46 lines
2.8 KiB
Go
46 lines
2.8 KiB
Go
package model
|
|
|
|
// Reference: M13 §3 — SAML Identity Provider per-account configuration
|
|
// Enables multi-tenant identity isolation: each account (tenant) can configure
|
|
// its own SAML IdP, allowing enterprise customers to bring their own IdP
|
|
// (Okta, Azure AD, OneLogin, etc.) while maintaining complete identity isolation
|
|
// between tenants.
|
|
// This mirrors Chatwoot's account-scoped SAML configuration pattern.
|
|
|
|
import (
|
|
"time"
|
|
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
// SAMLIdPConfig stores per-account SAML IdP configuration for multi-tenant identity isolation.
|
|
// Each account can have exactly one active SAML IdP configuration.
|
|
type SAMLIdPConfig struct {
|
|
ID uint `gorm:"primaryKey" json:"id"`
|
|
AccountID uint `gorm:"not null;uniqueIndex" json:"account_id"` // one active config per account
|
|
IdPEntityID string `gorm:"size:512;not null" json:"idp_entity_id"` // IdP entity ID (e.g. https://idp.example.com/metadata)
|
|
IdPMetadataURL string `gorm:"size:1024" json:"idp_metadata_url,omitempty"` // URL to fetch IdP metadata XML
|
|
IdPMetadataXML string `gorm:"type:text" json:"idp_metadata_xml,omitempty"` // raw IdP metadata XML (fallback if URL unavailable)
|
|
SPEntityID string `gorm:"size:512;not null" json:"sp_entity_id"` // SP entity ID for this account (overrides global default)
|
|
ACSURL string `gorm:"size:1024;not null" json:"acs_url"` // ACS URL for this account (overrides global default)
|
|
AttributeMapping string `gorm:"type:text" json:"attribute_mapping,omitempty"` // JSON: {"uid":"nameid","email":"email","firstName":"givenName","lastName":"surname"}
|
|
ClockDriftTolerance int `gorm:"default:300" json:"clock_drift_tolerance"` // seconds of allowed clock skew
|
|
Active bool `gorm:"not null;default:true" json:"active"` // whether this config is active
|
|
CreatedBy uint `gorm:"not null" json:"created_by"` // admin user who created this config
|
|
CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
|
|
UpdatedAt time.Time `gorm:"autoUpdateTime" json:"updated_at"`
|
|
DeletedAt gorm.DeletedAt `gorm:"index" json:"deleted_at,omitempty"`
|
|
|
|
// Relations
|
|
Account Account `gorm:"foreignKey:AccountID" json:"account,omitempty"`
|
|
}
|
|
|
|
func (SAMLIdPConfig) TableName() string { return "saml_idp_configs" }
|
|
|
|
// SAMLAttributeMapping defines how SAML assertion attributes map to gochat user fields.
|
|
type SAMLAttributeMapping struct {
|
|
UID string `json:"uid"` // maps to user identifier (default: NameID)
|
|
Email string `json:"email"` // maps to user email
|
|
FirstName string `json:"firstName"` // maps to user first_name
|
|
LastName string `json:"lastName"` // maps to user last_name
|
|
} |