",
|
||||
(int)resp.StatusCode, errorBody);
|
||||
return null;
|
||||
}
|
||||
|
||||
var result = await resp.Content.ReadFromJsonAsync<AuthentikPropertyMapping>(cancellationToken: ct);
|
||||
if (result?.Pk != null)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Created usertypeid mapping: {Id}", result.Pk);
|
||||
return result.Pk;
|
||||
}
|
||||
|
||||
_logger.LogWarning("[Authentik] Created usertypeid mapping but response had no Pk");
|
||||
return null;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogWarning(ex, "[Authentik] Error creating usertypeid mapping");
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Attaches the usertypeid property mapping to the given SAML provider
|
||||
/// so it's included in outgoing SAML assertions.
|
||||
/// </summary>
|
||||
private async Task AttachUserTypeidMappingToProviderAsync(
|
||||
HttpClient client, int providerId, string mappingId, CancellationToken ct)
|
||||
{
|
||||
try
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Attaching usertypeid mapping {Id} to provider {ProviderId}",
|
||||
mappingId, providerId);
|
||||
|
||||
// ── 1. Fetch current provider to get existing mappings ───────────
|
||||
var getResp = await client.GetAsync($"/api/v3/providers/saml/{providerId}/", ct);
|
||||
if (!getResp.IsSuccessStatusCode)
|
||||
{
|
||||
_logger.LogWarning("[Authentik] Could not fetch provider {Id} (HTTP {Status})",
|
||||
providerId, (int)getResp.StatusCode);
|
||||
return;
|
||||
}
|
||||
|
||||
var body = await getResp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
var mappings = new List<string>();
|
||||
|
||||
// ── 2. Get existing mappings ───────────────────────────────────
|
||||
if (doc.RootElement.TryGetProperty("property_mappings", out var mapsProp) &&
|
||||
mapsProp.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var mapEl in mapsProp.EnumerateArray())
|
||||
{
|
||||
var mapId = mapEl.ValueKind == JsonValueKind.String
|
||||
? mapEl.GetString()
|
||||
: (mapEl.TryGetProperty("pk", out var pkProp)
|
||||
? pkProp.GetString()
|
||||
: null);
|
||||
|
||||
if (!string.IsNullOrEmpty(mapId) && !mappings.Contains(mapId))
|
||||
mappings.Add(mapId);
|
||||
}
|
||||
}
|
||||
|
||||
// ── 3. Add new mapping if not already present ──────────────────
|
||||
if (!mappings.Contains(mappingId))
|
||||
mappings.Add(mappingId);
|
||||
|
||||
// ── 4. Patch provider with updated mappings ───────────────────
|
||||
var patchPayload = JsonSerializer.Serialize(new Dictionary<string, object>
|
||||
{
|
||||
["property_mappings"] = mappings,
|
||||
});
|
||||
var patchContent = new StringContent(patchPayload, Encoding.UTF8, "application/json");
|
||||
var patchReq = new HttpRequestMessage(HttpMethod.Patch, $"/api/v3/providers/saml/{providerId}/")
|
||||
{
|
||||
Content = patchContent,
|
||||
};
|
||||
|
||||
var patchResp = await client.SendAsync(patchReq, ct);
|
||||
if (patchResp.IsSuccessStatusCode)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Usertypeid mapping attached to provider {Id}", providerId);
|
||||
}
|
||||
else
|
||||
{
|
||||
var err = await patchResp.Content.ReadAsStringAsync(ct);
|
||||
_logger.LogWarning("[Authentik] Failed to attach usertypeid mapping to provider {Id} (HTTP {Status}): {Error}",
|
||||
providerId, (int)patchResp.StatusCode, err);
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogWarning(ex, "[Authentik] Error attaching usertypeid mapping to provider {Id}", providerId);
|
||||
}
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// Flow resolution
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
@@ -997,6 +1241,592 @@ public class AuthentikService : IAuthentikService
|
||||
return config;
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// Customer invitation infrastructure
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<string> CreateGroupAsync(string groupName, CancellationToken ct = default)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Creating group '{Name}'", groupName);
|
||||
var (_, client) = await CreateAuthenticatedClientAsync();
|
||||
|
||||
// Check if the group already exists
