Skip to content
GitLab Next
  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • GitLab GitLab
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Locked Files
  • Issues 43,133
    • Issues 43,133
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 1,371
    • Merge requests 1,371
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
    • Test Cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages & Registries
    • Packages & Registries
    • Package Registry
    • Container Registry
    • Infrastructure Registry
  • Monitor
    • Monitor
    • Metrics
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Code review
    • Insights
    • Issue
    • Repository
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar

GitLab 15.0 has launched! Please visit Breaking changes in 15.0 and 15.0 Removals to see which breaking changes may impact your workflow.

  • GitLab.org
  • GitLabGitLab
  • Merge requests
  • !17744

Add individual inherited member lookup API

  • Review changes

  • Download
  • Email patches
  • Plain diff
Merged Hordur Freyr Yngvason requested to merge allow-api-lookup-of-inherited-member-by-id into master Sep 26, 2019
  • Overview 43
  • Commits 3
  • Pipelines 20
  • Changes 4

What does this MR do?

1. Adds individual inherited member lookup

Adds the endpoints

/(groups|projects)/:id/members/all/:user_id

similar to the existing

/(groups|projects)/:id/members/all      # all members of group or project, including inherited members
/(groups|projects)/:id/members/:user_id # is this user a direct member of the group or project?

It is a new endpoint because changing the behavior of

/(groups|projects)/:id/members/:user_id

is technically not backwards compatible and would just introduce the inverse problem (no simple way to check for direct membership).

2. Adds filtering by user ID on search endpoints

Since

/(groups|projects)/:id/members/
/(groups|projects)/:id/members/all

only allow to filter on a fuzzy search param, I'm proposing we also add a query parameter

user_ids[]=...

as an alternative to making multiple requests of the type

/(groups|projects)/:id/members/(all/):user_id

Background

Currently, JupyterHub login via gitlab is failing for members inherited from parent groups, #31165 (closed). The reason is that the

/(groups|projects)/:id/members/:user_id

endpoints only look up direct members, not inherited ones. The idea was to use

/(groups|projects)/:id/members/all?query=:username

on the oauthenticator side instead, but we discovered that this search is a bit too fuzzy for our purposes (see also the oauthenticator pull request https://github.com/jupyterhub/oauthenticator/pull/283) and would overcomplicate something that should be very simple.

Screenshots

Does this MR meet the acceptance criteria?

Conformity

  • Changelog entry
  • Documentation created/updated or follow-up review issue created
  • Code review guidelines
  • Merge request performance guidelines
  • Style guides
  • Database guides
  • Separation of EE specific content

Performance and Testing

  • [-] Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
  • [-] Tested in all supported browsers

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited Oct 04, 2019 by Hordur Freyr Yngvason
Assignee
Assign to
Reviewer
Request review from
Time tracking
Source branch: allow-api-lookup-of-inherited-member-by-id