{"action":"created","issue":{"url":"https://api.github.com/repos/spinnaker/fiat/issues/41","repository_url":"https://api.github.com/repos/spinnaker/fiat","labels_url":"https://api.github.com/repos/spinnaker/fiat/issues/41/labels{/name}","comments_url":"https://api.github.com/repos/spinnaker/fiat/issues/41/comments","events_url":"https://api.github.com/repos/spinnaker/fiat/issues/41/events","html_url":"https://github.com/spinnaker/fiat/issues/41","id":174611313,"number":41,"title":"Roles passed through SAML assertion are dropped on first sync ","user":{"login":"ttomsu","id":13141550,"avatar_url":"https://avatars.githubusercontent.com/u/13141550?v=3","gravatar_id":"","url":"https://api.github.com/users/ttomsu","html_url":"https://github.com/ttomsu","followers_url":"https://api.github.com/users/ttomsu/followers","following_url":"https://api.github.com/users/ttomsu/following{/other_user}","gists_url":"https://api.github.com/users/ttomsu/gists{/gist_id}","starred_url":"https://api.github.com/users/ttomsu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ttomsu/subscriptions","organizations_url":"https://api.github.com/users/ttomsu/orgs","repos_url":"https://api.github.com/users/ttomsu/repos","events_url":"https://api.github.com/users/ttomsu/events{/privacy}","received_events_url":"https://api.github.com/users/ttomsu/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spinnaker/fiat/labels/bug","name":"bug","color":"ee0701"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/spinnaker/fiat/milestones/1","html_url":"https://github.com/spinnaker/fiat/milestones/1.0%20Release","labels_url":"https://api.github.com/repos/spinnaker/fiat/milestones/1/labels","id":1978420,"number":1,"title":"1.0 Release","description":"Initial release of Fiat with integrations with Gate, Orca, Clouddriver, Echo, and Front50.","creator":{"login":"ttomsu","id":13141550,"avatar_url":"https://avatars.githubusercontent.com/u/13141550?v=3","gravatar_id":"","url":"https://api.github.com/users/ttomsu","html_url":"https://github.com/ttomsu","followers_url":"https://api.github.com/users/ttomsu/followers","following_url":"https://api.github.com/users/ttomsu/following{/other_user}","gists_url":"https://api.github.com/users/ttomsu/gists{/gist_id}","starred_url":"https://api.github.com/users/ttomsu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ttomsu/subscriptions","organizations_url":"https://api.github.com/users/ttomsu/orgs","repos_url":"https://api.github.com/users/ttomsu/repos","events_url":"https://api.github.com/users/ttomsu/events{/privacy}","received_events_url":"https://api.github.com/users/ttomsu/received_events","type":"User","site_admin":false},"open_issues":13,"closed_issues":2,"state":"open","created_at":"2016-09-01T18:26:13Z","updated_at":"2016-09-06T21:13:10Z","due_on":"2016-09-29T00:00:00Z","closed_at":null},"comments":4,"created_at":"2016-09-01T19:55:53Z","updated_at":"2016-09-07T12:08:19Z","closed_at":null,"body":"Reported by @jvasallo, @ndcampbell"},"comment":{"url":"https://api.github.com/repos/spinnaker/fiat/issues/comments/245260228","html_url":"https://github.com/spinnaker/fiat/issues/41#issuecomment-245260228","issue_url":"https://api.github.com/repos/spinnaker/fiat/issues/41","id":245260228,"user":{"login":"ttomsu","id":13141550,"avatar_url":"https://avatars.githubusercontent.com/u/13141550?v=3","gravatar_id":"","url":"https://api.github.com/users/ttomsu","html_url":"https://github.com/ttomsu","followers_url":"https://api.github.com/users/ttomsu/followers","following_url":"https://api.github.com/users/ttomsu/following{/other_user}","gists_url":"https://api.github.com/users/ttomsu/gists{/gist_id}","starred_url":"https://api.github.com/users/ttomsu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ttomsu/subscriptions","organizations_url":"https://api.github.com/users/ttomsu/orgs","repos_url":"https://api.github.com/users/ttomsu/repos","events_url":"https://api.github.com/users/ttomsu/events{/privacy}","received_events_url":"https://api.github.com/users/ttomsu/received_events","type":"User","site_admin":false},"created_at":"2016-09-07T12:08:19Z","updated_at":"2016-09-07T12:08:19Z","body":"Spoke with @jvasallo on Slack. They're setup for users to have SAML roles passed in, but are trying to use X509 certs with email addresses that map to GitHub Teams accounts. The code linked above does in fact work as intended by logging out any user whose roles have changed between syncs. \r\n\r\nAs I see it, there are actually two issues here:\r\n1. What to do about the situation above - mixed auth/z in Gate\r\n2. What to do in the future in Fiat - the issue described is definitely present.\r\n\r\nA few options considered:\r\n1. For X509 certs, default to including a role with the exact string as the username. Each cert would then be individually whitelisted.\r\n2. Deleting the line of code that logs out a user if their roles change. \r\n3. Splitting `User.roles` into separate `externalRoles` and `providerRoles` lists. "}}
{"actor":{"display_login":"ttomsu"}}