|
||||
var existingPk = await TryGetGroupPkByNameAsync(client, groupName, ct);
|
||||
if (existingPk != null)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Group '{Name}' already exists (pk={Pk})", groupName, existingPk);
|
||||
return existingPk;
|
||||
}
|
||||
|
||||
var payload = JsonSerializer.Serialize(new Dictionary<string, object> { ["name"] = groupName });
|
||||
var content = new StringContent(payload, Encoding.UTF8, "application/json");
|
||||
var resp = await client.PostAsync("/api/v3/core/groups/", content, ct);
|
||||
|
||||
if (!resp.IsSuccessStatusCode)
|
||||
{
|
||||
var error = await resp.Content.ReadAsStringAsync(ct);
|
||||
throw new InvalidOperationException($"Failed to create Authentik group '{groupName}' (HTTP {(int)resp.StatusCode}): {error}");
|
||||
}
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
var pk = doc.RootElement.GetProperty("pk").GetString()
|
||||
?? throw new InvalidOperationException("Authentik returned null PK for created group.");
|
||||
|
||||
_logger.LogInformation("[Authentik] Group '{Name}' created (pk={Pk})", groupName, pk);
|
||||
return pk;
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<string> CreateInvitationStageAsync(
|
||||
string stageName, bool continueWithoutInvitation = false, CancellationToken ct = default)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Creating invitation stage '{Name}'", stageName);
|
||||
var (_, client) = await CreateAuthenticatedClientAsync();
|
||||
|
||||
// Check if stage already exists
|
||||
var existingPk = await FindStageByNameAsync(stageName, ct);
|
||||
if (existingPk != null)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Invitation stage '{Name}' already exists (pk={Pk})", stageName, existingPk);
|
||||
return existingPk;
|
||||
}
|
||||
|
||||
var payload = JsonSerializer.Serialize(new Dictionary<string, object>
|
||||
{
|
||||
["name"] = stageName,
|
||||
["continue_flow_without_invitation"] = continueWithoutInvitation,
|
||||
});
|
||||
var content = new StringContent(payload, Encoding.UTF8, "application/json");
|
||||
var resp = await client.PostAsync("/api/v3/stages/invitation/stages/", content, ct);
|
||||
|
||||
if (!resp.IsSuccessStatusCode)
|
||||
{
|
||||
var error = await resp.Content.ReadAsStringAsync(ct);
|
||||
throw new InvalidOperationException(
|
||||
$"Failed to create invitation stage '{stageName}' (HTTP {(int)resp.StatusCode}): {error}");
|
||||
}
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
var pk = doc.RootElement.GetProperty("pk").GetString()
|
||||
?? throw new InvalidOperationException("Authentik returned null PK for created invitation stage.");
|
||||
|
||||
_logger.LogInformation("[Authentik] Invitation stage '{Name}' created (pk={Pk})", stageName, pk);
|
||||
return pk;
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<string> CreateEnrollmentFlowAsync(string name, string slug, CancellationToken ct = default)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Creating enrollment flow '{Name}' (slug={Slug})", name, slug);
|
||||
var (_, client) = await CreateAuthenticatedClientAsync();
|
||||
|
||||
// Check if flow already exists by slug
|
||||
var existingPk = await TryGetFlowPkBySlugAsync(client, slug, ct);
|
||||
if (existingPk != null)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Flow '{Slug}' already exists (pk={Pk})", slug, existingPk);
|
||||
return existingPk;
|
||||
}
|
||||
|
||||
var payload = JsonSerializer.Serialize(new Dictionary<string, object>
|
||||
{
|
||||
["name"] = name,
|
||||
["slug"] = slug,
|
||||
["designation"] = "enrollment",
|
||||
["title"] = name,
|
||||
});
|
||||
var content = new StringContent(payload, Encoding.UTF8, "application/json");
|
||||
var resp = await client.PostAsync("/api/v3/flows/instances/", content, ct);
|
||||
|
||||
if (!resp.IsSuccessStatusCode)
|
||||
{
|
||||
var error = await resp.Content.ReadAsStringAsync(ct);
|
||||
throw new InvalidOperationException(
|
||||
$"Failed to create enrollment flow '{slug}' (HTTP {(int)resp.StatusCode}): {error}");
|
||||
}
