[CX-97] add SAML as default when creating user #24
+153
−20
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
WalkthroughAdds Tableau MFA and SAML IDP selection: new account schema fields, IDP discovery/selection logic during account creation, a client API to list site IDP configurations, and model changes to carry auth settings and IDP ids. Also a minor formatting tweak to the siteRole description. Changes
Sequence DiagramsequenceDiagram
participant U as User
participant C as Connector
participant T as Tableau API Client
participant S as Tableau Site
U->>C: Create account (email, siteRole, withMFA?, idpConfigurationName?)
C->>C: read withMFA & idpConfigurationName
alt withMFA == true
C->>C: set authSetting = "TableauIDWithMFA"
else withMFA == false
C->>T: ListIdpConfigurations(ctx)
T->>S: GET /sites/{siteId}/site-auth-configurations
S-->>T: return configurations
T-->>C: IdpConfiguration list
alt single enabled SAML IDP
C->>C: choose that IdP id
else idpConfigurationName provided
C->>C: find matching IdP by name
else multiple IDPs & no name
C-->>U: error (specify idpConfigurationName)
end
end
C->>T: AddUserToSite(user{email, siteRole, authSetting?, idpConfigurationId?})
T->>S: POST /sites/{siteId}/users
S-->>T: user created
T-->>C: success
C-->>U: account created / error
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@pkg/connector/user.go`:
- Around line 224-233: The function buildMultipleIDPError builds a dynamic error
message into builder and then calls fmt.Errorf(builder.String()), which is
unsafe for non-constant format strings; replace the final
fmt.Errorf(builder.String()) with errors.New(builder.String()) (or
fmt.Errorf("%s", builder.String())) and add the "errors" import to the file so
the function returns a plain error created from the constructed string;
reference buildMultipleIDPError and the final return statement to locate and
update the code.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@pkg/connector/user.go`:
- Around line 178-195: The code currently returns the sole
enabledSAMLConfigs[0].IdpConfigurationId without honoring idpConfigName; change
the logic in the selection block so that when len(enabledSAMLConfigs) == 1 you
still check idpConfigName: if idpConfigName is empty, return
enabledSAMLConfigs[0].IdpConfigurationId, otherwise call
findIDPByName(enabledSAMLConfigs, idpConfigName) and return an InvalidArgument
error (use uhttp.WrapErrors with buildMultipleIDPError) if the name doesn't
match, otherwise return the matched selectedConfig.IdpConfigurationId; this
preserves current behavior for empty names but surfaces typos/misconfigurations
when a name is provided.
Comment on lines
+178
to
+195
| if len(enabledSAMLConfigs) == 0 { | ||
| return "", fmt.Errorf("baton-tableau: you need to pass the MFA flag since no IDP is configured in Tableau") | ||
| } | ||
|
|
||
| if len(enabledSAMLConfigs) == 1 { | ||
| return enabledSAMLConfigs[0].IdpConfigurationId, nil | ||
| } | ||
|
|
||
| if idpConfigName == "" { | ||
| return "", uhttp.WrapErrors(codes.InvalidArgument, "multiple SAML IDPs available", buildMultipleIDPError(enabledSAMLConfigs)) | ||
| } | ||
|
|
||
| selectedConfig, err := findIDPByName(enabledSAMLConfigs, idpConfigName) | ||
| if err != nil { | ||
| return "", uhttp.WrapErrors(codes.InvalidArgument, fmt.Sprintf("IDP configuration '%s' not found", idpConfigName), buildMultipleIDPError(enabledSAMLConfigs)) | ||
| } | ||
|
|
||
| return selectedConfig.IdpConfigurationId, nil |
There was a problem hiding this comment.
Honor explicit idpConfigurationName even when only one config exists.
If a caller provides idpConfigurationName but there’s only one enabled SAML config, the current logic ignores the name and silently selects the only config. That can mask typos or misconfigurations.
🔧 Suggested adjustment
- if len(enabledSAMLConfigs) == 1 {
- return enabledSAMLConfigs[0].IdpConfigurationId, nil
- }
-
- if idpConfigName == "" {
- return "", uhttp.WrapErrors(codes.InvalidArgument, "multiple SAML IDPs available", buildMultipleIDPError(enabledSAMLConfigs))
- }
-
- selectedConfig, err := findIDPByName(enabledSAMLConfigs, idpConfigName)
- if err != nil {
- return "", uhttp.WrapErrors(codes.InvalidArgument, fmt.Sprintf("IDP configuration '%s' not found", idpConfigName), buildMultipleIDPError(enabledSAMLConfigs))
- }
-
- return selectedConfig.IdpConfigurationId, nil
+ if idpConfigName != "" {
+ selectedConfig, err := findIDPByName(enabledSAMLConfigs, idpConfigName)
+ if err != nil {
+ return "", uhttp.WrapErrors(codes.InvalidArgument, fmt.Sprintf("IDP configuration '%s' not found", idpConfigName), buildMultipleIDPError(enabledSAMLConfigs))
+ }
+ return selectedConfig.IdpConfigurationId, nil
+ }
+
+ if len(enabledSAMLConfigs) == 1 {
+ return enabledSAMLConfigs[0].IdpConfigurationId, nil
+ }
+
+ return "", uhttp.WrapErrors(codes.InvalidArgument, "multiple SAML IDPs available", buildMultipleIDPError(enabledSAMLConfigs))🤖 Prompt for AI Agents
In `@pkg/connector/user.go` around lines 178 - 195, The code currently returns the
sole enabledSAMLConfigs[0].IdpConfigurationId without honoring idpConfigName;
change the logic in the selection block so that when len(enabledSAMLConfigs) ==
1 you still check idpConfigName: if idpConfigName is empty, return
enabledSAMLConfigs[0].IdpConfigurationId, otherwise call
findIDPByName(enabledSAMLConfigs, idpConfigName) and return an InvalidArgument
error (use uhttp.WrapErrors with buildMultipleIDPError) if the name doesn't
match, otherwise return the matched selectedConfig.IdpConfigurationId; this
preserves current behavior for empty names but surfaces typos/misconfigurations
when a name is provided.
btipling
approved these changes
Jan 26, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Style
✏️ Tip: You can customize this high-level summary in your review settings.