From 4f9e08d988170685f85c6a933d88564b62baea4d Mon Sep 17 00:00:00 2001
From: ioito <qu_xuan@icloud.com>
Date: Wed, 7 Dec 2022 11:21:26 +0800
Subject: [PATCH] fix(cloudid): huawei saml user name

---
 pkg/cloudid/models/cloudaccount.go  | 25 +++++++++++++------------
 pkg/cloudid/models/huawei_driver.go |  9 +++++----
 2 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/pkg/cloudid/models/cloudaccount.go b/pkg/cloudid/models/cloudaccount.go
index 1a4b9068e6..3bbfb97142 100644
--- a/pkg/cloudid/models/cloudaccount.go
+++ b/pkg/cloudid/models/cloudaccount.go
@@ -1874,51 +1874,52 @@ func (self *SCloudaccount) SyncCloudroles(ctx context.Context, userCred mcclient
 	return result
 }
 
-func (self *SCloudaccount) GetUserCloudgroups(userCred mcclient.TokenCredential) ([]string, error) {
-	ret := []string{}
+func (self *SCloudaccount) GetUserCloudgroups(userCred mcclient.TokenCredential) ([]string, []string, error) {
+	userNames, groupNames := []string{}, []string{}
 	q := SamluserManager.Query().Equals("owner_id", userCred.GetUserId()).Equals("cloudaccount_id", self.Id)
 	users := []SSamluser{}
 	err := db.FetchModelObjects(SamluserManager, q, &users)
 	if err != nil {
-		return nil, errors.Wrapf(err, "db.FetchModelObjects")
+		return nil, nil, errors.Wrapf(err, "db.FetchModelObjects")
 	}
 	if len(users) == 0 {
-		return nil, fmt.Errorf("no available saml user for %s %s", userCred.GetUserName(), userCred.GetUserId())
+		return nil, nil, fmt.Errorf("no available saml user for %s %s", userCred.GetUserName(), userCred.GetUserId())
 	}
 	groupIds := []string{}
 	for i := range users {
+		userNames = append(userNames, users[i].Name)
 		groupIds = append(groupIds, users[i].CloudgroupId)
 	}
 	q = CloudgroupManager.Query().In("id", groupIds)
 	groups := []SCloudgroup{}
 	err = db.FetchModelObjects(CloudgroupManager, q, &groups)
 	if err != nil {
-		return nil, errors.Wrapf(err, "db.FetchModelObjects")
+		return nil, nil, errors.Wrapf(err, "db.FetchModelObjects")
 	}
 	if len(groups) == 0 {
-		return ret, fmt.Errorf("no available cloudgroup for %s %s", userCred.GetUserName(), userCred.GetUserId())
+		return userNames, groupNames, fmt.Errorf("no available cloudgroup for %s %s", userCred.GetUserName(), userCred.GetUserId())
 	}
 	for i := range groups {
 		cache, err := CloudgroupcacheManager.Register(&groups[i], self)
 		if err != nil {
-			return []string{}, errors.Wrapf(err, "group cache Register")
+			return userNames, groupNames, errors.Wrapf(err, "group cache Register")
 		}
 		if len(cache.ExternalId) > 0 {
-			ret = append(ret, cache.Name)
+			groupNames = append(groupNames, cache.Name)
 		} else {
 			s := auth.GetAdminSession(context.TODO(), options.Options.Region)
 			_, err = cache.GetOrCreateICloudgroup(context.TODO(), s.GetToken())
 			if err != nil {
-				return []string{}, errors.Wrapf(err, "GetOrCreateICloudgroup")
+				return userNames, groupNames, errors.Wrapf(err, "GetOrCreateICloudgroup")
 			}
 			cache, err := CloudgroupcacheManager.Register(&groups[i], self)
 			if err != nil {
-				return []string{}, errors.Wrapf(err, "group cache Register")
+				return userNames, groupNames, errors.Wrapf(err, "group cache Register")
 			}
-			ret = append(ret, cache.Name)
+			groupNames = append(groupNames, cache.Name)
 		}
 	}
-	return ret, nil
+	return userNames, groupNames, nil
 }
 
 func (self *SCloudaccount) InviteAzureUser(ctx context.Context, userCred mcclient.TokenCredential, domain string) (string, error) {
diff --git a/pkg/cloudid/models/huawei_driver.go b/pkg/cloudid/models/huawei_driver.go
index a01f6f4cb1..243a2afb39 100644
--- a/pkg/cloudid/models/huawei_driver.go
+++ b/pkg/cloudid/models/huawei_driver.go
@@ -19,6 +19,7 @@ import (
 	"database/sql"
 	"fmt"
 	"net/url"
+	"strings"
 
 	"yunion.io/x/pkg/errors"
 
@@ -68,7 +69,7 @@ func (d *SHuaweiSAMLDriver) GetIdpInitiatedLoginData(ctx context.Context, userCr
 	if len(idpId) == 0 {
 		return data, httperrors.NewInputParameterError("saml auth url %s missing idp", uri)
 	}
-	groups, err := account.GetUserCloudgroups(userCred)
+	users, groups, err := account.GetUserCloudgroups(userCred)
 	if err != nil {
 		return data, httperrors.NewGeneralError(errors.Wrapf(err, "GetUserCloudgroups"))
 	}
@@ -77,7 +78,7 @@ func (d *SHuaweiSAMLDriver) GetIdpInitiatedLoginData(ctx context.Context, userCr
 	data.NameIdFormat = samlutils.NAME_ID_FORMAT_TRANSIENT
 	data.AudienceRestriction = sp.GetEntityId()
 	for k, v := range map[string][]string{
-		"User":   {userCred.GetUserName()},
+		"User":   {strings.Join(users, ",")},
 		"Groups": groups,
 	} {
 		data.Attributes = append(data.Attributes, samlutils.SSAMLResponseAttribute{
@@ -126,7 +127,7 @@ func (d *SHuaweiSAMLDriver) GetSpInitiatedLoginData(ctx context.Context, userCre
 		return data, httperrors.NewResourceNotReadyError("SAMLProvider for account %s not ready", account.Id)
 	}
 
-	groups, err := account.GetUserCloudgroups(userCred)
+	users, groups, err := account.GetUserCloudgroups(userCred)
 	if err != nil {
 		return data, httperrors.NewGeneralError(errors.Wrapf(err, "GetUserCloudgroups"))
 	}
@@ -135,7 +136,7 @@ func (d *SHuaweiSAMLDriver) GetSpInitiatedLoginData(ctx context.Context, userCre
 	data.NameIdFormat = samlutils.NAME_ID_FORMAT_TRANSIENT
 	data.AudienceRestriction = sp.GetEntityId()
 	for k, v := range map[string][]string{
-		"User":   {userCred.GetUserName()},
+		"User":   {strings.Join(users, ",")},
 		"Groups": groups,
 	} {
 		data.Attributes = append(data.Attributes, samlutils.SSAMLResponseAttribute{