From 3b58e887ed3dffefada98ff36d5acdf6503efbd2 Mon Sep 17 00:00:00 2001
From: Samir Patel <48686912+54mir@users.noreply.github.com>
Date: Fri, 17 Dec 2021 11:34:48 -0600
Subject: [PATCH] add group lenth check

---
 authn/authenticate.go | 11 +++++++----
 http/handler.go       |  4 ++--
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/authn/authenticate.go b/authn/authenticate.go
index 13b25de8a..89c599894 100644
--- a/authn/authenticate.go
+++ b/authn/authenticate.go
@@ -90,11 +90,11 @@ type UserInfo struct {
 	UserName string `json:"username"`
 }
 
-func (a *Auth) Authenticate(w http.ResponseWriter, r *http.Request) []Group {
+func (a *Auth) Authenticate(w http.ResponseWriter, r *http.Request) ([]Group, error) {
 	cookie, err := a.readCookie(r)
 	if err != nil {
 		http.Redirect(w, r, "/signin", http.StatusTemporaryRedirect)
-		return nil
+		return nil, err
 	}
 	if cookie.Token.Expiry.Before(time.Now().Add(a.refreshWithin)) {
 		err = a.refreshToken(w, cookie)
@@ -102,11 +102,14 @@ func (a *Auth) Authenticate(w http.ResponseWriter, r *http.Request) []Group {
 			//log error
 			if cookie.Token.Expiry.Before(time.Now()) {
 				http.Redirect(w, r, "/signin", http.StatusTemporaryRedirect)
-				return nil
+				return nil, err
 			}
 		}
 	}
-	return cookie.GroupMembership
+	if len(cookie.GroupMembership) == 0 {
+		return nil, errors.New("user is not part of any groups in identity provider")
+	}
+	return cookie.GroupMembership, nil
 
 }
 
diff --git a/http/handler.go b/http/handler.go
index 2f84ee363..0852242aa 100644
--- a/http/handler.go
+++ b/http/handler.go
@@ -3395,8 +3395,8 @@ func (h *Handler) handleCheckAuthentication(w http.ResponseWriter, r *http.Reque
 		http.Error(w, "Trying to authenticate but authentication is off.", http.StatusBadRequest)
 		return
 	}
-	groups := h.auth.Authenticate(w, r)
-	if groups == nil {
+	groups, err := h.auth.Authenticate(w, r)
+	if groups == nil || err != nil {
 		w.Header().Add("Content-Type", "text/plain")
 		w.WriteHeader(http.StatusForbidden)
 		return