From 81c0f21f78c860f9e1133c151d32bc73bf1313f1 Mon Sep 17 00:00:00 2001 From: Ralf Haferkamp Date: Tue, 14 Mar 2023 17:25:07 +0100 Subject: [PATCH] graph: Allow to disable the default role assignment on user creation Introduces a switch ('GRAPH_ASSIGN_DEFAULT_USER_ROLE') to allow to disable the assignment of the default role "User" to newly created users. This will be used for setups where the role-assignments are populated either manually or during first login (e.g. from OIDC claims) --- services/graph/pkg/config/config.go | 1 + services/graph/pkg/config/defaults/defaultconfig.go | 1 + services/graph/pkg/service/v0/users.go | 2 +- 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/services/graph/pkg/config/config.go b/services/graph/pkg/config/config.go index 4e4998d26..fd0025ff4 100644 --- a/services/graph/pkg/config/config.go +++ b/services/graph/pkg/config/config.go @@ -99,6 +99,7 @@ type Identity struct { type API struct { GroupMembersPatchLimit int `yaml:"group_members_patch_limit" env:"GRAPH_GROUP_MEMBERS_PATCH_LIMIT" desc:"The amount of group members allowed to be added with a single patch request."` UsernameMatch string `yaml:"graph_username_match" env:"GRAPH_USERNAME_MATCH" desc:"Option to allow legacy usernames. Supported options are 'default' and 'none'."` + AssignDefaultUserRole bool `yaml:"graph_assign_default_user_role" env:"GRAPH_ASSIGN_DEFAULT_USER_ROLE" desc:"Whether to assign newly created users the default role 'User'. Set this to 'false' if you want to assign roles manually, or if the role assignment should happen at first login. Set this to 'true' (the default) to assign the role 'User' when creating a new user."` } // Events combines the configuration options for the event bus. diff --git a/services/graph/pkg/config/defaults/defaultconfig.go b/services/graph/pkg/config/defaults/defaultconfig.go index 1d313a378..7c17e7f4e 100644 --- a/services/graph/pkg/config/defaults/defaultconfig.go +++ b/services/graph/pkg/config/defaults/defaultconfig.go @@ -40,6 +40,7 @@ func DefaultConfig() *config.Config { API: config.API{ GroupMembersPatchLimit: 20, UsernameMatch: "default", + AssignDefaultUserRole: true, }, Reva: shared.DefaultRevaConfig(), Spaces: config.Spaces{ diff --git a/services/graph/pkg/service/v0/users.go b/services/graph/pkg/service/v0/users.go index 87ce1136e..d27e4b37e 100644 --- a/services/graph/pkg/service/v0/users.go +++ b/services/graph/pkg/service/v0/users.go @@ -328,7 +328,7 @@ func (g Graph) PostUser(w http.ResponseWriter, r *http.Request) { } // assign roles if possible - if g.roleService != nil { + if g.roleService != nil && g.config.API.AssignDefaultUserRole { // All users get the user role by default currently. // to all new users for now, as create Account request does not have any role field if _, err = g.roleService.AssignRoleToUser(r.Context(), &settings.AssignRoleToUserRequest{