expose dex's allowedGroups config option

[bcmdarroch]

User Story

Dex recently added a feature that allows specifying certain SAML groups to allow. Exposing this will allow customers to reduce the number of groups passed around in requests.

Definition of Done

• user can set config/submit a patch that specifies which groups should be allowed to authenticate and returned in dex's claims
• document it

Demo Script / Repro Steps

[dex.v1.sys.connectors.saml]
groups_attr = "groups"
allowed_groups = ["IT", "ChefAdmins"]

chef-automate config patch saml.toml

Reference

dexidp/dex#1544

[srenatus]

habitat-sh/core-plans#3311 the plan is up to date ☑️

[srenatus]

Dex recently added a feature that allows specifying certain SAML groups to allow. Exposing this will allow customers to reduce the number of groups passed around in requests.

So... it just occurred to me that exposing the setting alone will not unbreak A2 for people with too many (SAML) groups. See this test case, and how ident is not changed in the relevant code section.

Hence exposing this setting will allow people to restrict the set of users that can login via SAML, to those being a member of the right groups, only. Any groups that are included in the SAML response for the user will be included in the ID token. It's not the equivalent of the LDAP group filter.

To really subset the incoming groups to a few, another code change to dex would be required.

[srenatus]

Thinking about this more, what it gives us is a second way to restrict access to (SAML) users, which would be bypassing our IAM system. The same thing could be achieved by having a policy that grants access only to the chosen "allowed" SAML groups, I think.

If that assessment is correct, I'd rather not expose this config setting. At least not given the current code, non-filtering. I'll look into what it would take to filter upstream (dex).

[srenatus]

• connector/saml: add 'FilterGroups' setting dexidp/dex#1704
• another release with that commit in it
• adapt the dex config to include the flag together with allowedGroups