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
var pk = doc.RootElement.GetProperty("pk").GetString()
|
||||
?? throw new InvalidOperationException("Authentik returned null PK for created flow.");
|
||||
|
||||
_logger.LogInformation("[Authentik] Enrollment flow '{Slug}' created (pk={Pk})", slug, pk);
|
||||
return pk;
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task BindStageToFlowAsync(string flowSlug, string stagePk, int order, CancellationToken ct = default)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Binding stage {StagePk} to flow '{Slug}' at order {Order}", stagePk, flowSlug, order);
|
||||
var (_, client) = await CreateAuthenticatedClientAsync();
|
||||
|
||||
// Check if binding already exists at this order
|
||||
var existingBinding = await GetFlowStageBindingPkAsync(flowSlug, order, ct);
|
||||
if (existingBinding != null)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Flow '{Slug}' already has a stage binding at order {Order} — skipping", flowSlug, order);
|
||||
return;
|
||||
}
|
||||
|
||||
var payload = JsonSerializer.Serialize(new Dictionary<string, object>
|
||||
{
|
||||
["target"] = flowSlug,
|
||||
["stage"] = stagePk,
|
||||
["order"] = order,
|
||||
});
|
||||
var content = new StringContent(payload, Encoding.UTF8, "application/json");
|
||||
var resp = await client.PostAsync("/api/v3/flows/bindings/", content, ct);
|
||||
|
||||
if (!resp.IsSuccessStatusCode)
|
||||
{
|
||||
var error = await resp.Content.ReadAsStringAsync(ct);
|
||||
throw new InvalidOperationException(
|
||||
$"Failed to bind stage to flow '{flowSlug}' at order {order} (HTTP {(int)resp.StatusCode}): {error}");
|
||||
}
|
||||
|
||||
_logger.LogInformation("[Authentik] Stage bound to flow '{Slug}' at order {Order}", flowSlug, order);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<string> CreateExpressionPolicyAsync(string name, string expression, CancellationToken ct = default)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Creating expression policy '{Name}'", name);
|
||||
var (_, client) = await CreateAuthenticatedClientAsync();
|
||||
|
||||
// Check if policy already exists
|
||||
var existingPk = await TryGetPolicyPkByNameAsync(client, name, ct);
|
||||
if (existingPk != null)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Expression policy '{Name}' already exists (pk={Pk})", name, existingPk);
|
||||
return existingPk;
|
||||
}
|
||||
|
||||
var payload = JsonSerializer.Serialize(new Dictionary<string, object>
|
||||
{
|
||||
["name"] = name,
|
||||
["expression"] = expression,
|
||||
["execution_logging"] = true,
|
||||
});
|
||||
var content = new StringContent(payload, Encoding.UTF8, "application/json");
|
||||
var resp = await client.PostAsync("/api/v3/policies/expression/", content, ct);
|
||||
|
||||
if (!resp.IsSuccessStatusCode)
|
||||
{
|
||||
var error = await resp.Content.ReadAsStringAsync(ct);
|
||||
throw new InvalidOperationException(
|
||||
$"Failed to create expression policy '{name}' (HTTP {(int)resp.StatusCode}): {error}");
|
||||
}
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
var pk = doc.RootElement.GetProperty("pk").GetString()
|
||||
?? throw new InvalidOperationException("Authentik returned null PK for created policy.");
|
||||
|
||||
_logger.LogInformation("[Authentik] Expression policy '{Name}' created (pk={Pk})", name, pk);
|
||||
return pk;
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task BindPolicyToFlowStageBoundAsync(
|
||||
string flowStageBindingPk, string policyPk, CancellationToken ct = default)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Binding policy {PolicyPk} to flow-stage binding {FsbPk}", policyPk, flowStageBindingPk);
|
||||
var (_, client) = await CreateAuthenticatedClientAsync();
|
||||
|
||||
var payload = JsonSerializer.Serialize(new Dictionary<string, object>
|
||||
{
|
||||
["target"] = flowStageBindingPk,
|
||||
["policy"] = policyPk,
|
||||
["order"] = 0,
|
||||
});
|
||||
var content = new StringContent(payload, Encoding.UTF8, "application/json");
|
||||
var resp = await client.PostAsync("/api/v3/policies/bindings/", content, ct);
