Repository navigation
Feat(ui): SSO configuration from UI and Scim bot token generate revoke functionality and Group Mapping in settings page - #21839
Conversation
github-actions
Bot
added
safe to test
shrushti2000
changed the title
shrushti2000
changed the title
….com/open-metadata/OpenMetadata into scim-bot-settings-page-functionality
….com/open-metadata/OpenMetadata into scim-bot-settings-page-functionality
|
The Java checkstyle failed. Please run You can install the pre-commit hooks with |
|
The Java checkstyle failed. Please run You can install the pre-commit hooks with |
| this.jwtFilter = | ||
| new JwtFilter(config.getAuthenticationConfiguration(), config.getAuthorizerConfiguration()); | ||
| new JwtFilter( | ||
| SecurityConfigurationManager.getInstance().getCurrentAuthConfig(), |
There was a problem hiding this comment.
nit: create a static method getCurrentAuthConfig() that check for INSTANCE nullability and call INSTANCE. getCurrentAuthConfig
| new ServletHolder(new AuthRefreshServlet(authenticationCodeFlowHandler)); | ||
| refreshHolder.setName("auth_refresh"); | ||
| environment.getApplicationContext().addServlet(refreshHolder, "/api/v1/auth/refresh"); | ||
| SessionCookieConfig cookieConfig = |
There was a problem hiding this comment.
for this one , please check that session timeout is not happening on multi tabs
default session expiry if of 30 mins , after which the session is removed .
So refresh does not work in taht case , we added below to extend that session expiry
There was a problem hiding this comment.
Checked SESSION_ID expiry time in active tab. Session timeout didnt happen in any tab.
| // Ensure we have a session handler | ||
| // Ensure we have a session handler | ||
| if (SecurityConfigurationManager.getInstance().getCurrentAuthConfig() != null | ||
| && SecurityConfigurationManager.getInstance() |
There was a problem hiding this comment.
you can add static helper for these kinds of things on SecurityConfigurationManager , like isSaml(), isConfidentialClient()
It could be helpfule and provides better readablilty
| catalogConfig.getAuthorizerConfiguration())), | ||
| "/api/v1/saml/logout"); | ||
|
|
||
| if (contextHandler.getServletHandler().getServletMapping("/api/v1/saml/login") == null) { |
There was a problem hiding this comment.
we don't need this check for if, internals already has this.containsServletHolder that prevents it
try (AutoLock ignored = this.lock()) {
if (!this.containsServletHolder(servlet)) {
this.setServlets((ServletHolder[])ArrayUtil.addToArray(holders, servlet, ServletHolder.class));
}
}
|
|
This PR introduces following functionalities:-
SSO configuration from UI through settings page.
Users can configure different sso providers from the ui by filling config fields in the form instead of updating any yml files.
Note: Currently there is no provision to reset back to basic provider if any sso is already configured. Only config fields for existing sso can be edited and saved.
SCIM Token Generate and Revoke Functionality (Collate only feature for Azure and Okta)
Edit sso config fields functionality for already configured sso through Configure Tab
Group Mapping
This functionality allows to map users from scim groups to Collate groups. (Collate only feature for Azure and Okta)
Working Demonstrations:-
Screen.Recording.2025-09-10.at.11.05.48.PM.mov
Screen.Recording.2025-09-10.at.9.51.50.PM.mov
Screen.Recording.2025-09-10.at.9.52.16.PM.mov
This functionality allows to map users from scim groups to Collate groups. (Collate only feature for Azure and Okta)
Screen.Recording.2025-09-10.at.9.53.34.PM.mov
Type of change:
Checklist:
Fixes <issue-number>: <short explanation>