Added primary_user config map and wiring

Author: glpatcern

cache/user.go

@@ -20,11 +20,13 @@ import (
 //   user:groups:<opaqueID>                      → JSON []string
 
 const (
-	userIDPrefix       = "user:id:"
-	userUsernamePrefix = "user:username:"
-	userMailPrefix     = "user:mail:"
-	userNamePrefix     = "user:name:"
-	userGroupsPrefix   = "user:groups:"
+	userIDPrefix          = "user:id:"
+	userUsernamePrefix    = "user:username:"
+	userMailPrefix        = "user:mail:"
+	userNamePrefix        = "user:name:"
+	userGroupsPrefix      = "user:groups:"
+	userIAMUUIDPrefix     = "user:iamuuid:"   // opaqueID -> IAM account UUID
+	userOpaqueIDByIAMUUID = "user:byiamuuid:" // IAM account UUID -> opaqueID
 )
 
 // UserCache is a Redis-backed cache for CS3 user objects and their group
@@ -144,3 +146,42 @@ func (c *UserCache) GetGroups(ctx context.Context, opaqueID string) ([]string, e
 	}
 	return groups, nil
 }
+
+// StoreIAMUUID records the two-way mapping between a remapped OpaqueId and
+// the original IAM account UUID, so callers can resolve in either direction:
+//   - GetIAMUUID:   opaqueID -> iamUUID  (used by the user driver for
+//     group-membership lookups against the IAM API)
+//   - GetOpaqueIDByIAMUUID: iamUUID -> opaqueID  (used by the group driver
+//     to report the same OpaqueId for a member that GetUser/FindUsers
+//     would report)
+//
+// Only called for accounts that were actually remapped via primary_users;
+// the common case (OpaqueId == IAM UUID) needs no entry in either direction.
+func (c *UserCache) StoreIAMUUID(opaqueID, iamUUID string) error {
+	if err := store(c.pools, userIAMUUIDPrefix+strings.ToLower(opaqueID), iamUUID, c.userTTLSecs); err != nil {
+		return err
+	}
+	return store(c.pools, userOpaqueIDByIAMUUID+strings.ToLower(iamUUID), opaqueID, c.userTTLSecs)
+}
+
+// GetIAMUUID resolves the IAM account UUID for a given OpaqueId. If no
+// mapping is present, callers should fall back to treating opaqueID itself
+// as the IAM UUID.
+func (c *UserCache) GetIAMUUID(ctx context.Context, opaqueID string) (string, error) {
+	var uuid string
+	if err := fetch(ctx, c.pools, userIAMUUIDPrefix+strings.ToLower(opaqueID), &uuid); err != nil {
+		return "", err
+	}
+	return uuid, nil
+}
+
+// GetOpaqueIDByIAMUUID resolves the public OpaqueId for a given IAM account
+// UUID. If no mapping is present, callers should fall back to treating the
+// IAM UUID itself as the OpaqueId (the common, non-remapped case).
+func (c *UserCache) GetOpaqueIDByIAMUUID(ctx context.Context, iamUUID string) (string, error) {
+	var opaqueID string
+	if err := fetch(ctx, c.pools, userOpaqueIDByIAMUUID+strings.ToLower(iamUUID), &opaqueID); err != nil {
+		return "", err
+	}
+	return opaqueID, nil
+}

group/indigoiam/rest.go

@@ -50,6 +50,7 @@ func init() {
 type manager struct {
 	conf       *config
 	cache      *cache.GroupCache
+	userCache  *cache.UserCache // read-only access, for IAM-UUID -> OpaqueId resolution
 	httpClient *http.Client
 }
 
@@ -177,6 +178,13 @@ func New(ctx context.Context, m map[string]interface{}) (group.Manager, error) {
 	mgr := &manager{
 		conf:  &c,
 		cache: cache.NewGroupCache(pools, c.GroupFetchInterval, c.GroupMembersCacheExpiration),
+		// UserGroupsCacheExpiration doesn't apply here since this UserCache
+		// instance is only ever used for GetIAMUUID/GetOpaqueIDByIAMUUID
+		// lookups, not for storing users or groups membership. The TTL
+		// arguments only affect StoreUser/StoreGroups, which this driver
+		// never calls, so any values are safe; we reuse the group driver's
+		// own fetch interval for consistency.
+		userCache: cache.NewUserCache(pools, c.GroupFetchInterval, c.GroupMembersCacheExpiration),
 		httpClient: &http.Client{
 			Transport: tr,
 			Timeout:   time.Duration(c.HTTPTimeoutSeconds) * time.Second,
@@ -332,10 +340,19 @@ func (m *manager) GetMembers(ctx context.Context, gid *grouppb.GroupId) ([]*user
 			if !acc.Active {
 				continue
 			}
+
+			opaqueID := acc.ID
+			userType := userpb.UserType_USER_TYPE_LIGHTWEIGHT
+
+			if mapped, err := m.userCache.GetOpaqueIDByIAMUUID(ctx, acc.ID); err == nil {
+				opaqueID = mapped
+				userType = userpb.UserType_USER_TYPE_PRIMARY
+			}
+
 			members = append(members, &userpb.UserId{
-				OpaqueId: acc.ID,
+				OpaqueId: opaqueID,
 				Idp:      m.conf.IDProvider,
-				Type:     userpb.UserType_USER_TYPE_PRIMARY,
+				Type:     userType,
 			})
 		}
 