|
||||
|
||||
if (!resp.IsSuccessStatusCode)
|
||||
{
|
||||
var error = await resp.Content.ReadAsStringAsync(ct);
|
||||
throw new InvalidOperationException(
|
||||
$"Failed to bind policy to flow-stage binding (HTTP {(int)resp.StatusCode}): {error}");
|
||||
}
|
||||
|
||||
_logger.LogInformation("[Authentik] Policy bound to flow-stage binding");
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task BindPolicyToFlowAsync(string flowSlug, string policyPk, CancellationToken ct = default)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Binding policy {PolicyPk} to flow '{Slug}'", policyPk, flowSlug);
|
||||
var (_, client) = await CreateAuthenticatedClientAsync();
|
||||
|
||||
// Get the flow PK from slug
|
||||
var flowPk = await TryGetFlowPkBySlugAsync(client, flowSlug, ct)
|
||||
?? throw new InvalidOperationException($"Flow '{flowSlug}' not found.");
|
||||
|
||||
var payload = JsonSerializer.Serialize(new Dictionary<string, object>
|
||||
{
|
||||
["target"] = flowPk,
|
||||
["policy"] = policyPk,
|
||||
["order"] = 0,
|
||||
});
|
||||
var content = new StringContent(payload, Encoding.UTF8, "application/json");
|
||||
var resp = await client.PostAsync("/api/v3/policies/bindings/", content, ct);
|
||||
|
||||
if (!resp.IsSuccessStatusCode)
|
||||
{
|
||||
var error = await resp.Content.ReadAsStringAsync(ct);
|
||||
throw new InvalidOperationException(
|
||||
$"Failed to bind policy to flow '{flowSlug}' (HTTP {(int)resp.StatusCode}): {error}");
|
||||
}
|
||||
|
||||
_logger.LogInformation("[Authentik] Policy bound to flow '{Slug}'", flowSlug);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<string> CreateRoleAsync(string roleName, CancellationToken ct = default)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Creating role '{Name}'", roleName);
|
||||
var (_, client) = await CreateAuthenticatedClientAsync();
|
||||
|
||||
// Check if role already exists
|
||||
var existingPk = await TryGetRolePkByNameAsync(client, roleName, ct);
|
||||
if (existingPk != null)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Role '{Name}' already exists (pk={Pk})", roleName, existingPk);
|
||||
return existingPk;
|
||||
}
|
||||
|
||||
var payload = JsonSerializer.Serialize(new Dictionary<string, object> { ["name"] = roleName });
|
||||
var content = new StringContent(payload, Encoding.UTF8, "application/json");
|
||||
var resp = await client.PostAsync("/api/v3/rbac/roles/", content, ct);
|
||||
|
||||
if (!resp.IsSuccessStatusCode)
|
||||
{
|
||||
var error = await resp.Content.ReadAsStringAsync(ct);
|
||||
throw new InvalidOperationException(
|
||||
$"Failed to create Authentik role '{roleName}' (HTTP {(int)resp.StatusCode}): {error}");
|
||||
}
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
var pk = doc.RootElement.GetProperty("pk").GetString()
|
||||
?? throw new InvalidOperationException("Authentik returned null PK for created role.");
|
||||
|
||||
_logger.LogInformation("[Authentik] Role '{Name}' created (pk={Pk})", roleName, pk);
|
||||
return pk;
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task AssignPermissionsToRoleAsync(
|
||||
string rolePk, IEnumerable<string> permissionCodenames, CancellationToken ct = default)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Assigning permissions to role {RolePk}", rolePk);
|
||||
var (_, client) = await CreateAuthenticatedClientAsync();
|
||||
|
||||
// Resolve permission IDs from codenames
|
||||
var permIds = await ResolvePermissionIdsAsync(client, permissionCodenames, ct);
|
||||
if (permIds.Count == 0)
|
||||
{
|
||||
_logger.LogWarning("[Authentik] No permission IDs resolved — skipping assignment");
|
||||
return;
|
||||
}
|
||||
|
||||
var payload = JsonSerializer.Serialize(new Dictionary<string, object>
|
||||
{
|
||||
["permissions"] = permIds,
|
||||
});
|
||||
var content = new StringContent(payload, Encoding.UTF8, "application/json");
|
||||
var resp = await client.PostAsync($"/api/v3/rbac/roles/{rolePk}/assign_permission/", content, ct);
|
||||
|
||||
// Some Authentik versions use a PATCH or different endpoint structure.
