Fix dry-run panic when syncing new users to existing groups - #313
Open
tbobm wants to merge 2 commits into
Open
Conversation
) Root cause: dryClient.CreateUser skips the real SCIM call, so the returned user always had an empty ID. DryIdentityStore.IsMemberInGroups was a straight pass-through to AWS, which rejected the empty userId with a ValidationException. Two changes, both scoped to the dry-run shims: - Add virtual_id.go: deterministic UUIDv5 IDs with a deadbeef00- prefix that satisfies the AWS regex and is detectable without shared state. dryClient.CreateUser/UpdateUser now populate u.ID with these IDs. - Short-circuit IsMemberInGroups, GetGroupMembershipId, and ListGroupMemberships in DryIdentityStore when any input ID is virtual, returning a safe synthetic response instead of calling AWS.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi ! Thanks for this great project:)
I faced issues already reported while using dry run mode and wanted to experiment with a solution, let me know if this could work for you.
When
DRY_RUN=trueand a Google user does not yet exist in AWS Identity Store,SyncGroupsUserscrashes with:Two root causes in the dry-run shims:
dryClient.CreateUserskips the real SCIM call, so the returned user always had an emptyID.DryIdentityStore.IsMemberInGroupswas a straight pass-through to AWS, which then received the empty userId and rejected it.Both changes are scoped to the dry-run shims, no production code paths are touched.
internal/aws/virtual_id.go(new): generates deterministic UUIDv5 IDs with adeadbeef00-prefix that satisfies the AWS regex and is detectable without shared state between the two shims.internal/aws/client_dry.go:CreateUserandUpdateUsernow populateu.IDwith a virtual ID.internal/aws/identitystore_dry.go:IsMemberInGroups,GetGroupMembershipId, andListGroupMembershipsshort-circuit when any input ID is virtual, returning a safe synthetic response instead of forwarding to AWS.