Only org policy #962

addisonbeck · 2020-10-08T16:55:15Z

Narrative ✍🏻

As an enterprise organization admin I want to be able to block members of my organization from being able to be a part of other organizations.

Acceptance Criteria Relevant To This PR 💯

A policy (OnlyOrg) exists that restricts non-admin members from being able to be a part of other organizations.
When applying the OnlyOrg policy any non-owner members who aren't the one enabling the policy & that are already in another org should be removed from the org applying the policy. This user flow should mirror what already exists for the 2FA policy.
Removed users should get an email informing them of the removal.
The OnlyOrg policy needs to be configurable from the web vault AND the enterprise portal.
Users in an org with the OnlyOrg policy enabled should not be able to create new organizations.

Code Changes 👨🏻‍💻

API

Added a new PolicyType enum
Blocked accepting new organization invites when OnlyOrg is relevant to the user
Blocked creating new orgs if already in an org with OnlyOrg enabled (this is also checked on the client)
Blocked confirming any org members that may have violated OnlyOrg between accepting their invite and being confirmed
Created an email alert to be sent when a user is kicked because of the OnlyOrg policy
Removed users and sent alerts when appropriate (this involved a slight refactor of the same logic for 2FA)

Portal

Added any needed localization strings for policy config in the portal
Allowed for the OnlyOrg policy to be configured on the policies screen

Screenshots

Notes 📝

Asana ticket
Web PR
jslib PR

…serOrg

…licy since accepting

kspearrin · 2020-10-09T11:46:57Z

bitwarden_license/src/Portal/Models/PolicyEditModel.cs

+                case PolicyType.OnlyOrg:
+                    break;


Why doesn't the 2FA policy enter this same code block? I would think the onlyorg and 2fa policies would be set up the same

The 2FA policy wasn't represented in this switch at all, which was causing a bug: enabling the 2FA policy from the portal simply didn't work.

I noticed this, but it didn't seem in scope of this PR so I was planning to fast-follow and fix it later, like with deleting orgUser records with an org, but since you brought it up I went ahead and fixed it here 😁

src/Api/Controllers/OrganizationsController.cs

src/Core/MailTemplates/Handlebars/OrganizationUserRemovedForPolicyOnlyOrg.html.hbs

src/Core/Services/Implementations/OrganizationService.cs

src/Core/Services/Implementations/PolicyService.cs

kspearrin · 2020-10-09T12:04:46Z

src/Core/Services/Implementations/PolicyService.cs

+                                    if (orgUser.UserId.HasValue)
+                                    {
+                                        var userOrgs = await _organizationUserRepository.GetManyByUserAsync(orgUser.UserId.Value);
+                                        if (userOrgs.Count > 1)


same. i think you need to check status

src/Core/Services/Implementations/PolicyService.cs

bitwarden_license/src/Portal/Models/PolicyEditModel.cs

src/Api/Controllers/OrganizationsController.cs

src/Core/Enums/PolicyType.cs

src/Core/Services/Implementations/OrganizationService.cs

src/Core/Services/Implementations/PolicyService.cs

addisonbeck · 2020-10-13T19:31:16Z

@cscharf @kspearrin this one got a little muddy with the string changes (I'll try and run those by you guys before PR next time), but I think the only issue left open is this one regarding optimizing removal of users on policy enable. Let me know if you'd like me to make the change I suggested on that thread, or any others.

src/Core/Services/Implementations/OrganizationService.cs

… into OnlyOrgPolicy

src/Sql/dbo/Stored Procedures/OrganizationUser_ReadByUserIds.sql

util/Migrator/DbScripts/2020-10-14_00_OrgUserReadByUserIds.sql

cscharf

Will still need @kspearrin to review from his requested changes and approval before this can be merged.

kspearrin · 2020-10-19T15:54:40Z

src/Core/Services/Implementations/OrganizationService.cs

-                throw new BadRequestException("You are already part of this organization.");
-            }
-
-            if (!CoreHelpers.UserInviteTokenIsValid(_dataProtector, token, user.Email, orgUser.Id, _globalSettings))


Where did this token validation go?

