[MM-20061] Add System Admin filter to both LDAP and SAML (#13534)

* promote user to admin upon login

* Add SAML support for admin accounts

* update en.json

* update i18n

* Add tests as per comments

* change function name

* fix config.go

* invalidate cache so its not checking for cache when roles change

* add enable attribute and filter

app/diagnostics.go

@@ -471,6 +471,7 @@ func (a *App) trackConfig() {
 	a.SendDiagnostic(TRACK_CONFIG_LDAP, map[string]interface{}{
 		"enable":                                 *cfg.LdapSettings.Enable,
 		"enable_sync":                            *cfg.LdapSettings.EnableSync,
+		"enable_admin_filter":                    *cfg.LdapSettings.EnableAdminFilter,
 		"connection_security":                    *cfg.LdapSettings.ConnectionSecurity,
 		"skip_certificate_verification":          *cfg.LdapSettings.SkipCertificateVerification,
 		"sync_interval_minutes":                  *cfg.LdapSettings.SyncIntervalMinutes,
@@ -492,6 +493,7 @@ func (a *App) trackConfig() {
 		"isdefault_group_display_name_attribute": isDefault(*cfg.LdapSettings.GroupDisplayNameAttribute, model.LDAP_SETTINGS_DEFAULT_GROUP_DISPLAY_NAME_ATTRIBUTE),
 		"isdefault_group_id_attribute":           isDefault(*cfg.LdapSettings.GroupIdAttribute, model.LDAP_SETTINGS_DEFAULT_GROUP_ID_ATTRIBUTE),
 		"isempty_guest_filter":                   isDefault(*cfg.LdapSettings.GuestFilter, ""),
+		"isempty_admin_filter":                   isDefault(*cfg.LdapSettings.AdminFilter, ""),
 	})
 
 	a.SendDiagnostic(TRACK_CONFIG_COMPLIANCE, map[string]interface{}{
@@ -509,6 +511,7 @@ func (a *App) trackConfig() {
 		"enable":                              *cfg.SamlSettings.Enable,
 		"enable_sync_with_ldap":               *cfg.SamlSettings.EnableSyncWithLdap,
 		"enable_sync_with_ldap_include_auth":  *cfg.SamlSettings.EnableSyncWithLdapIncludeAuth,
+		"enable_admin_attribute":              *cfg.SamlSettings.EnableAdminAttribute,
 		"verify":                              *cfg.SamlSettings.Verify,
 		"encrypt":                             *cfg.SamlSettings.Encrypt,
 		"sign_request":                        *cfg.SamlSettings.SignRequest,
@@ -518,6 +521,7 @@ func (a *App) trackConfig() {
 		"isdefault_scoping_idp_name":          isDefault(*cfg.SamlSettings.ScopingIDPName, ""),
 		"isdefault_id_attribute":              isDefault(*cfg.SamlSettings.IdAttribute, model.SAML_SETTINGS_DEFAULT_ID_ATTRIBUTE),
 		"isdefault_guest_attribute":           isDefault(*cfg.SamlSettings.GuestAttribute, model.SAML_SETTINGS_DEFAULT_GUEST_ATTRIBUTE),
+		"isdefault_admin_attribute":           isDefault(*cfg.SamlSettings.AdminAttribute, model.SAML_SETTINGS_DEFAULT_ADMIN_ATTRIBUTE),
 		"isdefault_first_name_attribute":      isDefault(*cfg.SamlSettings.FirstNameAttribute, model.SAML_SETTINGS_DEFAULT_FIRST_NAME_ATTRIBUTE),
 		"isdefault_last_name_attribute":       isDefault(*cfg.SamlSettings.LastNameAttribute, model.SAML_SETTINGS_DEFAULT_LAST_NAME_ATTRIBUTE),
 		"isdefault_email_attribute":           isDefault(*cfg.SamlSettings.EmailAttribute, model.SAML_SETTINGS_DEFAULT_EMAIL_ATTRIBUTE),

app/user.go

@@ -1435,6 +1435,7 @@ func (a *App) UpdateUserRoles(userId string, newRoles string, sendWebSocketEvent
 		mlog.Error("Failed during updating user roles", mlog.Err(result.Err))
 	}
 
+	a.InvalidateCacheForUser(user.Id)
 	a.ClearSessionCacheForUser(user.Id)
 
 	if sendWebSocketEvent {
@@ -2313,6 +2314,8 @@ func (a *App) PromoteGuestToUser(user *model.User, requestorId string) *model.Ap
 		}
 	}
 
+	a.InvalidateCacheForUser(user.Id)
+	a.ClearSessionCacheForUser(user.Id)
 	return nil
 }
 
@@ -2354,6 +2357,9 @@ func (a *App) DemoteUserToGuest(user *model.User) *model.AppError {
 		}
 	}
 
+	a.InvalidateCacheForUser(user.Id)
+	a.ClearSessionCacheForUser(user.Id)
+
 	return nil
 }