Auto add user to correct organization based on JWT token

[pimmerks]

Feature description 💡

Hi, we would like to have an option available to automatically add users to the correct Organization based on the ID/JWT token that the user is authenticated with.

This feature can have different use-cases:

• In an organization where each 'team' has it's own 'Terrakube organization', and teams are managed by the Identity Provider
• Allowing access to Terrakube in a B2B scenario.

The general flow would be:

1. User logs in
   The IDP adds a specific claim to the JWT token, for example organization
2. Terrakube checks JWT token ({..., "organization": "org-a", ...})
3. Terrakube checks if org-a exists
4. Terrakube adds user to org-a

We could possible also create the organization if it does not exists yet.

This behaviour should be configurable in the settings.

# Settings example:
createOrganizationOnLogin: true/false
addUserToOrganizationOnLogin: true/false
organizationNameClaim: "organization"

I am able to help with creating a PR if you see value in this feature.

Anything else?

No response

[alfespa17]

This sounds like an interesting idea, feel free to send a pull request with this feature and just keep in mind to leave some option to enable or disable it.

I guess you can add some logic similar to the one that we use to validate if a PAT token is deleted in this part of the code

terrakube/api/src/main/java/org/terrakube/api/plugin/security/authentication/dex/DexAuthenticationManagerResolver.java

Line 51 in 9b45945

if (isTokenDeleted(getTokenId(request))){

And you can parse the token similar to this.

terrakube/api/src/main/java/org/terrakube/api/plugin/security/authentication/dex/DexAuthenticationManagerResolver.java

Line 92 in 9b45945

private String getTokenId(HttpServletRequest request) {

Or you can also parse it like this.

terrakube/registry/src/main/java/org/terrakube/registry/configuration/authentication/dex/RegistryAuthenticationManagerResolver.java

Line 57 in 9b45945

private String getJwtIssuer(HttpServletRequest request) {