cloudfoundry / korifi

Cloud Foundry on Kubernetes
Apache License 2.0
317 stars 65 forks source link

[Bug]: Space roles cannot be listed by user GUIDs #2302

Open danail-branekov opened 1 year ago

danail-branekov commented 1 year ago

Blockers

This story is blocked on proposing a holistic user management strategy for Korifi

What happened?

According to the CF API,

user_guids | list of strings | Comma-delimited list of user guids to filter by

However, we are currently filtering roles by user names

Also, see the discussion on relationships.user argument of role creation

relationships.user | to-one relationship | A relationship to a user; the user can be defined by either a guid or, if the set_roles_by_username feature_flag is enabled, a username (with the option of including an origin to disambiguate it)

Currently in Korifi we do not have the concept of users, we just piggyback role bindings. Therefore we just have user names, but not user guids. One could argue that using user names as guids is good enough but this is not true in cases we want to use OIDC provides. In the tokens they issue there are distinct claims, such as user_id (which is the actual user guid), origin (that translates into OIDC prefix) and user_name.

What you expected to happen

TBD

Acceptance Criteria

GIVEN WHEN I THEN I

How to reproduce it (as minimally and precisely as possible)

TBD

Anything else we need to know?

No response

Environment

Revision of codebase: Kubernetes version (use kubectl version): Cloud provider or hardware configuration: Others:

georgethebeatle commented 1 year ago

This story is part of the users epic

Proposal doc for user support: https://docs.google.com/document/d/1GpeKxcDSKoSOiRsKVOWlq0klADj1MAui6iI3i5uZwYM/edit