Self service journey of Identy provider Group Mapping for stackspot IAM

[eduardohyodozup]

Description

Given an account with SSO integrated, it's essential to be able to map groups of user's external to provider to the platform groups. This feature covers how this can be achieved and capabilities which will be provided to customer to be able to configure them.

Concepts

• Association: Associating a user with a given group retrieved by its external authentication provider
• External Group: Groups inherited from external authentication provider
• Group: Stackspot/IAM group
• Named Capture Group: A REGEX capture group with a name binded to it

Usecase Flow

Association

1. Setup SSO
2. A user authenticates using SSO
3. Their external groups are associated to their Stackspot user
4. User is able to access the resources granted by Stackspot groups their got associated with

Disassociation

1. Setup SSO
2. A user authenticates using SSO
3. Their external groups are associated to their Stackspot user
4. User is able to access the resources granted by Stackspot groups their got associated with
5. User loses some external groups in SSO provider
6. When user reauthenticates in platform the respective groups removed in the SSO provider gets removed as well in platform

Proposed Solution

Creation of a group mapper REGEX where a rule is set and the captured external group is the group name to associate the user with. If user is not in the group then they are inserted into it.

To perform disassociation, the same REGEX is applied to user's current groups and if any filtered group is not in the external groups it gets removed.

Mapper configuration

• Raw

  • Raw REGEX query is performed in a given group table column.

  • Capture group example: (?<name>\d{4})

  • Possible names for capture group:

    • name query will be performed using table column called name
    • slug query will be performed using table column called slug

  • Example usage:

    • (?<name>^.*$) will map the exact external group name to group, so if there is a external group in users authentication named FW4-FW4-P_AI_STACKSPOT_ADMIN_V2 the user will be added to group FW4-FW4-P_AI_STACKSPOT_ADMIN_V2 in the platform as well. The follwing query will be executed: SELECT * from groups where name = 'FW4-FW4-P_AI_STACKSPOT_ADMIN_V2'

• Default

  • Pre computed configuration where the REGEX get parsed and pre-determined operations are already setup

  • All rules are exclusive (only one applies at time)

  • Capture group example: (?<name>\d{4})

  • Capture Group Prefixes (column that query will be performed)

    • name: Find by group name
    • slug: Find by group slug

  • Capture Group Suffixes:

    • _endswith: retrieves all groups that ends with captured value
    • _startswith: retrieves all groups that starts with captured value
    • _contains: retrieves all groups that contains captured value
    • _match: retrieve all groups that matches captured value

  • Simple Example usage:

    • (?<name_startswith>\ABC_) -> SELECT from groups where name like 'ABC_%' (all groups that name starts with ABC_)
    • (?<name_endswith>\_CDE) SELECT from groups where name like '%_CDE' (all groups that name ends with _CDE)
    • (?<name_contains>\ABC) -> SELECT from groups where name like '%ABC%' (all groups that name contains with ABC)
    • (?<name_match>\ABC) -> SELECT from groups where name = 'ABC' (all groups that name equals ABC)

  • Dynamic matching usage:

  • ^FW4-FW4-P_(?<name_match>.*)$ -> Will capture any remaining text that comes after FW4-FW4-P_ and perform a match search in group table using column name. Example:

    • If this external group is present in users authentication FW4-FW4-P_AI_STACKSPOT_ADMIN_V2 their will be added to group AI_STACKSPOT_ADMIN_V2 by the execution of the following query: SELECT * from groups where name = 'AI_STACKSPOT_ADMIN_V2'
    • All suffixes modes are available to be used as well