move directory providers (#3633)

* remove directory providers and support for groups

* idp: remove directory providers

* better error messages

* fix errors

* restore postgres

* fix test

authenticate/handlers.go

@@ -30,7 +30,6 @@ import (
 	"github.com/pomerium/pomerium/internal/urlutil"
 	"github.com/pomerium/pomerium/pkg/cryptutil"
 	"github.com/pomerium/pomerium/pkg/grpc/databroker"
-	"github.com/pomerium/pomerium/pkg/grpc/directory"
 	"github.com/pomerium/pomerium/pkg/grpc/session"
 	"github.com/pomerium/pomerium/pkg/grpc/user"
 )
@@ -544,34 +543,13 @@ func (a *Authenticate) getUserInfoData(r *http.Request) (handlers.UserInfoData,
 			Id: pbSession.GetUserId(),
 		}
 	}
-	pbDirectoryUser, err := a.getDirectoryUser(r.Context(), pbSession.GetUserId())
-	if err != nil {
-		pbDirectoryUser = &directory.User{
-			Id: pbSession.GetUserId(),
-		}
-	}
-	var groups []*directory.Group
-	for _, groupID := range pbDirectoryUser.GetGroupIds() {
-		pbDirectoryGroup, err := directory.GetGroup(r.Context(), state.dataBrokerClient, groupID)
-		if err != nil {
-			pbDirectoryGroup = &directory.Group{
-				Id:    groupID,
-				Name:  groupID,
-				Email: groupID,
-			}
-		}
-		groups = append(groups, pbDirectoryGroup)
-	}
-
 	creationOptions, requestOptions, _ := a.webauthn.GetOptions(r.Context())
 
 	return handlers.UserInfoData{
-		CSRFToken:       csrf.Token(r),
-		DirectoryGroups: groups,
-		DirectoryUser:   pbDirectoryUser,
-		IsImpersonated:  isImpersonated,
-		Session:         pbSession,
-		User:            pbUser,
+		CSRFToken:      csrf.Token(r),
+		IsImpersonated: isImpersonated,
+		Session:        pbSession,
+		User:           pbUser,
 
 		WebAuthnCreationOptions: creationOptions,
 		WebAuthnRequestOptions:  requestOptions,
@@ -645,14 +623,6 @@ func (a *Authenticate) saveSessionToDataBroker(
 	sessionState.DatabrokerServerVersion = res.GetServerVersion()
 	sessionState.DatabrokerRecordVersion = res.GetRecord().GetVersion()
 
-	_, err = state.directoryClient.RefreshUser(ctx, &directory.RefreshUserRequest{
-		UserId:      s.UserId,
-		AccessToken: accessToken.AccessToken,
-	})
-	if err != nil {
-		log.Error(ctx).Err(err).Msg("directory: failed to refresh user data")
-	}
-
 	return nil
 }
 
@@ -718,11 +688,6 @@ func (a *Authenticate) getUser(ctx context.Context, userID string) (*user.User,
 	return user.Get(ctx, client, userID)
 }
 
-func (a *Authenticate) getDirectoryUser(ctx context.Context, userID string) (*directory.User, error) {
-	client := a.state.Load().dataBrokerClient
-	return directory.GetUser(ctx, client, userID)
-}
-
 func (a *Authenticate) getWebauthnState(ctx context.Context) (*webauthn.State, error) {
 	state := a.state.Load()
 

authenticate/handlers/userinfo.go

@@ -6,7 +6,6 @@ import (
 
 	"google.golang.org/protobuf/encoding/protojson"
 
-	"github.com/pomerium/pomerium/internal/directory"
 	"github.com/pomerium/pomerium/internal/httputil"
 	"github.com/pomerium/pomerium/pkg/grpc/session"
 	"github.com/pomerium/pomerium/pkg/grpc/user"
@@ -16,12 +15,10 @@ import (
 
 // UserInfoData is the data for the UserInfo page.
 type UserInfoData struct {
-	CSRFToken       string
-	DirectoryGroups []*directory.Group
-	DirectoryUser   *directory.User
-	IsImpersonated  bool
-	Session         *session.Session
-	User            *user.User
+	CSRFToken      string
+	IsImpersonated bool
+	Session        *session.Session
+	User           *user.User
 
 	WebAuthnCreationOptions *webauthn.PublicKeyCredentialCreationOptions
 	WebAuthnRequestOptions  *webauthn.PublicKeyCredentialRequestOptions
@@ -34,16 +31,6 @@ type UserInfoData struct {
 func (data UserInfoData) ToJSON() map[string]any {
 	m := map[string]any{}
 	m["csrfToken"] = data.CSRFToken
-	var directoryGroups []json.RawMessage
-	for _, directoryGroup := range data.DirectoryGroups {
-		if bs, err := protojson.Marshal(directoryGroup); err == nil {
-			directoryGroups = append(directoryGroups, json.RawMessage(bs))
-		}
-	}
-	m["directoryGroups"] = directoryGroups
-	if bs, err := protojson.Marshal(data.DirectoryUser); err == nil {
-		m["directoryUser"] = json.RawMessage(bs)
-	}
 	m["isImpersonated"] = data.IsImpersonated
 	if bs, err := protojson.Marshal(data.Session); err == nil {
 		m["session"] = json.RawMessage(bs)

