DRONE_USER_FILTER for organizations and bitbucket cloud does not work?

jcucl · December 4, 2020, 3:59pm

Title says it all…

individual users, yes, works fine - organization, well I cannot figure out what would be the correct value here for a bitbucket workspace? is there a particular syntax to use? Really do not want to create a config file with all my users in them…

Thanks
John

bradrydzewski · December 4, 2020, 4:32pm

Drone makes an API request to the /2.0/teams endpoint which returns a list of teams that your user account has access to. Drone then checks to make sure that you are a member of a team that is listed in the DRONE_USER_FILTER configuration parameter. If you are member of a team in the list, you Drone account is created and you are authenticated, else you are rejected.

Here is the code where we make the API call:

github.com

drone/go-scm/blob/master/scm/driver/bitbucket/org.go#L29


	path := fmt.Sprintf("2.0/teams/%s", name)
	out := new(organization)
	res, err := s.client.do(ctx, "GET", path, nil, out)
	return convertOrganization(out), res, err
}
func (s *organizationService) FindMembership(ctx context.Context, name, username string) (*scm.Membership, *scm.Response, error) {
	return nil, nil, scm.ErrNotSupported
}
func (s *organizationService) List(ctx context.Context, opts scm.ListOptions) ([]*scm.Organization, *scm.Response, error) {
	path := fmt.Sprintf("2.0/teams?%s", encodeListRoleOptions(opts))
	out := new(organizationList)
	res, err := s.client.do(ctx, "GET", path, nil, out)
	copyPagination(out.pagination, res)
	return convertOrganizationList(out), res, err
}
func convertOrganizationList(from *organizationList) []*scm.Organization {
	to := []*scm.Organization{}
	for _, v := range from.Values {

Here is the code where we enforce team membership before allowing a user to login for the first time:

github.com

drone/drone/blob/master/plugin/admission/account.go

// Copyright 2019 Drone.IO Inc. All rights reserved.
// Use of this source code is governed by the Drone Non-Commercial License
// that can be found in the LICENSE file.

// +build !oss

package admission

import (
	"context"
	"errors"
	"strings"

	"github.com/drone/drone/core"
)

// ErrMembership is returned when attempting to create a new
// user account for a user that is not a member of an approved
// organization.
var ErrMembership = errors.New("User must be a member of an approved organization")

This file has been truncated. show original

I ran a quick test and was not able to reproduce any issues with this particular feature, but would accept pull requests if you think there is opportunity for improvement.

jcucl · December 4, 2020, 4:46pm

Thanks! Well, it looks like that endpoint is deprecated as of now:

Going to turn debug on my server and see if I can see the response. If there is still one maybe i can align it with the correct value.

Martin_Herren · September 28, 2022, 1:16pm

Still an issue today…

Shruthikini · September 29, 2022, 4:35am

Hi @Martin_Herren, welcome to Harness community

Can you elaborate the issues you are facing?

Thanks!