user/indigoiam/rest.go

@@ -51,6 +51,12 @@ type manager struct {
 	httpClient *http.Client
 }
 
+type primaryUser struct {
+	username   string
+	uid_number int64
+	gid_number int64
+}
+
 func (manager) RevaPlugin() reva.PluginInfo {
 	return reva.PluginInfo{
 		ID:  "grpc.services.userprovider.drivers.indigo-iam",
@@ -75,6 +81,14 @@ type config struct {
 	UserFetchInterval         int `mapstructure:"user_fetch_interval"          docs:"3600"`
 	UserGroupsCacheExpiration int `mapstructure:"user_groups_cache_expiration" docs:"5"`
 	PageSize                  int `mapstructure:"page_size"                    docs:"100"`
+
+	// PrimaryUsers maps an IAM account UUID to an internal user with the given
+	// username, uid and gid, and marks that user as USER_TYPE_PRIMARY. Every other
+	// user is treated as USER_TYPE_LIGHTWEIGHT. This is needed because IAM
+	// has no native concept of primary vs. lightweight accounts: by default
+	// every account looks the same, so an explicit allowlist is required to
+	// recognize the subset of "real" organization members.
+	PrimaryUsers map[string]primaryUser `mapstructure:"primary_users" docs:"{}"`
 }
 
 func (c *config) ApplyDefaults() {
@@ -261,10 +275,17 @@ func (m *manager) fetchAllUserAccounts(ctx context.Context) error {
 			if !acc.Active {
 				continue
 			}
-			u := m.accountToProto(acc)
+			u, remapped := m.accountToProto(acc)
 			if err := m.cache.StoreUser(u); err != nil {
 				log.Error().Err(err).Str("uuid", acc.ID).Msg("indigoiam user: cache error")
 			}
+			// Only the exceptional, remapped case needs a reverse-index
+			// entry; lightweight users already have OpaqueId == IAM UUID.
+			if remapped {
+				if err := m.cache.StoreIAMUUID(u.Id.OpaqueId, acc.ID); err != nil {
+					log.Error().Err(err).Str("uuid", acc.ID).Msg("indigoiam user: failed to cache IAM UUID mapping")
+				}
+			}
 		}
 
 		nextStart := startIndex + list.ItemsPerPage
@@ -276,17 +297,36 @@ func (m *manager) fetchAllUserAccounts(ctx context.Context) error {
 	return nil
 }
 
-func (m *manager) accountToProto(acc *iamAccount) *userpb.User {
+// accountToProto converts an iamAccount to the CS3 userpb.User type.
+// If acc.ID is a key in conf.PrimaryUsers, the OpaqueId is replaced by the
+// mapped value and the user is marked PRIMARY; otherwise the user is
+// LIGHTWEIGHT and keeps its original IAM UUID as OpaqueId.
+func (m *manager) accountToProto(acc *iamAccount) (*userpb.User, bool) {
+	opaqueID := acc.ID
+	userType := userpb.UserType_USER_TYPE_LIGHTWEIGHT
+	uid := int64(0)
+	gid := int64(0)
+	remapped := false
+
+	if mapped, remapped := m.conf.PrimaryUsers[acc.ID]; remapped {
+		opaqueID = mapped.username
+		uid = int64(mapped.uid_number)
+		gid = int64(mapped.gid_number)
+		userType = userpb.UserType_USER_TYPE_PRIMARY
+	}
+
 	return &userpb.User{
 		Id: &userpb.UserId{
-			OpaqueId: acc.ID,
+			OpaqueId: opaqueID,
 			Idp:      m.conf.IDProvider,
-			Type:     userpb.UserType_USER_TYPE_PRIMARY,
+			Type:     userType,
 		},
 		Username:    acc.UserName,
 		Mail:        acc.primaryEmail(),
 		DisplayName: acc.DisplayName,
-	}
+		UidNumber:   uid,
+		GidNumber:   gid,
+	}, remapped
 }
 
 // ---------------------------------------------------------------------------
@@ -364,7 +404,15 @@ func (m *manager) GetUserGroups(ctx context.Context, uid *userpb.UserId) ([]stri
 		return cached, nil
 	}
 
-	url := fmt.Sprintf("%s/iam/account/%s/groups", m.conf.IAMBaseURL, uid.OpaqueId)
+	iamUUID, err := m.cache.GetIAMUUID(ctx, uid.OpaqueId)
+	if err != nil {
+		// No mapping found — assume the OpaqueId is already the IAM UUID
+		// (this is always true for lightweight users, since they are never
+		// remapped).
+		iamUUID = uid.OpaqueId
+	}
+
+	url := fmt.Sprintf("%s/iam/account/%s/groups", m.conf.IAMBaseURL, iamUUID)
 	var list iamGroupList
 	if err := m.iamGET(ctx, url, &list); err != nil {
 		return nil, err