authenticate/handlers_test.go

@@ -14,14 +14,11 @@ import (
 
 	"github.com/go-jose/go-jose/v3/jwt"
 	"github.com/golang/mock/gomock"
-	"github.com/golang/protobuf/ptypes/empty"
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/crypto/chacha20poly1305"
 	"golang.org/x/oauth2"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/pomerium/pomerium/authenticate/handlers/webauthn"
@@ -38,7 +35,6 @@ import (
 	"github.com/pomerium/pomerium/internal/urlutil"
 	"github.com/pomerium/pomerium/pkg/cryptutil"
 	"github.com/pomerium/pomerium/pkg/grpc/databroker"
-	"github.com/pomerium/pomerium/pkg/grpc/directory"
 	"github.com/pomerium/pomerium/pkg/grpc/session"
 )
 
@@ -165,7 +161,6 @@ func TestAuthenticate_SignIn(t *testing.T) {
 							}, nil
 						},
 					},
-					directoryClient: new(mockDirectoryServiceClient),
 				}),
 
 				options: config.NewAtomicOptions(),
@@ -321,7 +316,6 @@ func TestAuthenticate_SignOut(t *testing.T) {
 							return nil, nil
 						},
 					},
-					directoryClient: new(mockDirectoryServiceClient),
 				}),
 				options: config.NewAtomicOptions(),
 			}
@@ -423,10 +417,9 @@ func TestAuthenticate_OAuthCallback(t *testing.T) {
 							return nil, nil
 						},
 					},
-					directoryClient: new(mockDirectoryServiceClient),
-					redirectURL:     authURL,
-					sessionStore:    tt.session,
-					cookieCipher:    aead,
+					redirectURL:  authURL,
+					sessionStore: tt.session,
+					cookieCipher: aead,
 				}),
 				options: config.NewAtomicOptions(),
 			}
@@ -565,7 +558,6 @@ func TestAuthenticate_SessionValidatorMiddleware(t *testing.T) {
 							}, nil
 						},
 					},
-					directoryClient: new(mockDirectoryServiceClient),
 				}),
 				options: config.NewAtomicOptions(),
 			}
@@ -681,7 +673,6 @@ func TestAuthenticate_userInfo(t *testing.T) {
 							}, nil
 						},
 					},
-					directoryClient: new(mockDirectoryServiceClient),
 				}),
 			}
 			a.webauthn = webauthn.New(a.getWebauthnState)
@@ -723,19 +714,6 @@ func (m mockDataBrokerServiceClient) Put(ctx context.Context, in *databroker.Put
 	return m.put(ctx, in, opts...)
 }
 
-type mockDirectoryServiceClient struct {
-	directory.DirectoryServiceClient
-
-	refreshUser func(ctx context.Context, in *directory.RefreshUserRequest, opts ...grpc.CallOption) (*empty.Empty, error)
-}
-
-func (m mockDirectoryServiceClient) RefreshUser(ctx context.Context, in *directory.RefreshUserRequest, opts ...grpc.CallOption) (*empty.Empty, error) {
-	if m.refreshUser != nil {
-		return m.refreshUser(ctx, in, opts...)
-	}
-	return nil, status.Error(codes.Unimplemented, "")
-}
-
 func mustParseURL(rawurl string) *url.URL {
 	u, err := url.Parse(rawurl)
 	if err != nil {

authenticate/identity.go

@@ -30,7 +30,6 @@ func defaultGetIdentityProvider(options *config.Options, idpID string) (identity
 		ClientID:        idp.GetClientId(),
 		ClientSecret:    idp.GetClientSecret(),
 		Scopes:          idp.GetScopes(),
-		ServiceAccount:  idp.GetServiceAccount(),
 		AuthCodeOptions: idp.GetRequestParams(),
 	})
 }

authenticate/state.go

@@ -18,7 +18,6 @@ import (
 	"github.com/pomerium/pomerium/pkg/cryptutil"
 	"github.com/pomerium/pomerium/pkg/grpc"
 	"github.com/pomerium/pomerium/pkg/grpc/databroker"
-	"github.com/pomerium/pomerium/pkg/grpc/directory"
 	"github.com/pomerium/pomerium/pkg/webauthnutil"
 	"github.com/pomerium/webauthn"
 )
@@ -47,7 +46,6 @@ type authenticateState struct {
 	jwk *jose.JSONWebKeySet
 
 	dataBrokerClient databroker.DataBrokerServiceClient
-	directoryClient  directory.DirectoryServiceClient
 
 	webauthnRelyingParty *webauthn.RelyingParty
 }
@@ -154,7 +152,6 @@ func newAuthenticateStateFromConfig(cfg *config.Config) (*authenticateState, err
 	}
 
 	state.dataBrokerClient = databroker.NewDataBrokerServiceClient(dataBrokerConn)
-	state.directoryClient = directory.NewDirectoryServiceClient(dataBrokerConn)
 
 	state.webauthnRelyingParty = webauthn.NewRelyingParty(
 		authenticateURL.String(),