|
||||
// Try alternative if POST fails.
|
||||
if (!resp.IsSuccessStatusCode)
|
||||
{
|
||||
// Fallback: try assigning via the permissions endpoint with model/object_pk
|
||||
_logger.LogDebug("[Authentik] Direct permission assignment returned HTTP {Status}, trying alternative approach",
|
||||
(int)resp.StatusCode);
|
||||
|
||||
foreach (var permId in permIds)
|
||||
{
|
||||
var singlePayload = JsonSerializer.Serialize(new Dictionary<string, object>
|
||||
{
|
||||
["permission"] = permId,
|
||||
["role"] = rolePk,
|
||||
});
|
||||
var singleContent = new StringContent(singlePayload, Encoding.UTF8, "application/json");
|
||||
var singleResp = await client.PostAsync("/api/v3/rbac/permissions/assigned_by_roles/assign/", singleContent, ct);
|
||||
if (!singleResp.IsSuccessStatusCode)
|
||||
{
|
||||
var error = await singleResp.Content.ReadAsStringAsync(ct);
|
||||
_logger.LogWarning("[Authentik] Failed to assign permission {PermId} to role (HTTP {Status}): {Error}",
|
||||
permId, (int)singleResp.StatusCode, error);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
_logger.LogInformation("[Authentik] Permissions assigned to role {RolePk}", rolePk);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task AssignRoleToGroupAsync(string rolePk, string groupPk, CancellationToken ct = default)
|
||||
{
|
||||
_logger.LogInformation("[Authentik] Assigning role {RolePk} to group {GroupPk}", rolePk, groupPk);
|
||||
var (_, client) = await CreateAuthenticatedClientAsync();
|
||||
|
||||
// Authentik manages role→group mapping via the group's roles list
|
||||
// PATCH the group to add the role
|
||||
var getResp = await client.GetAsync($"/api/v3/core/groups/{groupPk}/", ct);
|
||||
if (!getResp.IsSuccessStatusCode)
|
||||
{
|
||||
var error = await getResp.Content.ReadAsStringAsync(ct);
|
||||
throw new InvalidOperationException(
|
||||
$"Failed to fetch group {groupPk} (HTTP {(int)getResp.StatusCode}): {error}");
|
||||
}
|
||||
|
||||
var groupBody = await getResp.Content.ReadAsStringAsync(ct);
|
||||
using var groupDoc = JsonDocument.Parse(groupBody);
|
||||
var existingRoles = new List<string>();
|
||||
|
||||
if (groupDoc.RootElement.TryGetProperty("roles", out var rolesProp) &&
|
||||
rolesProp.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var r in rolesProp.EnumerateArray())
|
||||
{
|
||||
var val = r.GetString();
|
||||
if (!string.IsNullOrEmpty(val))
|
||||
existingRoles.Add(val);
|
||||
}
|
||||
}
|
||||
|
||||
if (!existingRoles.Contains(rolePk))
|
||||
existingRoles.Add(rolePk);
|
||||
|
||||
var patchPayload = JsonSerializer.Serialize(new Dictionary<string, object>
|
||||
{
|
||||
["roles"] = existingRoles,
|
||||
});
|
||||
var patchContent = new StringContent(patchPayload, Encoding.UTF8, "application/json");
|
||||
var patchReq = new HttpRequestMessage(HttpMethod.Patch, $"/api/v3/core/groups/{groupPk}/")
|
||||
{
|
||||
Content = patchContent,
|
||||
};
|
||||
|
||||
var patchResp = await client.SendAsync(patchReq, ct);
|
||||
if (!patchResp.IsSuccessStatusCode)
|
||||
{
|
||||
var error = await patchResp.Content.ReadAsStringAsync(ct);
|
||||
throw new InvalidOperationException(
|
||||
$"Failed to assign role to group (HTTP {(int)patchResp.StatusCode}): {error}");
|
||||
}
|
||||
|
||||
_logger.LogInformation("[Authentik] Role {RolePk} assigned to group {GroupPk}", rolePk, groupPk);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<string?> GetFlowStageBindingPkAsync(string flowSlug, int order, CancellationToken ct = default)
|
||||
{
|
||||
var (_, client) = await CreateAuthenticatedClientAsync();
