Skip to content

Add SAML provider search to UsersFinder

What does this MR do?

Adds the by_saml_provider_id query param to UsersFinder.

  • This was done so that lib/api/users.rb can later be changed (in a separate MR: !66167 (merged)) to accept this param too, so that get /users can be queried by the Invite members modal, to display the suggested users to invite list, when the group or project's group is using enforced group_saml.

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/333625

Required by !63565 (merged) and !66167 (merged)

There is no changelog entry because it is developer-facing only and nothing is using the new finder param yet. The API will use this in the next MR, and the changelog and documentation will go with that one.

SQL

SELECT "users".* FROM "users" INNER JOIN "identities" ON "identities"."user_id" = "users"."id" WHERE "identities"."saml_provider_id" = 1

QUERY PLAN

                                                QUERY PLAN
-------------------------------------------------------------------------------------------------------------
 Nested Loop  (cost=0.27..9.67 rows=2 width=1387)
   ->  Index Scan using index_identities_on_saml_provider_id on identities  (cost=0.12..4.16 rows=3 width=4)
         Index Cond: (saml_provider_id = 1)
   ->  Index Scan using users_pkey on users  (cost=0.14..1.83 rows=1 width=1387)
         Index Cond: (id = identities.user_id)
(5 rows)

Screenshots or Screencasts (strongly suggested)

Screen_Shot_2021-07-19_at_7.06.54_PM

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

Does this MR contain changes to processing or storing of credentials or tokens, authorization and authentication methods or other items described in the security review guidelines? If not, then delete this Security section.

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Mayra Cabrera

Merge request reports