DefGuard · t-aleksander · Mar 3, 2025 · Feb 27, 2025 · Feb 28, 2025 · Feb 28, 2025
diff --git a/...30776bab957e26654cc62ca2a9874df6c942.json → ...0b2a4cbedb33babd5b9fc908ec17d3f882e2.json b/...30776bab957e26654cc62ca2a9874df6c942.json → ...0b2a4cbedb33babd5b9fc908ec17d3f882e2.json
diff --git a/...8ed6ad81d5a2f00e7307d8d338bc2269ba91.json → ...508dbd1407c8963b3fb240ad24b84fdf5fab.json b/...8ed6ad81d5a2f00e7307d8d338bc2269ba91.json → ...508dbd1407c8963b3fb240ad24b84fdf5fab.json
diff --git a/...cbecaa2fe8897d73fba2c8301410853712e7.json → ...6ceb4e139f131e33a032dd4b719a937de935.json b/...cbecaa2fe8897d73fba2c8301410853712e7.json → ...6ceb4e139f131e33a032dd4b719a937de935.json
diff --git a/...49921e469e97b86196b5608b3c79e4c7a7df.json → ...f6464ef320242782b486f7e17c7742eec1f0.json b/...49921e469e97b86196b5608b3c79e4c7a7df.json → ...f6464ef320242782b486f7e17c7742eec1f0.json
diff --git a/...4aa2ffde87118e17ed90f0ed72622eae6c99.json → ...a956656c9ef58f46ede7bc8225900ade4579.json b/...4aa2ffde87118e17ed90f0ed72622eae6c99.json → ...a956656c9ef58f46ede7bc8225900ade4579.json
diff --git a/...fad03c0cac68d8b597b55a2fb0ccc4d2cb15.json → ...0fc67194a7de7cf7241d938b25f068525411.json b/...fad03c0cac68d8b597b55a2fb0ccc4d2cb15.json → ...0fc67194a7de7cf7241d938b25f068525411.json
diff --git a/...e0f68aa815e09d48e2cd79985d62bd02711a.json → ...9a3c89e0725d2d2d7a1aa6739f1870a4fd05.json b/...e0f68aa815e09d48e2cd79985d62bd02711a.json → ...9a3c89e0725d2d2d7a1aa6739f1870a4fd05.json
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "defguard"
-version = "1.2.4"
+version = "1.2.5"
 edition = "2021"
 license-file = "LICENSE.md"
 homepage = "https://defguard.net/"

diff --git a/migrations/20250228101233_directory_sync_group_match.down.sql b/migrations/20250228101233_directory_sync_group_match.down.sql
@@ -0,0 +1 @@
+ALTER TABLE openidprovider DROP COLUMN directory_sync_group_match;
diff --git a/migrations/20250228101233_directory_sync_group_match.up.sql b/migrations/20250228101233_directory_sync_group_match.up.sql
@@ -0,0 +1 @@
+ALTER TABLE openidprovider ADD COLUMN directory_sync_group_match TEXT[] DEFAULT '{}' NOT NULL;
diff --git a/src/enterprise/db/models/openid_provider.rs b/src/enterprise/db/models/openid_provider.rs
@@ -110,6 +110,9 @@ pub struct OpenIdProvider<I = NoId> {
     pub okta_private_jwk: Option<String>,
     // The client ID of the directory sync app specifically
     pub okta_dirsync_client_id: Option<String>,
+    #[model(ref)]
+    // The groups to sync from the directory, exact match
+    pub directory_sync_group_match: Vec<String>,
 }
 
 impl OpenIdProvider {
@@ -130,6 +133,7 @@ impl OpenIdProvider {
         directory_sync_target: DirectorySyncTarget,
         okta_private_jwk: Option<String>,
         okta_dirsync_client_id: Option<String>,
+        directory_sync_group_match: Vec<String>,
     ) -> Self {
         Self {
             id: NoId,
@@ -148,6 +152,7 @@ impl OpenIdProvider {
             directory_sync_target,
             okta_private_jwk,
             okta_dirsync_client_id,
+            directory_sync_group_match,
         }
     }
 
@@ -159,8 +164,8 @@ impl OpenIdProvider {
                 display_name = $5, google_service_account_key = $6, google_service_account_email = $7, admin_email = $8, \
                 directory_sync_enabled = $9, directory_sync_interval = $10, directory_sync_user_behavior = $11, \
                 directory_sync_admin_behavior = $12, directory_sync_target = $13, \
-                okta_private_jwk = $14, okta_dirsync_client_id = $15 \
-                WHERE id = $16",
+                okta_private_jwk = $14, okta_dirsync_client_id = $15, directory_sync_group_match = $16 \
+                WHERE id = $17",
                 self.name,
                 self.base_url,
                 self.client_id,
@@ -176,6 +181,7 @@ impl OpenIdProvider {
                 self.directory_sync_target as DirectorySyncTarget,
                 self.okta_private_jwk,
                 self.okta_dirsync_client_id,
+                &self.directory_sync_group_match,
                 provider.id,
             )
             .execute(pool)
@@ -197,7 +203,7 @@ impl OpenIdProvider<Id> {
             directory_sync_interval, directory_sync_user_behavior  \"directory_sync_user_behavior: DirectorySyncUserBehavior\", \
             directory_sync_admin_behavior  \"directory_sync_admin_behavior: DirectorySyncUserBehavior\", \
             directory_sync_target  \"directory_sync_target: DirectorySyncTarget\", \
-            okta_private_jwk, okta_dirsync_client_id \
+            okta_private_jwk, okta_dirsync_client_id, directory_sync_group_match \
             FROM openidprovider WHERE name = $1",
             name
         )
@@ -213,7 +219,7 @@ impl OpenIdProvider<Id> {
             directory_sync_interval, directory_sync_user_behavior \"directory_sync_user_behavior: DirectorySyncUserBehavior\", \
             directory_sync_admin_behavior  \"directory_sync_admin_behavior: DirectorySyncUserBehavior\", \
             directory_sync_target  \"directory_sync_target: DirectorySyncTarget\", \
-            okta_private_jwk, okta_dirsync_client_id \
+            okta_private_jwk, okta_dirsync_client_id, directory_sync_group_match \
             FROM openidprovider LIMIT 1"
         )
         .fetch_optional(pool)
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		ALTER TABLE openidprovider DROP COLUMN directory_sync_group_match;
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		ALTER TABLE openidprovider ADD COLUMN directory_sync_group_match TEXT[] DEFAULT '{}' NOT NULL;