databroker: update identity manager to use route credentials (#5728)

## Summary
Currently when we refresh sessions we always use the global IdP
credentials. This PR updates the identity manager to use route settings
when defined.

To do this a new `idp_id` field is added to the session stored in the
databroker.

## Related issues
-
[ENG-2595](https://linear.app/pomerium/issue/ENG-2595/refresh-using-custom-idp-uses-wrong-credentials)
- https://github.com/pomerium/pomerium/issues/4759

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [x] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [x] ready for review
This commit is contained in:
Caleb Doxsey 2025-07-15 18:04:36 -06:00 committed by GitHub
parent e5e799a868
commit 622519e901
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
14 changed files with 185 additions and 123 deletions

View file

@ -52,7 +52,7 @@ func (p *Proxy) getUserInfoData(r *http.Request) handlers.UserInfoData {
if err == nil {
data.Session, data.IsImpersonated, err = p.getSession(r.Context(), ss.ID)
if err != nil {
data.Session = &session.Session{Id: ss.ID}
data.Session = session.New(ss.IdentityProviderID, ss.ID)
}
data.User, err = p.getUser(r.Context(), data.Session.GetUserId())