Conversation
Adds an optional "Vacation Mode" toggle to the JIT Admin apply form (existing users only) and JIT Admin Templates, which schedules the existing CA policy / location-based audit alert exclusion for the same window as the JIT admin access, plus a 1 hour buffer. Reuses the existing ExecCAExclusion and ExecScheduleAuditExclusionVacation endpoints; only the JIT admin template storage needed backend changes to persist the new defaults. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…mode-2f61a8 # Conflicts: # frontend/src/pages/identity/administration/jit-admin/add.jsx
- Regenerate backend/Config/openapi.json (build/tools/build-openapi.ps1) to pick up the new JIT Admin Template vacation-mode fields; the "Validate and check for drift" check flagged it as stale. - Invoke-AddUser.Tests.ps1 predates the single-tenant guard merged in from upstream dev (commit c8d3845), which calls Get-Tenants without a stub/mock in this test file, failing every test with CommandNotFoundException. Add the missing Get-Tenants stub and mock. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
dev advanced again (Invoke-ListSignIns deprecation notice) while this branch's CI fixes were in flight, so the committed spec drifted again relative to the PR's merge preview. Re-ran build/tools/build-openapi.ps1 after merging upstream/dev. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…(AllTenants templates) Stacked on top of the base vacation-mode feature (CyberDrain#579). Adds an opt-in "exclude from all CA policies in the tenant" option, usable only when creating a new user (userAction 'create') - either directly on the JIT Admin apply form, or as a default on an AllTenants JIT Admin Template, where hand-picking specific policies isn't possible since the template isn't scoped to one tenant. This is a meaningfully broader action than the existing hand-picked CA policy exclusion (it excludes from every policy in the resolved tenant, not a chosen subset), so it's being proposed as a separate, independently rejectable follow-up rather than folded into the base PR. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stacked on #579 — this branch is built directly on top of
claude/jit-vacation-mode-2f61a8, so this diff includes #579's commits until that one merges. Please review only the additional commits on top of #579; this PR should not be merged before #579.userAction: 'create') — either directly on the JIT Admin apply form, or as a default on anAllTenantsJIT Admin Template, where hand-picking specific policies isn't possible since the template isn't scoped to one tenantFixes #580
Test plan
Alertis shown wherever this option is exposed