|
||||
var resp = await client.GetAsync($"/api/v3/flows/bindings/?target={flowSlug}&ordering=order", ct);
|
||||
|
||||
if (!resp.IsSuccessStatusCode) return null;
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
|
||||
if (doc.RootElement.TryGetProperty("results", out var results) && results.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var binding in results.EnumerateArray())
|
||||
{
|
||||
if (binding.TryGetProperty("order", out var orderProp) && orderProp.GetInt32() == order)
|
||||
{
|
||||
return binding.TryGetProperty("pk", out var pkProp) ? pkProp.GetString() : null;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public async Task<string?> FindStageByNameAsync(string nameContains, CancellationToken ct = default)
|
||||
{
|
||||
var (_, client) = await CreateAuthenticatedClientAsync();
|
||||
var resp = await client.GetAsync($"/api/v3/stages/all/?search={Uri.EscapeDataString(nameContains)}&page_size=50", ct);
|
||||
|
||||
if (!resp.IsSuccessStatusCode) return null;
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
|
||||
if (doc.RootElement.TryGetProperty("results", out var results) && results.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var stage in results.EnumerateArray())
|
||||
{
|
||||
var name = stage.TryGetProperty("name", out var nameProp) ? nameProp.GetString() : null;
|
||||
if (name != null && name.Contains(nameContains, StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
return stage.TryGetProperty("pk", out var pkProp) ? pkProp.GetString() : null;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// Invitation infrastructure helpers
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
private async Task<string?> TryGetGroupPkByNameAsync(HttpClient client, string name, CancellationToken ct)
|
||||
{
|
||||
try
|
||||
{
|
||||
var resp = await client.GetAsync($"/api/v3/core/groups/?search={Uri.EscapeDataString(name)}&page_size=50", ct);
|
||||
if (!resp.IsSuccessStatusCode) return null;
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
|
||||
if (doc.RootElement.TryGetProperty("results", out var results) && results.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var g in results.EnumerateArray())
|
||||
{
|
||||
var gName = g.TryGetProperty("name", out var nProp) ? nProp.GetString() : null;
|
||||
if (string.Equals(gName, name, StringComparison.OrdinalIgnoreCase))
|
||||
return g.TryGetProperty("pk", out var pkProp) ? pkProp.GetString() : null;
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogDebug(ex, "[Authentik] Error checking for existing group '{Name}'", name);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
private async Task<string?> TryGetFlowPkBySlugAsync(HttpClient client, string slug, CancellationToken ct)
|
||||
{
|
||||
try
|
||||
{
|
||||
var resp = await client.GetAsync($"/api/v3/flows/instances/?slug={Uri.EscapeDataString(slug)}", ct);
|
||||
if (!resp.IsSuccessStatusCode) return null;
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
|
||||
if (doc.RootElement.TryGetProperty("results", out var results) && results.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var f in results.EnumerateArray())
|
||||
{
|
||||
var fSlug = f.TryGetProperty("slug", out var sProp) ? sProp.GetString() : null;
|
||||
if (string.Equals(fSlug, slug, StringComparison.OrdinalIgnoreCase))
|
||||
return f.TryGetProperty("pk", out var pkProp) ? pkProp.GetString() : null;
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogDebug(ex, "[Authentik] Error checking for existing flow '{Slug}'", slug);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
