authentik.enterprise.providers.google_workspace.clients.groups

  1from django.db import transaction
  2from django.utils.text import slugify
  3
  4from authentik.core.models import Group
  5from authentik.enterprise.providers.google_workspace.clients.base import GoogleWorkspaceSyncClient
  6from authentik.enterprise.providers.google_workspace.models import (
  7    GoogleWorkspaceProvider,
  8    GoogleWorkspaceProviderGroup,
  9    GoogleWorkspaceProviderMapping,
 10    GoogleWorkspaceProviderUser,
 11)
 12from authentik.lib.sync.mapper import PropertyMappingManager
 13from authentik.lib.sync.outgoing.base import Direction
 14from authentik.lib.sync.outgoing.exceptions import (
 15    NotFoundSyncException,
 16    ObjectExistsSyncException,
 17    TransientSyncException,
 18)
 19from authentik.lib.sync.outgoing.models import OutgoingSyncDeleteAction
 20
 21
 22class GoogleWorkspaceGroupClient(
 23    GoogleWorkspaceSyncClient[Group, GoogleWorkspaceProviderGroup, dict]
 24):
 25    """Google client for groups"""
 26
 27    connection_type = GoogleWorkspaceProviderGroup
 28    connection_type_query = "group"
 29    can_discover = True
 30
 31    def __init__(self, provider: GoogleWorkspaceProvider) -> None:
 32        super().__init__(provider)
 33        self.mapper = PropertyMappingManager(
 34            self.provider.property_mappings_group.all().order_by("name").select_subclasses(),
 35            GoogleWorkspaceProviderMapping,
 36            ["group", "provider", "connection"],
 37        )
 38
 39    def to_schema(self, obj: Group, connection: GoogleWorkspaceProviderGroup) -> dict:
 40        """Convert authentik group"""
 41        return super().to_schema(
 42            obj,
 43            connection=connection,
 44            email=f"{slugify(obj.name)}@{self.provider.default_group_email_domain}",
 45        )
 46
 47    def delete(self, identifier: str):
 48        """Delete group"""
 49        GoogleWorkspaceProviderGroup.objects.filter(
 50            provider=self.provider, google_id=identifier
 51        ).delete()
 52        if self.provider.group_delete_action == OutgoingSyncDeleteAction.DELETE:
 53            return self._request(self.directory_service.groups().delete(groupKey=identifier))
 54
 55    def create(self, group: Group):
 56        """Create group from scratch and create a connection object"""
 57        google_group = self.to_schema(group, None)
 58        self.check_email_valid(google_group["email"])
 59        with transaction.atomic():
 60            try:
 61                response = self._request(self.directory_service.groups().insert(body=google_group))
 62            except ObjectExistsSyncException:
 63                # group already exists in google workspace, so we can connect them manually
 64                # for groups we need to fetch the group from google as we connect on
 65                # ID and not group email
 66                group_data = self._request(
 67                    self.directory_service.groups().get(groupKey=google_group["email"])
 68                )
 69                return GoogleWorkspaceProviderGroup.objects.create(
 70                    provider=self.provider,
 71                    group=group,
 72                    google_id=group_data["id"],
 73                    attributes=group_data,
 74                )
 75            else:
 76                return GoogleWorkspaceProviderGroup.objects.create(
 77                    provider=self.provider,
 78                    group=group,
 79                    google_id=response["id"],
 80                    attributes=response,
 81                )
 82
 83    def update(self, group: Group, connection: GoogleWorkspaceProviderGroup):
 84        """Update existing group"""
 85        google_group = self.to_schema(group, connection)
 86        self.check_email_valid(google_group["email"])
 87        try:
 88            response = self._request(
 89                self.directory_service.groups().update(
 90                    groupKey=connection.google_id,
 91                    body=google_group,
 92                )
 93            )
 94            connection.attributes = response
 95            connection.save()
 96        except NotFoundSyncException:
 97            # Resource missing is handled by self.write, which will re-create the group
 98            raise
 99
100    def write(self, obj: Group):
101        google_group, created = super().write(obj)
102        self.create_sync_members(obj, google_group)
103        return google_group, created
104
105    def create_sync_members(self, obj: Group, google_group: GoogleWorkspaceProviderGroup):
106        """Sync all members after a group was created"""