Was this comment looking at a specific commit? This logic was moved around in this PR, it's reflected in some commits here because of merge issues.

src/Core/Services/Implementations/PolicyService.cs

addisonbeck added 10 commits October 6, 2020 13:32

added OnlyOrg to PolicyType enum

0720f5e

blocked accepting new org invitations if OnlyOrg is relevant to the u…

118b997

…serOrg

blocked creating new orgs if already in an org with OnlyOrg enabled

33c8af8

created email alert for OnlyOrg policy

e476ebd

removed users & sent alerts when appropriate for the OnlyOrg policy

cb16690

added method to noop mail service

b8faa4e

cleanup for OnlyOrg policy server logic

28c2051

blocked confirming new org users if they have violated the OnlyOrg po…

839b1bb

…licy since accepting

added localization strings needed for the OnlyOrg policy

e5e5e8a

allowed OnlyOrg policy configuration from the portal

df7f2d2

addisonbeck requested a review from a team October 8, 2020 16:55

This was referenced Oct 8, 2020

OnlyOrg Policy bitwarden/web#669

Merged

added OnlyOrg to PolicyType enum bitwarden/jslib#183

Merged

used correct localization key for onlyorg

3374c23

addisonbeck mentioned this pull request Oct 8, 2020

Delete OrgUsers When Deleting An Org #964

Merged

kspearrin requested changes Oct 9, 2020

View reviewed changes

addisonbeck added 3 commits October 10, 2020 14:25

formatting and messaging changes for OnlyOrg

3d709fd

formatting

eabd06e

messaging change

de295de

cscharf reviewed Oct 12, 2020

View reviewed changes

code review changes for onlyorg

c5bcf17

cscharf reviewed Oct 14, 2020

View reviewed changes

src/Core/Services/Implementations/OrganizationService.cs Outdated Show resolved Hide resolved

slimmed down a conditional

ac97c52

addisonbeck force-pushed the OnlyOrgPolicy branch from b1f932f to ac97c52 Compare October 14, 2020 18:39

Addison Beck and others added 4 commits October 14, 2020 14:41

Merge branch 'master' into OnlyOrgPolicy

e6b2c9f

optimized getting many orgUser records from many userIds

eafebd8

Merge branch 'OnlyOrgPolicy' of https://www.github.com/bitwarden/server…

f56a3fd

… into OnlyOrgPolicy

removed a test file

30b5b56

addisonbeck requested a review from cscharf October 14, 2020 22:25

addisonbeck requested a review from kspearrin October 14, 2020 22:25

cscharf reviewed Oct 15, 2020

View reviewed changes

addisonbeck added 3 commits October 15, 2020 10:45

sql formatting

354d059

weirdness

1965d49

trying to resolve git diff formatting issues

50bb35c

addisonbeck requested a review from cscharf October 15, 2020 14:49

cscharf approved these changes Oct 15, 2020

View reviewed changes

kspearrin reviewed Oct 19, 2020

View reviewed changes

addisonbeck requested a review from kspearrin October 19, 2020 17:00

kspearrin approved these changes Oct 19, 2020

View reviewed changes

addisonbeck merged commit e872b4d into master Oct 20, 2020

addisonbeck deleted the OnlyOrgPolicy branch October 20, 2020 06:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Only org policy #962

Only org policy #962

addisonbeck commented Oct 8, 2020 •

edited by vincentsalucci

Loading

kspearrin Oct 9, 2020

addisonbeck Oct 10, 2020

kspearrin Oct 9, 2020

addisonbeck Oct 10, 2020

addisonbeck commented Oct 13, 2020

cscharf left a comment

kspearrin Oct 19, 2020

addisonbeck Oct 19, 2020 •

edited

Loading

Only org policy #962

Only org policy #962

Conversation

addisonbeck commented Oct 8, 2020 • edited by vincentsalucci Loading

Narrative ✍🏻

Acceptance Criteria Relevant To This PR 💯

Code Changes 👨🏻‍💻

API

Portal

Screenshots

Notes 📝

kspearrin Oct 9, 2020

Choose a reason for hiding this comment

addisonbeck Oct 10, 2020

Choose a reason for hiding this comment

kspearrin Oct 9, 2020

Choose a reason for hiding this comment

addisonbeck Oct 10, 2020

Choose a reason for hiding this comment

addisonbeck commented Oct 13, 2020

cscharf left a comment

Choose a reason for hiding this comment

kspearrin Oct 19, 2020

Choose a reason for hiding this comment

addisonbeck Oct 19, 2020 • edited Loading

Choose a reason for hiding this comment

addisonbeck commented Oct 8, 2020 •

edited by vincentsalucci

Loading

addisonbeck Oct 19, 2020 •

edited

Loading