Package io.deephaven.enterprise.authserver

Class DeephavenGroupSynchronizer

java.lang.Object

io.deephaven.enterprise.authserver.DeephavenGroupSynchronizer

All Implemented Interfaces:

GroupSynchronizer

public class DeephavenGroupSynchronizer
extends Object
implements GroupSynchronizer

Synchronizes groups from the idP to the Deephaven ACL database.

When a user is authenticated via SAML or Active Directory, the idP (e.g. Okta) or directory can provide a list of groups to the service (i.e us). When the user does not yet exist in Deephaven, this class creates the user and assigns the user to the given groups. If the user already exists, then groups that the idP references are added to the user and groups that the idP does not reference are removed from the user.

To enable inexact translation between the idP groups and Deephaven groups, the following properties may be set:

• authentication.samlauth.sync.ignoregroups.idp: These groups from the IdP are not added to Deephaven. Okta development, for example, includes an "Everyone" group. You can avoid replicating that group by including it in this comma separated list.
• authentication.samlauth.sync.ignoregroups.dh: These Deephaven groups are not removed. For example, you may not want to remove users from "iris-acleditors" or other internal groups.
• authentication.samlauth.sync.mapgroup.<name>: Maps name from the idP group list to a set of Deephaven groups.

Similar properties may be set for Active directory group synchronization:

• authentication.server.ldap.sync.ignoregroups.directory: These groups from the Active Directory are not added to Deephaven.
• authentication.server.ldap.sync.ignoregroups.dh: These Deephaven groups are not removed. For example, you may not want to remove users from "iris-acleditors" or other internal groups.
• authentication.server.ldap.sync.mapgroup.<name>: Maps name from the Active Directory group list to a set of Deephaven groups.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static interface	DeephavenGroupSynchronizer.GroupSynchronizerPropertyNames

Nested classes/interfaces inherited from interface io.deephaven.enterprise.authserver.GroupSynchronizer

GroupSynchronizer.Null

Field Summary

Fields

Modifier and Type	Field	Description
final com.fishlib.io.logger.Logger	log

Constructor Summary

Constructors

Constructor	Description
DeephavenGroupSynchronizer(@NotNull com.fishlib.configuration.Configuration configuration, @NotNull com.fishlib.io.logger.Logger log, @NotNull IrisGroupProvider groupProvider, @NotNull DbAclWriter aclWriter, @NotNull DeephavenGroupSynchronizer.GroupSynchronizerPropertyNames propNames)

Method Summary

Modifier and Type	Method	Description
void	synchronizeGroups(@NotNull String user, @NotNull Collection<String> providerGroups)	Called after groups are provided by the authentication provider for an authenticated user.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

log

public final com.fishlib.io.logger.Logger log

Constructor Details

DeephavenGroupSynchronizer

public DeephavenGroupSynchronizer(@NotNull
 @NotNull com.fishlib.configuration.Configuration configuration,
 @NotNull
 @NotNull com.fishlib.io.logger.Logger log,
 @NotNull
 @NotNull IrisGroupProvider groupProvider,
 @NotNull
 @NotNull DbAclWriter aclWriter,
 @NotNull
 @NotNull DeephavenGroupSynchronizer.GroupSynchronizerPropertyNames propNames)

Method Details

synchronizeGroups

public void synchronizeGroups(@NotNull
 @NotNull String user,
 @NotNull
 @NotNull Collection<String> providerGroups)

Description copied from interface: GroupSynchronizer

Called after groups are provided by the authentication provider for an authenticated user.

Specified by:

synchronizeGroups in interface GroupSynchronizer

Parameters:

user - the authenticated user

providerGroups - the list of external groups for the user