107        users = list(obj.users.order_by("id").values_list("id", flat=True))
108        connections = GoogleWorkspaceProviderUser.objects.filter(
109            provider=self.provider, user__pk__in=users
110        ).values_list("google_id", flat=True)
111        self._patch(google_group.google_id, Direction.add, connections)
112
113    def update_group(self, group: Group, action: Direction, users_set: set[int]):
114        """Update a groups members"""
115        if action == Direction.add:
116            return self._patch_add_users(group, users_set)
117        if action == Direction.remove:
118            return self._patch_remove_users(group, users_set)
119
120    def _patch(self, google_group_id: str, direction: Direction, members: list[str]):
121        for user in members:
122            try:
123                if direction == Direction.add:
124                    self._request(
125                        self.directory_service.members().insert(
126                            groupKey=google_group_id, body={"email": user}
127                        )
128                    )
129                if direction == Direction.remove:
130                    self._request(
131                        self.directory_service.members().delete(
132                            groupKey=google_group_id, memberKey=user
133                        )
134                    )
135            except ObjectExistsSyncException:
136                pass
137            except TransientSyncException:
138                raise
139
140    def _patch_add_users(self, group: Group, users_set: set[int]):
141        """Add users in users_set to group"""
142        if len(users_set) < 1:
143            return
144        google_group = GoogleWorkspaceProviderGroup.objects.filter(
145            provider=self.provider, group=group
146        ).first()
147        if not google_group:
148            self.logger.warning(
149                "could not sync group membership, group does not exist", group=group
150            )
151            return
152        user_ids = list(
153            GoogleWorkspaceProviderUser.objects.filter(
154                user__pk__in=users_set, provider=self.provider
155            ).values_list("google_id", flat=True)
156        )
157        if len(user_ids) < 1:
158            return
159        self._patch(google_group.google_id, Direction.add, user_ids)
160
161    def _patch_remove_users(self, group: Group, users_set: set[int]):
162        """Remove users in users_set from group"""
163        if len(users_set) < 1:
164            return
165        google_group = GoogleWorkspaceProviderGroup.objects.filter(
166            provider=self.provider, group=group
167        ).first()
168        if not google_group:
169            self.logger.warning(
170                "could not sync group membership, group does not exist", group=group
171            )
172            return
173        user_ids = list(
174            GoogleWorkspaceProviderUser.objects.filter(
175                user__pk__in=users_set, provider=self.provider
176            ).values_list("google_id", flat=True)
177        )
178        if len(user_ids) < 1:
179            return
180        self._patch(google_group.google_id, Direction.remove, user_ids)
181
182    def discover(self):
183        """Iterate through all groups and connect them with authentik groups if possible"""
184        request = self.directory_service.groups().list(
185            customer="my_customer", maxResults=500, orderBy="email"
186        )
187        while request:
188            response = request.execute()
189            for group in response.get("groups", []):
190                self._discover_single_group(group)
191            request = self.directory_service.groups().list_next(
192                previous_request=request, previous_response=response
193            )
194
195    def _discover_single_group(self, group: dict):
196        """handle discovery of a single group"""
197        google_name = group["name"]
198        google_id = group["id"]
199        matching_authentik_group = (
200            self.provider.get_object_qs(Group).filter(name=google_name).first()
201        )
202        if not matching_authentik_group:
203            return
204        GoogleWorkspaceProviderGroup.objects.update_or_create(
205            provider=self.provider,
206            group=matching_authentik_group,
207            google_id=google_id,
208            defaults={"attributes": group},
209        )
210
211    def update_single_attribute(self, connection: GoogleWorkspaceProviderUser):
212        group = self.directory_service.groups().get(connection.google_id)
213        connection.attributes = group