private async Task<string?> TryGetPolicyPkByNameAsync(HttpClient client, string name, CancellationToken ct)
|
||||
{
|
||||
try
|
||||
{
|
||||
var resp = await client.GetAsync($"/api/v3/policies/expression/?search={Uri.EscapeDataString(name)}&page_size=50", ct);
|
||||
if (!resp.IsSuccessStatusCode) return null;
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
|
||||
if (doc.RootElement.TryGetProperty("results", out var results) && results.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var p in results.EnumerateArray())
|
||||
{
|
||||
var pName = p.TryGetProperty("name", out var nProp) ? nProp.GetString() : null;
|
||||
if (string.Equals(pName, name, StringComparison.OrdinalIgnoreCase))
|
||||
return p.TryGetProperty("pk", out var pkProp) ? pkProp.GetString() : null;
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogDebug(ex, "[Authentik] Error checking for existing policy '{Name}'", name);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
private async Task<string?> TryGetRolePkByNameAsync(HttpClient client, string name, CancellationToken ct)
|
||||
{
|
||||
try
|
||||
{
|
||||
var resp = await client.GetAsync($"/api/v3/rbac/roles/?search={Uri.EscapeDataString(name)}&page_size=50", ct);
|
||||
if (!resp.IsSuccessStatusCode) return null;
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
|
||||
if (doc.RootElement.TryGetProperty("results", out var results) && results.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var r in results.EnumerateArray())
|
||||
{
|
||||
var rName = r.TryGetProperty("name", out var nProp) ? nProp.GetString() : null;
|
||||
if (string.Equals(rName, name, StringComparison.OrdinalIgnoreCase))
|
||||
return r.TryGetProperty("pk", out var pkProp) ? pkProp.GetString() : null;
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogDebug(ex, "[Authentik] Error checking for existing role '{Name}'", name);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
private async Task<List<int>> ResolvePermissionIdsAsync(
|
||||
HttpClient client, IEnumerable<string> codenames, CancellationToken ct)
|
||||
{
|
||||
var ids = new List<int>();
|
||||
var codenameSet = new HashSet<string>(codenames, StringComparer.OrdinalIgnoreCase);
|
||||
|
||||
try
|
||||
{
|
||||
var resp = await client.GetAsync("/api/v3/rbac/permissions/?page_size=500", ct);
|
||||
if (!resp.IsSuccessStatusCode)
|
||||
{
|
||||
_logger.LogWarning("[Authentik] Could not list permissions (HTTP {Status})", (int)resp.StatusCode);
|
||||
return ids;
|
||||
}
|
||||
|
||||
var body = await resp.Content.ReadAsStringAsync(ct);
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
|
||||
if (doc.RootElement.TryGetProperty("results", out var results) && results.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var perm in results.EnumerateArray())
|
||||
{
|
||||
var codename = perm.TryGetProperty("codename", out var cnProp) ? cnProp.GetString() : null;
|
||||
if (codename != null && codenameSet.Contains(codename))
|
||||
{
|
||||
if (perm.TryGetProperty("id", out var idProp) && idProp.TryGetInt32(out var id))
|
||||
ids.Add(id);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogWarning(ex, "[Authentik] Error resolving permission IDs");
|
||||
}
|
||||
|
||||
_logger.LogDebug("[Authentik] Resolved {Count}/{Total} permission ID(s)", ids.Count, codenameSet.Count);
|
||||
return ids;
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
// API response DTOs (internal)
|
||||
// ─────────────────────────────────────────────────────────────────────────
|
||||
|
||||
Reference in New Issue
Block a user