From 3ebc531ae2d457bf9d86d78b86a107a5688ce891 Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Tue, 4 May 2021 12:02:16 +0200
Subject: [PATCH] web/admin/sources: fix userMatchingMode not being
 configurable

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 .../pages/sources/oauth/OAuthSourceForm.ts    | 24 ++++++++++++++++++-
 web/src/pages/sources/plex/PlexSourceForm.ts  | 24 ++++++++++++++++++-
 2 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/web/src/pages/sources/oauth/OAuthSourceForm.ts b/web/src/pages/sources/oauth/OAuthSourceForm.ts
index 6b898e4d9..8a82e378c 100644
--- a/web/src/pages/sources/oauth/OAuthSourceForm.ts
+++ b/web/src/pages/sources/oauth/OAuthSourceForm.ts
@@ -1,4 +1,4 @@
-import { OAuthSource, SourcesApi, FlowsApi, FlowDesignationEnum } from "authentik-api";
+import { OAuthSource, SourcesApi, FlowsApi, FlowDesignationEnum, OAuthSourceUserMatchingModeEnum } from "authentik-api";
 import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
@@ -119,6 +119,28 @@ export class OAuthSourceForm extends Form<OAuthSource> {
                     </label>
                 </div>
             </ak-form-element-horizontal>
+            <ak-form-element-horizontal
+                label=${t`User matching mode`}
+                ?required=${true}
+                name="userMatchingMode">
+                <select class="pf-c-form-control">
+                    <option value=${OAuthSourceUserMatchingModeEnum.Identifier} ?selected=${this.source?.userMatchingMode === OAuthSourceUserMatchingModeEnum.Identifier}>
+                        ${t`Link users on unique identifier`}
+                    </option>
+                    <option value=${OAuthSourceUserMatchingModeEnum.UsernameLink} ?selected=${this.source?.userMatchingMode === OAuthSourceUserMatchingModeEnum.UsernameLink}>
+                        ${t`Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses`}
+                    </option>
+                    <option value=${OAuthSourceUserMatchingModeEnum.UsernameDeny} ?selected=${this.source?.userMatchingMode === OAuthSourceUserMatchingModeEnum.UsernameDeny}>
+                        ${t`Use the user's email address, but deny enrollment when the email address already exists.`}
+                    </option>
+                    <option value=${OAuthSourceUserMatchingModeEnum.EmailLink} ?selected=${this.source?.userMatchingMode === OAuthSourceUserMatchingModeEnum.EmailLink}>
+                        ${t`Link to a user with identical username address. Can have security implications when a username is used with another source.`}
+                    </option>
+                    <option value=${OAuthSourceUserMatchingModeEnum.EmailDeny} ?selected=${this.source?.userMatchingMode === OAuthSourceUserMatchingModeEnum.EmailDeny}>
+                        ${t`Use the user's username, but deny enrollment when the username already exists.`}
+                    </option>
+                </select>
+            </ak-form-element-horizontal>
 
             <ak-form-group .expanded=${true}>
                 <span slot="header">
diff --git a/web/src/pages/sources/plex/PlexSourceForm.ts b/web/src/pages/sources/plex/PlexSourceForm.ts
index 10c7da501..ec49ce8e0 100644
--- a/web/src/pages/sources/plex/PlexSourceForm.ts
+++ b/web/src/pages/sources/plex/PlexSourceForm.ts
@@ -1,4 +1,4 @@
-import { PlexSource, SourcesApi, FlowsApi, FlowDesignationEnum } from "authentik-api";
+import { PlexSource, SourcesApi, FlowsApi, FlowDesignationEnum, PlexSourceUserMatchingModeEnum } from "authentik-api";
 import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
@@ -94,6 +94,28 @@ export class PlexSourceForm extends Form<PlexSource> {
                     </label>
                 </div>
             </ak-form-element-horizontal>
+            <ak-form-element-horizontal
+                label=${t`User matching mode`}
+                ?required=${true}
+                name="userMatchingMode">
+                <select class="pf-c-form-control">
+                    <option value=${PlexSourceUserMatchingModeEnum.Identifier} ?selected=${this.source?.userMatchingMode === PlexSourceUserMatchingModeEnum.Identifier}>
+                        ${t`Link users on unique identifier`}
+                    </option>
+                    <option value=${PlexSourceUserMatchingModeEnum.UsernameLink} ?selected=${this.source?.userMatchingMode === PlexSourceUserMatchingModeEnum.UsernameLink}>
+                        ${t`Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses`}
+                    </option>
+                    <option value=${PlexSourceUserMatchingModeEnum.UsernameDeny} ?selected=${this.source?.userMatchingMode === PlexSourceUserMatchingModeEnum.UsernameDeny}>
+                        ${t`Use the user's email address, but deny enrollment when the email address already exists.`}
+                    </option>
+                    <option value=${PlexSourceUserMatchingModeEnum.EmailLink} ?selected=${this.source?.userMatchingMode === PlexSourceUserMatchingModeEnum.EmailLink}>
+                        ${t`Link to a user with identical username address. Can have security implications when a username is used with another source.`}
+                    </option>
+                    <option value=${PlexSourceUserMatchingModeEnum.EmailDeny} ?selected=${this.source?.userMatchingMode === PlexSourceUserMatchingModeEnum.EmailDeny}>
+                        ${t`Use the user's username, but deny enrollment when the username already exists.`}
+                    </option>
+                </select>
+            </ak-form-element-horizontal>
 
             <ak-form-group .expanded=${true}>
                 <span slot="header">