mystiq/dex
Archived
4
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow the "google" connector to work without a service account

Browse source 
Fixes #1718
This commit is contained in:
Brian Candler 2020-05-20 18:00:06 +00:00
parent 709d4169d6
commit 442d3de11d
2 changed files with 9 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
connector/google/google.go
View file

@ -212,7 +212,7 @@ func (c *googleConnector) createIdentity(ctx context.Context, identity connector
}
var groups []string
if s.Groups && c.adminEmail != "" && c.serviceAccountFilePath != "" {
if s.Groups && c.adminSrv != nil {
groups, err = c.getGroups(claims.Email)
if err != nil {
return identity, fmt.Errorf("google: could not retrieve groups: %v", err)
@ -251,7 +251,7 @@ func (c *googleConnector) getGroups(email string) ([]string, error) {
}
for _, group := range groupsList.Groups {
// TODO (joelspeed): Make desried group key configurable
// TODO (joelspeed): Make desired group key configurable
userGroups = append(userGroups, group.Email)
}
@ -267,6 +267,12 @@ func (c *googleConnector) getGroups(email string) ([]string, error) {
// sets up super user impersonation and creates an admin client for calling
// the google admin api
func createDirectoryService(serviceAccountFilePath string, email string) (*admin.Service, error) {
if serviceAccountFilePath == "" && email == "" {
return nil, nil
}
if serviceAccountFilePath == "" || email == "" {
return nil, fmt.Errorf("directory service requires both serviceAccountFilePath and adminEmail")
}
jsonCredentials, err := ioutil.ReadFile(serviceAccountFilePath)
if err != nil {
return nil, fmt.Errorf("error reading credentials from file: %v", err)

2
examples/config-dev.yaml
View file

@ -70,7 +70,7 @@ connectors:
- type: mockCallback
id: mock
name: Example
# - type: oidc
# - type: google
# id: google
# name: Google
# config: