feat: add UserIdentity entity and CRUD operations (#4643)

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
Signed-off-by: Maksim Nabokikh <max.nabokih@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

pkg/featureflags/set.go

@@ -21,4 +21,7 @@ var (
 	// ClientCredentialGrantEnabledByDefault enables the client_credentials grant type by default
 	// without requiring explicit configuration in oauth2.grantTypes.
 	ClientCredentialGrantEnabledByDefault = newFlag("client_credential_grant_enabled_by_default", false)
+
+	// SessionsEnabled enables experimental auth sessions support.
+	SessionsEnabled = newFlag("sessions_enabled", false)
 )

storage/conformance/conformance.go

@@ -51,6 +51,7 @@ func RunTests(t *testing.T, newStorage func(t *testing.T) storage.Storage) {
 		{"TimezoneSupport", testTimezones},
 		{"DeviceRequestCRUD", testDeviceRequestCRUD},
 		{"DeviceTokenCRUD", testDeviceTokenCRUD},
+		{"UserIdentityCRUD", testUserIdentityCRUD},
 	})
 }
 
@@ -1084,3 +1085,84 @@ func testDeviceTokenCRUD(t *testing.T, s storage.Storage) {
 		t.Fatalf("storage does not support PKCE, wanted challenge=%#v got %#v", codeChallenge, got.PKCE)
 	}
 }
+
+func testUserIdentityCRUD(t *testing.T, s storage.Storage) {
+	ctx := t.Context()
+
+	now := time.Now().UTC().Round(time.Millisecond)
+
+	u1 := storage.UserIdentity{
+		UserID:      "user1",
+		ConnectorID: "conn1",
+		Claims: storage.Claims{
+			UserID:        "user1",
+			Username:      "jane",
+			Email:         "jane@example.com",
+			EmailVerified: true,
+			Groups:        []string{"a", "b"},
+		},
+		Consents:     make(map[string][]string),
+		CreatedAt:    now,
+		LastLogin:    now,
+		BlockedUntil: time.Unix(0, 0).UTC(),
+	}
+
+	// Create with empty Consents map.
+	if err := s.CreateUserIdentity(ctx, u1); err != nil {
+		t.Fatalf("create user identity: %v", err)
+	}
+
+	// Duplicate create should return ErrAlreadyExists.
+	err := s.CreateUserIdentity(ctx, u1)
+	mustBeErrAlreadyExists(t, "user identity", err)
+
+	// Get and compare.
+	got, err := s.GetUserIdentity(ctx, u1.UserID, u1.ConnectorID)
+	if err != nil {
+		t.Fatalf("get user identity: %v", err)
+	}
+
+	got.CreatedAt = got.CreatedAt.UTC().Round(time.Millisecond)
+	got.LastLogin = got.LastLogin.UTC().Round(time.Millisecond)
+	got.BlockedUntil = got.BlockedUntil.UTC().Round(time.Millisecond)
+	u1.BlockedUntil = u1.BlockedUntil.UTC().Round(time.Millisecond)
+	if diff := pretty.Compare(u1, got); diff != "" {
+		t.Errorf("user identity retrieved from storage did not match: %s", diff)
+	}
+
+	// Update: add consent entry.
+	if err := s.UpdateUserIdentity(ctx, u1.UserID, u1.ConnectorID, func(old storage.UserIdentity) (storage.UserIdentity, error) {
+		old.Consents["client1"] = []string{"openid", "email"}
+		return old, nil
+	}); err != nil {
+		t.Fatalf("update user identity: %v", err)
+	}
+
+	// Get and verify updated consents.
+	got, err = s.GetUserIdentity(ctx, u1.UserID, u1.ConnectorID)
+	if err != nil {
+		t.Fatalf("get user identity after update: %v", err)
+	}
+	wantConsents := map[string][]string{"client1": {"openid", "email"}}
+	if diff := pretty.Compare(wantConsents, got.Consents); diff != "" {
+		t.Errorf("user identity consents did not match after update: %s", diff)
+	}
+
+	// List and verify.
+	identities, err := s.ListUserIdentities(ctx)
+	if err != nil {
+		t.Fatalf("list user identities: %v", err)
+	}
+	if len(identities) != 1 {
+		t.Fatalf("expected 1 user identity, got %d", len(identities))
+	}
+
+	// Delete.
+	if err := s.DeleteUserIdentity(ctx, u1.UserID, u1.ConnectorID); err != nil {
+		t.Fatalf("delete user identity: %v", err)
+	}
+
+	// Get deleted should return ErrNotFound.
+	_, err = s.GetUserIdentity(ctx, u1.UserID, u1.ConnectorID)
+	mustBeErrNotFound(t, "user identity", err)
+}

storage/ent/client/offlinesession.go

@@ -15,7 +15,7 @@ func (d *Database) CreateOfflineSessions(ctx context.Context, session storage.Of
 		return fmt.Errorf("encode refresh offline session: %w", err)
 	}
 
-	id := offlineSessionID(session.UserID, session.ConnID, d.hasher)
+	id := compositeKeyID(session.UserID, session.ConnID, d.hasher)
 	_, err = d.client.OfflineSession.Create().
 		SetID(id).
 		SetUserID(session.UserID).
@@ -31,7 +31,7 @@ func (d *Database) CreateOfflineSessions(ctx context.Context, session storage.Of
 
 // GetOfflineSessions extracts an offline session from the database by user id and connector id.
 func (d *Database) GetOfflineSessions(ctx context.Context, userID, connID string) (storage.OfflineSessions, error) {
-	id := offlineSessionID(userID, connID, d.hasher)
+	id := compositeKeyID(userID, connID, d.hasher)
 
 	offlineSession, err := d.client.OfflineSession.Get(ctx, id)
 	if err != nil {
@@ -42,7 +42,7 @@ func (d *Database) GetOfflineSessions(ctx context.Context, userID, connID string
 
 // DeleteOfflineSessions deletes an offline session from the database by user id and connector id.
 func (d *Database) DeleteOfflineSessions(ctx context.Context, userID, connID string) error {
-	id := offlineSessionID(userID, connID, d.hasher)
+	id := compositeKeyID(userID, connID, d.hasher)
 
 	err := d.client.OfflineSession.DeleteOneID(id).Exec(ctx)
 	if err != nil {
@@ -53,7 +53,7 @@ func (d *Database) DeleteOfflineSessions(ctx context.Context, userID, connID str
 
 // UpdateOfflineSessions changes an offline session by user id and connector id using an updater function.
 func (d *Database) UpdateOfflineSessions(ctx context.Context, userID string, connID string, updater func(s storage.OfflineSessions) (storage.OfflineSessions, error)) error {
-	id := offlineSessionID(userID, connID, d.hasher)
+	id := compositeKeyID(userID, connID, d.hasher)
 
 	tx, err := d.BeginTx(ctx)
 	if err != nil {

storage/ent/client/types.go

@@ -163,6 +163,39 @@ func toStorageDeviceRequest(r *db.DeviceRequest) storage.DeviceRequest {
 	}
 }
 
+func toStorageUserIdentity(u *db.UserIdentity) storage.UserIdentity {
+	s := storage.UserIdentity{
+		UserID:      u.UserID,
+		ConnectorID: u.ConnectorID,
+		Claims: storage.Claims{
+			UserID:            u.ClaimsUserID,
+			Username:          u.ClaimsUsername,
+			PreferredUsername: u.ClaimsPreferredUsername,
+			Email:             u.ClaimsEmail,
+			EmailVerified:     u.ClaimsEmailVerified,
+			Groups:            u.ClaimsGroups,
+		},
+		CreatedAt:    u.CreatedAt,
+		LastLogin:    u.LastLogin,
+		BlockedUntil: u.BlockedUntil,
+	}
+
+	if u.Consents != nil {
+		if err := json.Unmarshal(u.Consents, &s.Consents); err != nil {
+			// Correctness of json structure is guaranteed on uploading
+			panic(err)
+		}
+		if s.Consents == nil {
+			// Ensure Consents is non-nil even if JSON was "null".
+			s.Consents = make(map[string][]string)
+		}
+	} else {
+		// Server code assumes this will be non-nil.
+		s.Consents = make(map[string][]string)
+	}
+	return s
+}
+
 func toStorageDeviceToken(t *db.DeviceToken) storage.DeviceToken {
 	return storage.DeviceToken{
 		DeviceCode:          t.DeviceCode,

storage/ent/client/useridentity.go

@@ -0,0 +1,130 @@
+package client
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/dexidp/dex/storage"
+)
+
+// CreateUserIdentity saves provided user identity into the database.
+func (d *Database) CreateUserIdentity(ctx context.Context, identity storage.UserIdentity) error {
+	if identity.Consents == nil {
+		identity.Consents = make(map[string][]string)
+	}
+	encodedConsents, err := json.Marshal(identity.Consents)
+	if err != nil {
+		return fmt.Errorf("encode consents user identity: %w", err)
+	}
+
+	id := compositeKeyID(identity.UserID, identity.ConnectorID, d.hasher)
+	_, err = d.client.UserIdentity.Create().
+		SetID(id).
+		SetUserID(identity.UserID).
+		SetConnectorID(identity.ConnectorID).
+		SetClaimsUserID(identity.Claims.UserID).
+		SetClaimsUsername(identity.Claims.Username).
+		SetClaimsPreferredUsername(identity.Claims.PreferredUsername).
+		SetClaimsEmail(identity.Claims.Email).
+		SetClaimsEmailVerified(identity.Claims.EmailVerified).
+		SetClaimsGroups(identity.Claims.Groups).
+		SetConsents(encodedConsents).
+		SetCreatedAt(identity.CreatedAt).
+		SetLastLogin(identity.LastLogin).
+		SetBlockedUntil(identity.BlockedUntil).
+		Save(ctx)
+	if err != nil {
+		return convertDBError("create user identity: %w", err)
+	}
+	return nil
+}
+
+// GetUserIdentity extracts a user identity from the database by user id and connector id.
+func (d *Database) GetUserIdentity(ctx context.Context, userID, connectorID string) (storage.UserIdentity, error) {
+	id := compositeKeyID(userID, connectorID, d.hasher)
+
+	userIdentity, err := d.client.UserIdentity.Get(ctx, id)
+	if err != nil {
+		return storage.UserIdentity{}, convertDBError("get user identity: %w", err)
+	}
+	return toStorageUserIdentity(userIdentity), nil
+}
+
+// DeleteUserIdentity deletes a user identity from the database by user id and connector id.
+func (d *Database) DeleteUserIdentity(ctx context.Context, userID, connectorID string) error {
+	id := compositeKeyID(userID, connectorID, d.hasher)
+
+	err := d.client.UserIdentity.DeleteOneID(id).Exec(ctx)
+	if err != nil {
+		return convertDBError("delete user identity: %w", err)
+	}
+	return nil
+}
+
+// UpdateUserIdentity changes a user identity by user id and connector id using an updater function.
+func (d *Database) UpdateUserIdentity(ctx context.Context, userID string, connectorID string, updater func(u storage.UserIdentity) (storage.UserIdentity, error)) error {
+	id := compositeKeyID(userID, connectorID, d.hasher)
+
+	tx, err := d.BeginTx(ctx)
+	if err != nil {
+		return convertDBError("update user identity tx: %w", err)
+	}
+
+	userIdentity, err := tx.UserIdentity.Get(ctx, id)
+	if err != nil {
+		return rollback(tx, "update user identity database: %w", err)
+	}
+
+	newUserIdentity, err := updater(toStorageUserIdentity(userIdentity))
+	if err != nil {
+		return rollback(tx, "update user identity updating: %w", err)
+	}
+
+	if newUserIdentity.Consents == nil {
+		newUserIdentity.Consents = make(map[string][]string)
+	}
+
+	encodedConsents, err := json.Marshal(newUserIdentity.Consents)
+	if err != nil {
+		return rollback(tx, "encode consents user identity: %w", err)
+	}
+
+	_, err = tx.UserIdentity.UpdateOneID(id).
+		SetUserID(newUserIdentity.UserID).
+		SetConnectorID(newUserIdentity.ConnectorID).
+		SetClaimsUserID(newUserIdentity.Claims.UserID).
+		SetClaimsUsername(newUserIdentity.Claims.Username).
+		SetClaimsPreferredUsername(newUserIdentity.Claims.PreferredUsername).
+		SetClaimsEmail(newUserIdentity.Claims.Email).
+		SetClaimsEmailVerified(newUserIdentity.Claims.EmailVerified).
+		SetClaimsGroups(newUserIdentity.Claims.Groups).
+		SetConsents(encodedConsents).
+		SetCreatedAt(newUserIdentity.CreatedAt).
+		SetLastLogin(newUserIdentity.LastLogin).
+		SetBlockedUntil(newUserIdentity.BlockedUntil).
+		Save(ctx)
+	if err != nil {
+		return rollback(tx, "update user identity uploading: %w", err)
+	}
+
+	if err = tx.Commit(); err != nil {
+		return rollback(tx, "update user identity commit: %w", err)
+	}
+
+	return nil
+}
+
+// ListUserIdentities lists all user identities in the database.
+func (d *Database) ListUserIdentities(ctx context.Context) ([]storage.UserIdentity, error) {
+	userIdentities, err := d.client.UserIdentity.Query().All(ctx)
+	if err != nil {
+		return nil, convertDBError("list user identities: %w", err)
+	}
+
+	storageUserIdentities := make([]storage.UserIdentity, 0, len(userIdentities))
+	for _, u := range userIdentities {
+		storageUserIdentities = append(storageUserIdentities, toStorageUserIdentity(u))
+	}
+	return storageUserIdentities, nil
+}

storage/ent/client/utils.go

@@ -32,13 +32,13 @@ func convertDBError(t string, err error) error {
 	return fmt.Errorf(t, err)
 }
 
-// compose hashed id from user and connection id to use it as primary key
+// compositeKeyID composes a hashed id from two key parts to use as primary key.
 // ent doesn't support multi-key primary yet
 // https://github.com/facebook/ent/issues/400
-func offlineSessionID(userID string, connID string, hasher func() hash.Hash) string {
+func compositeKeyID(first string, second string, hasher func() hash.Hash) string {
 	h := hasher()
 
-	h.Write([]byte(userID))
-	h.Write([]byte(connID))
+	h.Write([]byte(first))
+	h.Write([]byte(second))
 	return fmt.Sprintf("%x", h.Sum(nil))
 }

storage/ent/db/client.go

@@ -24,6 +24,7 @@ import (
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
 	"github.com/dexidp/dex/storage/ent/db/password"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
 )
 
 // Client is the client that holds all ent builders.
@@ -51,6 +52,8 @@ type Client struct {
 	Password *PasswordClient
 	// RefreshToken is the client for interacting with the RefreshToken builders.
 	RefreshToken *RefreshTokenClient
+	// UserIdentity is the client for interacting with the UserIdentity builders.
+	UserIdentity *UserIdentityClient
 }
 
 // NewClient creates a new client configured with the given options.
@@ -72,6 +75,7 @@ func (c *Client) init() {
 	c.OfflineSession = NewOfflineSessionClient(c.config)
 	c.Password = NewPasswordClient(c.config)
 	c.RefreshToken = NewRefreshTokenClient(c.config)
+	c.UserIdentity = NewUserIdentityClient(c.config)
 }
 
 type (
@@ -174,6 +178,7 @@ func (c *Client) Tx(ctx context.Context) (*Tx, error) {
 		OfflineSession: NewOfflineSessionClient(cfg),
 		Password:       NewPasswordClient(cfg),
 		RefreshToken:   NewRefreshTokenClient(cfg),
+		UserIdentity:   NewUserIdentityClient(cfg),
 	}, nil
 }
 
@@ -203,6 +208,7 @@ func (c *Client) BeginTx(ctx context.Context, opts *sql.TxOptions) (*Tx, error)
 		OfflineSession: NewOfflineSessionClient(cfg),
 		Password:       NewPasswordClient(cfg),
 		RefreshToken:   NewRefreshTokenClient(cfg),
+		UserIdentity:   NewUserIdentityClient(cfg),
 	}, nil
 }
 
@@ -233,7 +239,7 @@ func (c *Client) Close() error {
 func (c *Client) Use(hooks ...Hook) {
 	for _, n := range []interface{ Use(...Hook) }{
 		c.AuthCode, c.AuthRequest, c.Connector, c.DeviceRequest, c.DeviceToken, c.Keys,
-		c.OAuth2Client, c.OfflineSession, c.Password, c.RefreshToken,
+		c.OAuth2Client, c.OfflineSession, c.Password, c.RefreshToken, c.UserIdentity,
 	} {
 		n.Use(hooks...)
 	}
@@ -244,7 +250,7 @@ func (c *Client) Use(hooks ...Hook) {
 func (c *Client) Intercept(interceptors ...Interceptor) {
 	for _, n := range []interface{ Intercept(...Interceptor) }{
 		c.AuthCode, c.AuthRequest, c.Connector, c.DeviceRequest, c.DeviceToken, c.Keys,
-		c.OAuth2Client, c.OfflineSession, c.Password, c.RefreshToken,
+		c.OAuth2Client, c.OfflineSession, c.Password, c.RefreshToken, c.UserIdentity,
 	} {
 		n.Intercept(interceptors...)
 	}
@@ -273,6 +279,8 @@ func (c *Client) Mutate(ctx context.Context, m Mutation) (Value, error) {
 		return c.Password.mutate(ctx, m)
 	case *RefreshTokenMutation:
 		return c.RefreshToken.mutate(ctx, m)
+	case *UserIdentityMutation:
+		return c.UserIdentity.mutate(ctx, m)
 	default:
 		return nil, fmt.Errorf("db: unknown mutation type %T", m)
 	}
@@ -1608,14 +1616,148 @@ func (c *RefreshTokenClient) mutate(ctx context.Context, m *RefreshTokenMutation
 	}
 }
 
+// UserIdentityClient is a client for the UserIdentity schema.
+type UserIdentityClient struct {
+	config
+}
+
+// NewUserIdentityClient returns a client for the UserIdentity from the given config.
+func NewUserIdentityClient(c config) *UserIdentityClient {
+	return &UserIdentityClient{config: c}
+}
+
+// Use adds a list of mutation hooks to the hooks stack.
+// A call to `Use(f, g, h)` equals to `useridentity.Hooks(f(g(h())))`.
+func (c *UserIdentityClient) Use(hooks ...Hook) {
+	c.hooks.UserIdentity = append(c.hooks.UserIdentity, hooks...)
+}
+
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `useridentity.Intercept(f(g(h())))`.
+func (c *UserIdentityClient) Intercept(interceptors ...Interceptor) {
+	c.inters.UserIdentity = append(c.inters.UserIdentity, interceptors...)
+}
+
+// Create returns a builder for creating a UserIdentity entity.
+func (c *UserIdentityClient) Create() *UserIdentityCreate {
+	mutation := newUserIdentityMutation(c.config, OpCreate)
+	return &UserIdentityCreate{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// CreateBulk returns a builder for creating a bulk of UserIdentity entities.
+func (c *UserIdentityClient) CreateBulk(builders ...*UserIdentityCreate) *UserIdentityCreateBulk {
+	return &UserIdentityCreateBulk{config: c.config, builders: builders}
+}
+
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *UserIdentityClient) MapCreateBulk(slice any, setFunc func(*UserIdentityCreate, int)) *UserIdentityCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &UserIdentityCreateBulk{err: fmt.Errorf("calling to UserIdentityClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*UserIdentityCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &UserIdentityCreateBulk{config: c.config, builders: builders}
+}
+
+// Update returns an update builder for UserIdentity.
+func (c *UserIdentityClient) Update() *UserIdentityUpdate {
+	mutation := newUserIdentityMutation(c.config, OpUpdate)
+	return &UserIdentityUpdate{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// UpdateOne returns an update builder for the given entity.
+func (c *UserIdentityClient) UpdateOne(_m *UserIdentity) *UserIdentityUpdateOne {
+	mutation := newUserIdentityMutation(c.config, OpUpdateOne, withUserIdentity(_m))
+	return &UserIdentityUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// UpdateOneID returns an update builder for the given id.
+func (c *UserIdentityClient) UpdateOneID(id string) *UserIdentityUpdateOne {
+	mutation := newUserIdentityMutation(c.config, OpUpdateOne, withUserIdentityID(id))
+	return &UserIdentityUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// Delete returns a delete builder for UserIdentity.
+func (c *UserIdentityClient) Delete() *UserIdentityDelete {
+	mutation := newUserIdentityMutation(c.config, OpDelete)
+	return &UserIdentityDelete{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// DeleteOne returns a builder for deleting the given entity.
+func (c *UserIdentityClient) DeleteOne(_m *UserIdentity) *UserIdentityDeleteOne {
+	return c.DeleteOneID(_m.ID)
+}
+
+// DeleteOneID returns a builder for deleting the given entity by its id.
+func (c *UserIdentityClient) DeleteOneID(id string) *UserIdentityDeleteOne {
+	builder := c.Delete().Where(useridentity.ID(id))
+	builder.mutation.id = &id
+	builder.mutation.op = OpDeleteOne
+	return &UserIdentityDeleteOne{builder}
+}
+
+// Query returns a query builder for UserIdentity.
+func (c *UserIdentityClient) Query() *UserIdentityQuery {
+	return &UserIdentityQuery{
+		config: c.config,
+		ctx:    &QueryContext{Type: TypeUserIdentity},
+		inters: c.Interceptors(),
+	}
+}
+
+// Get returns a UserIdentity entity by its id.
+func (c *UserIdentityClient) Get(ctx context.Context, id string) (*UserIdentity, error) {
+	return c.Query().Where(useridentity.ID(id)).Only(ctx)
+}
+
+// GetX is like Get, but panics if an error occurs.
+func (c *UserIdentityClient) GetX(ctx context.Context, id string) *UserIdentity {
+	obj, err := c.Get(ctx, id)
+	if err != nil {
+		panic(err)
+	}
+	return obj
+}
+
+// Hooks returns the client hooks.
+func (c *UserIdentityClient) Hooks() []Hook {
+	return c.hooks.UserIdentity
+}
+
+// Interceptors returns the client interceptors.
+func (c *UserIdentityClient) Interceptors() []Interceptor {
+	return c.inters.UserIdentity
+}
+
+func (c *UserIdentityClient) mutate(ctx context.Context, m *UserIdentityMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&UserIdentityCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&UserIdentityUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&UserIdentityUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&UserIdentityDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("db: unknown UserIdentity mutation op: %q", m.Op())
+	}
+}
+
 // hooks and interceptors per client, for fast access.
 type (
 	hooks struct {
 		AuthCode, AuthRequest, Connector, DeviceRequest, DeviceToken, Keys,
-		OAuth2Client, OfflineSession, Password, RefreshToken []ent.Hook
+		OAuth2Client, OfflineSession, Password, RefreshToken, UserIdentity []ent.Hook
 	}
 	inters struct {
 		AuthCode, AuthRequest, Connector, DeviceRequest, DeviceToken, Keys,
-		OAuth2Client, OfflineSession, Password, RefreshToken []ent.Interceptor
+		OAuth2Client, OfflineSession, Password, RefreshToken,
+		UserIdentity []ent.Interceptor
 	}
 )

storage/ent/db/ent.go

@@ -22,6 +22,7 @@ import (
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
 	"github.com/dexidp/dex/storage/ent/db/password"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
 )
 
 // ent aliases to avoid import conflicts in user's code.
@@ -92,6 +93,7 @@ func checkColumn(t, c string) error {
 			offlinesession.Table: offlinesession.ValidColumn,
 			password.Table:       password.ValidColumn,
 			refreshtoken.Table:   refreshtoken.ValidColumn,
+			useridentity.Table:   useridentity.ValidColumn,
 		})
 	})
 	return columnCheck(t, c)

storage/ent/db/hook/hook.go

@@ -129,6 +129,18 @@ func (f RefreshTokenFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value,
 	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.RefreshTokenMutation", m)
 }
 
+// The UserIdentityFunc type is an adapter to allow the use of ordinary
+// function as UserIdentity mutator.
+type UserIdentityFunc func(context.Context, *db.UserIdentityMutation) (db.Value, error)
+
+// Mutate calls f(ctx, m).
+func (f UserIdentityFunc) Mutate(ctx context.Context, m db.Mutation) (db.Value, error) {
+	if mv, ok := m.(*db.UserIdentityMutation); ok {
+		return f(ctx, mv)
+	}
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *db.UserIdentityMutation", m)
+}
+
 // Condition is a hook condition function.
 type Condition func(context.Context, db.Mutation) bool
 

storage/ent/db/migrate/schema.go

@@ -200,6 +200,28 @@ var (
 		Columns:    RefreshTokensColumns,
 		PrimaryKey: []*schema.Column{RefreshTokensColumns[0]},
 	}
+	// UserIdentitiesColumns holds the columns for the "user_identities" table.
+	UserIdentitiesColumns = []*schema.Column{
+		{Name: "id", Type: field.TypeString, Unique: true, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "user_id", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "connector_id", Type: field.TypeString, Size: 2147483647, SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "claims_user_id", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "claims_username", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "claims_preferred_username", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "claims_email", Type: field.TypeString, Size: 2147483647, Default: "", SchemaType: map[string]string{"mysql": "varchar(384)", "postgres": "text", "sqlite3": "text"}},
+		{Name: "claims_email_verified", Type: field.TypeBool, Default: false},
+		{Name: "claims_groups", Type: field.TypeJSON, Nullable: true},
+		{Name: "consents", Type: field.TypeBytes},
+		{Name: "created_at", Type: field.TypeTime, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
+		{Name: "last_login", Type: field.TypeTime, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
+		{Name: "blocked_until", Type: field.TypeTime, SchemaType: map[string]string{"mysql": "datetime(3)", "postgres": "timestamptz", "sqlite3": "timestamp"}},
+	}
+	// UserIdentitiesTable holds the schema information for the "user_identities" table.
+	UserIdentitiesTable = &schema.Table{
+		Name:       "user_identities",
+		Columns:    UserIdentitiesColumns,
+		PrimaryKey: []*schema.Column{UserIdentitiesColumns[0]},
+	}
 	// Tables holds all the tables in the schema.
 	Tables = []*schema.Table{
 		AuthCodesTable,
@@ -212,6 +234,7 @@ var (
 		OfflineSessionsTable,
 		PasswordsTable,
 		RefreshTokensTable,
+		UserIdentitiesTable,
 	}
 )
 

storage/ent/db/predicate/predicate.go

@@ -35,3 +35,6 @@ type Password func(*sql.Selector)
 
 // RefreshToken is the predicate function for refreshtoken builders.
 type RefreshToken func(*sql.Selector)
+
+// UserIdentity is the predicate function for useridentity builders.
+type UserIdentity func(*sql.Selector)

storage/ent/db/runtime.go

@@ -15,6 +15,7 @@ import (
 	"github.com/dexidp/dex/storage/ent/db/offlinesession"
 	"github.com/dexidp/dex/storage/ent/db/password"
 	"github.com/dexidp/dex/storage/ent/db/refreshtoken"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
 	"github.com/dexidp/dex/storage/ent/schema"
 )
 
@@ -274,4 +275,38 @@ func init() {
 	refreshtokenDescID := refreshtokenFields[0].Descriptor()
 	// refreshtoken.IDValidator is a validator for the "id" field. It is called by the builders before save.
 	refreshtoken.IDValidator = refreshtokenDescID.Validators[0].(func(string) error)
+	useridentityFields := schema.UserIdentity{}.Fields()
+	_ = useridentityFields
+	// useridentityDescUserID is the schema descriptor for user_id field.
+	useridentityDescUserID := useridentityFields[1].Descriptor()
+	// useridentity.UserIDValidator is a validator for the "user_id" field. It is called by the builders before save.
+	useridentity.UserIDValidator = useridentityDescUserID.Validators[0].(func(string) error)
+	// useridentityDescConnectorID is the schema descriptor for connector_id field.
+	useridentityDescConnectorID := useridentityFields[2].Descriptor()
+	// useridentity.ConnectorIDValidator is a validator for the "connector_id" field. It is called by the builders before save.
+	useridentity.ConnectorIDValidator = useridentityDescConnectorID.Validators[0].(func(string) error)
+	// useridentityDescClaimsUserID is the schema descriptor for claims_user_id field.
+	useridentityDescClaimsUserID := useridentityFields[3].Descriptor()
+	// useridentity.DefaultClaimsUserID holds the default value on creation for the claims_user_id field.
+	useridentity.DefaultClaimsUserID = useridentityDescClaimsUserID.Default.(string)
+	// useridentityDescClaimsUsername is the schema descriptor for claims_username field.
+	useridentityDescClaimsUsername := useridentityFields[4].Descriptor()
+	// useridentity.DefaultClaimsUsername holds the default value on creation for the claims_username field.
+	useridentity.DefaultClaimsUsername = useridentityDescClaimsUsername.Default.(string)
+	// useridentityDescClaimsPreferredUsername is the schema descriptor for claims_preferred_username field.
+	useridentityDescClaimsPreferredUsername := useridentityFields[5].Descriptor()
+	// useridentity.DefaultClaimsPreferredUsername holds the default value on creation for the claims_preferred_username field.
+	useridentity.DefaultClaimsPreferredUsername = useridentityDescClaimsPreferredUsername.Default.(string)
+	// useridentityDescClaimsEmail is the schema descriptor for claims_email field.
+	useridentityDescClaimsEmail := useridentityFields[6].Descriptor()
+	// useridentity.DefaultClaimsEmail holds the default value on creation for the claims_email field.
+	useridentity.DefaultClaimsEmail = useridentityDescClaimsEmail.Default.(string)
+	// useridentityDescClaimsEmailVerified is the schema descriptor for claims_email_verified field.
+	useridentityDescClaimsEmailVerified := useridentityFields[7].Descriptor()
+	// useridentity.DefaultClaimsEmailVerified holds the default value on creation for the claims_email_verified field.
+	useridentity.DefaultClaimsEmailVerified = useridentityDescClaimsEmailVerified.Default.(bool)
+	// useridentityDescID is the schema descriptor for id field.
+	useridentityDescID := useridentityFields[0].Descriptor()
+	// useridentity.IDValidator is a validator for the "id" field. It is called by the builders before save.
+	useridentity.IDValidator = useridentityDescID.Validators[0].(func(string) error)
 }

storage/ent/db/tx.go

@@ -32,6 +32,8 @@ type Tx struct {
 	Password *PasswordClient
 	// RefreshToken is the client for interacting with the RefreshToken builders.
 	RefreshToken *RefreshTokenClient
+	// UserIdentity is the client for interacting with the UserIdentity builders.
+	UserIdentity *UserIdentityClient
 
 	// lazily loaded.
 	client     *Client
@@ -173,6 +175,7 @@ func (tx *Tx) init() {
 	tx.OfflineSession = NewOfflineSessionClient(tx.config)
 	tx.Password = NewPasswordClient(tx.config)
 	tx.RefreshToken = NewRefreshTokenClient(tx.config)
+	tx.UserIdentity = NewUserIdentityClient(tx.config)
 }
 
 // txDriver wraps the given dialect.Tx with a nop dialect.Driver implementation.

storage/ent/db/useridentity.go

@@ -0,0 +1,232 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"entgo.io/ent"
+	"entgo.io/ent/dialect/sql"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
+)
+
+// UserIdentity is the model entity for the UserIdentity schema.
+type UserIdentity struct {
+	config `json:"-"`
+	// ID of the ent.
+	ID string `json:"id,omitempty"`
+	// UserID holds the value of the "user_id" field.
+	UserID string `json:"user_id,omitempty"`
+	// ConnectorID holds the value of the "connector_id" field.
+	ConnectorID string `json:"connector_id,omitempty"`
+	// ClaimsUserID holds the value of the "claims_user_id" field.
+	ClaimsUserID string `json:"claims_user_id,omitempty"`
+	// ClaimsUsername holds the value of the "claims_username" field.
+	ClaimsUsername string `json:"claims_username,omitempty"`
+	// ClaimsPreferredUsername holds the value of the "claims_preferred_username" field.
+	ClaimsPreferredUsername string `json:"claims_preferred_username,omitempty"`
+	// ClaimsEmail holds the value of the "claims_email" field.
+	ClaimsEmail string `json:"claims_email,omitempty"`
+	// ClaimsEmailVerified holds the value of the "claims_email_verified" field.
+	ClaimsEmailVerified bool `json:"claims_email_verified,omitempty"`
+	// ClaimsGroups holds the value of the "claims_groups" field.
+	ClaimsGroups []string `json:"claims_groups,omitempty"`
+	// Consents holds the value of the "consents" field.
+	Consents []byte `json:"consents,omitempty"`
+	// CreatedAt holds the value of the "created_at" field.
+	CreatedAt time.Time `json:"created_at,omitempty"`
+	// LastLogin holds the value of the "last_login" field.
+	LastLogin time.Time `json:"last_login,omitempty"`
+	// BlockedUntil holds the value of the "blocked_until" field.
+	BlockedUntil time.Time `json:"blocked_until,omitempty"`
+	selectValues sql.SelectValues
+}
+
+// scanValues returns the types for scanning values from sql.Rows.
+func (*UserIdentity) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
+	for i := range columns {
+		switch columns[i] {
+		case useridentity.FieldClaimsGroups, useridentity.FieldConsents:
+			values[i] = new([]byte)
+		case useridentity.FieldClaimsEmailVerified:
+			values[i] = new(sql.NullBool)
+		case useridentity.FieldID, useridentity.FieldUserID, useridentity.FieldConnectorID, useridentity.FieldClaimsUserID, useridentity.FieldClaimsUsername, useridentity.FieldClaimsPreferredUsername, useridentity.FieldClaimsEmail:
+			values[i] = new(sql.NullString)
+		case useridentity.FieldCreatedAt, useridentity.FieldLastLogin, useridentity.FieldBlockedUntil:
+			values[i] = new(sql.NullTime)
+		default:
+			values[i] = new(sql.UnknownType)
+		}
+	}
+	return values, nil
+}
+
+// assignValues assigns the values that were returned from sql.Rows (after scanning)
+// to the UserIdentity fields.
+func (_m *UserIdentity) assignValues(columns []string, values []any) error {
+	if m, n := len(values), len(columns); m < n {
+		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
+	}
+	for i := range columns {
+		switch columns[i] {
+		case useridentity.FieldID:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field id", values[i])
+			} else if value.Valid {
+				_m.ID = value.String
+			}
+		case useridentity.FieldUserID:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field user_id", values[i])
+			} else if value.Valid {
+				_m.UserID = value.String
+			}
+		case useridentity.FieldConnectorID:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field connector_id", values[i])
+			} else if value.Valid {
+				_m.ConnectorID = value.String
+			}
+		case useridentity.FieldClaimsUserID:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field claims_user_id", values[i])
+			} else if value.Valid {
+				_m.ClaimsUserID = value.String
+			}
+		case useridentity.FieldClaimsUsername:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field claims_username", values[i])
+			} else if value.Valid {
+				_m.ClaimsUsername = value.String
+			}
+		case useridentity.FieldClaimsPreferredUsername:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field claims_preferred_username", values[i])
+			} else if value.Valid {
+				_m.ClaimsPreferredUsername = value.String
+			}
+		case useridentity.FieldClaimsEmail:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field claims_email", values[i])
+			} else if value.Valid {
+				_m.ClaimsEmail = value.String
+			}
+		case useridentity.FieldClaimsEmailVerified:
+			if value, ok := values[i].(*sql.NullBool); !ok {
+				return fmt.Errorf("unexpected type %T for field claims_email_verified", values[i])
+			} else if value.Valid {
+				_m.ClaimsEmailVerified = value.Bool
+			}
+		case useridentity.FieldClaimsGroups:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field claims_groups", values[i])
+			} else if value != nil && len(*value) > 0 {
+				if err := json.Unmarshal(*value, &_m.ClaimsGroups); err != nil {
+					return fmt.Errorf("unmarshal field claims_groups: %w", err)
+				}
+			}
+		case useridentity.FieldConsents:
+			if value, ok := values[i].(*[]byte); !ok {
+				return fmt.Errorf("unexpected type %T for field consents", values[i])
+			} else if value != nil {
+				_m.Consents = *value
+			}
+		case useridentity.FieldCreatedAt:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field created_at", values[i])
+			} else if value.Valid {
+				_m.CreatedAt = value.Time
+			}
+		case useridentity.FieldLastLogin:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field last_login", values[i])
+			} else if value.Valid {
+				_m.LastLogin = value.Time
+			}
+		case useridentity.FieldBlockedUntil:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field blocked_until", values[i])
+			} else if value.Valid {
+				_m.BlockedUntil = value.Time
+			}
+		default:
+			_m.selectValues.Set(columns[i], values[i])
+		}
+	}
+	return nil
+}
+
+// Value returns the ent.Value that was dynamically selected and assigned to the UserIdentity.
+// This includes values selected through modifiers, order, etc.
+func (_m *UserIdentity) Value(name string) (ent.Value, error) {
+	return _m.selectValues.Get(name)
+}
+
+// Update returns a builder for updating this UserIdentity.
+// Note that you need to call UserIdentity.Unwrap() before calling this method if this UserIdentity
+// was returned from a transaction, and the transaction was committed or rolled back.
+func (_m *UserIdentity) Update() *UserIdentityUpdateOne {
+	return NewUserIdentityClient(_m.config).UpdateOne(_m)
+}
+
+// Unwrap unwraps the UserIdentity entity that was returned from a transaction after it was closed,
+// so that all future queries will be executed through the driver which created the transaction.
+func (_m *UserIdentity) Unwrap() *UserIdentity {
+	_tx, ok := _m.config.driver.(*txDriver)
+	if !ok {
+		panic("db: UserIdentity is not a transactional entity")
+	}
+	_m.config.driver = _tx.drv
+	return _m
+}
+
+// String implements the fmt.Stringer.
+func (_m *UserIdentity) String() string {
+	var builder strings.Builder
+	builder.WriteString("UserIdentity(")
+	builder.WriteString(fmt.Sprintf("id=%v, ", _m.ID))
+	builder.WriteString("user_id=")
+	builder.WriteString(_m.UserID)
+	builder.WriteString(", ")
+	builder.WriteString("connector_id=")
+	builder.WriteString(_m.ConnectorID)
+	builder.WriteString(", ")
+	builder.WriteString("claims_user_id=")
+	builder.WriteString(_m.ClaimsUserID)
+	builder.WriteString(", ")
+	builder.WriteString("claims_username=")
+	builder.WriteString(_m.ClaimsUsername)
+	builder.WriteString(", ")
+	builder.WriteString("claims_preferred_username=")
+	builder.WriteString(_m.ClaimsPreferredUsername)
+	builder.WriteString(", ")
+	builder.WriteString("claims_email=")
+	builder.WriteString(_m.ClaimsEmail)
+	builder.WriteString(", ")
+	builder.WriteString("claims_email_verified=")
+	builder.WriteString(fmt.Sprintf("%v", _m.ClaimsEmailVerified))
+	builder.WriteString(", ")
+	builder.WriteString("claims_groups=")
+	builder.WriteString(fmt.Sprintf("%v", _m.ClaimsGroups))
+	builder.WriteString(", ")
+	builder.WriteString("consents=")
+	builder.WriteString(fmt.Sprintf("%v", _m.Consents))
+	builder.WriteString(", ")
+	builder.WriteString("created_at=")
+	builder.WriteString(_m.CreatedAt.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("last_login=")
+	builder.WriteString(_m.LastLogin.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("blocked_until=")
+	builder.WriteString(_m.BlockedUntil.Format(time.ANSIC))
+	builder.WriteByte(')')
+	return builder.String()
+}
+
+// UserIdentities is a parsable slice of UserIdentity.
+type UserIdentities []*UserIdentity

storage/ent/db/useridentity/useridentity.go

@@ -0,0 +1,144 @@
+// Code generated by ent, DO NOT EDIT.
+
+package useridentity
+
+import (
+	"entgo.io/ent/dialect/sql"
+)
+
+const (
+	// Label holds the string label denoting the useridentity type in the database.
+	Label = "user_identity"
+	// FieldID holds the string denoting the id field in the database.
+	FieldID = "id"
+	// FieldUserID holds the string denoting the user_id field in the database.
+	FieldUserID = "user_id"
+	// FieldConnectorID holds the string denoting the connector_id field in the database.
+	FieldConnectorID = "connector_id"
+	// FieldClaimsUserID holds the string denoting the claims_user_id field in the database.
+	FieldClaimsUserID = "claims_user_id"
+	// FieldClaimsUsername holds the string denoting the claims_username field in the database.
+	FieldClaimsUsername = "claims_username"
+	// FieldClaimsPreferredUsername holds the string denoting the claims_preferred_username field in the database.
+	FieldClaimsPreferredUsername = "claims_preferred_username"
+	// FieldClaimsEmail holds the string denoting the claims_email field in the database.
+	FieldClaimsEmail = "claims_email"
+	// FieldClaimsEmailVerified holds the string denoting the claims_email_verified field in the database.
+	FieldClaimsEmailVerified = "claims_email_verified"
+	// FieldClaimsGroups holds the string denoting the claims_groups field in the database.
+	FieldClaimsGroups = "claims_groups"
+	// FieldConsents holds the string denoting the consents field in the database.
+	FieldConsents = "consents"
+	// FieldCreatedAt holds the string denoting the created_at field in the database.
+	FieldCreatedAt = "created_at"
+	// FieldLastLogin holds the string denoting the last_login field in the database.
+	FieldLastLogin = "last_login"
+	// FieldBlockedUntil holds the string denoting the blocked_until field in the database.
+	FieldBlockedUntil = "blocked_until"
+	// Table holds the table name of the useridentity in the database.
+	Table = "user_identities"
+)
+
+// Columns holds all SQL columns for useridentity fields.
+var Columns = []string{
+	FieldID,
+	FieldUserID,
+	FieldConnectorID,
+	FieldClaimsUserID,
+	FieldClaimsUsername,
+	FieldClaimsPreferredUsername,
+	FieldClaimsEmail,
+	FieldClaimsEmailVerified,
+	FieldClaimsGroups,
+	FieldConsents,
+	FieldCreatedAt,
+	FieldLastLogin,
+	FieldBlockedUntil,
+}
+
+// ValidColumn reports if the column name is valid (part of the table columns).
+func ValidColumn(column string) bool {
+	for i := range Columns {
+		if column == Columns[i] {
+			return true
+		}
+	}
+	return false
+}
+
+var (
+	// UserIDValidator is a validator for the "user_id" field. It is called by the builders before save.
+	UserIDValidator func(string) error
+	// ConnectorIDValidator is a validator for the "connector_id" field. It is called by the builders before save.
+	ConnectorIDValidator func(string) error
+	// DefaultClaimsUserID holds the default value on creation for the "claims_user_id" field.
+	DefaultClaimsUserID string
+	// DefaultClaimsUsername holds the default value on creation for the "claims_username" field.
+	DefaultClaimsUsername string
+	// DefaultClaimsPreferredUsername holds the default value on creation for the "claims_preferred_username" field.
+	DefaultClaimsPreferredUsername string
+	// DefaultClaimsEmail holds the default value on creation for the "claims_email" field.
+	DefaultClaimsEmail string
+	// DefaultClaimsEmailVerified holds the default value on creation for the "claims_email_verified" field.
+	DefaultClaimsEmailVerified bool
+	// IDValidator is a validator for the "id" field. It is called by the builders before save.
+	IDValidator func(string) error
+)
+
+// OrderOption defines the ordering options for the UserIdentity queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByUserID orders the results by the user_id field.
+func ByUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUserID, opts...).ToFunc()
+}
+
+// ByConnectorID orders the results by the connector_id field.
+func ByConnectorID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldConnectorID, opts...).ToFunc()
+}
+
+// ByClaimsUserID orders the results by the claims_user_id field.
+func ByClaimsUserID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUserID, opts...).ToFunc()
+}
+
+// ByClaimsUsername orders the results by the claims_username field.
+func ByClaimsUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsUsername, opts...).ToFunc()
+}
+
+// ByClaimsPreferredUsername orders the results by the claims_preferred_username field.
+func ByClaimsPreferredUsername(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsPreferredUsername, opts...).ToFunc()
+}
+
+// ByClaimsEmail orders the results by the claims_email field.
+func ByClaimsEmail(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmail, opts...).ToFunc()
+}
+
+// ByClaimsEmailVerified orders the results by the claims_email_verified field.
+func ByClaimsEmailVerified(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldClaimsEmailVerified, opts...).ToFunc()
+}
+
+// ByCreatedAt orders the results by the created_at field.
+func ByCreatedAt(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCreatedAt, opts...).ToFunc()
+}
+
+// ByLastLogin orders the results by the last_login field.
+func ByLastLogin(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldLastLogin, opts...).ToFunc()
+}
+
+// ByBlockedUntil orders the results by the blocked_until field.
+func ByBlockedUntil(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldBlockedUntil, opts...).ToFunc()
+}

storage/ent/db/useridentity_create.go

@@ -0,0 +1,416 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
+)
+
+// UserIdentityCreate is the builder for creating a UserIdentity entity.
+type UserIdentityCreate struct {
+	config
+	mutation *UserIdentityMutation
+	hooks    []Hook
+}
+
+// SetUserID sets the "user_id" field.
+func (_c *UserIdentityCreate) SetUserID(v string) *UserIdentityCreate {
+	_c.mutation.SetUserID(v)
+	return _c
+}
+
+// SetConnectorID sets the "connector_id" field.
+func (_c *UserIdentityCreate) SetConnectorID(v string) *UserIdentityCreate {
+	_c.mutation.SetConnectorID(v)
+	return _c
+}
+
+// SetClaimsUserID sets the "claims_user_id" field.
+func (_c *UserIdentityCreate) SetClaimsUserID(v string) *UserIdentityCreate {
+	_c.mutation.SetClaimsUserID(v)
+	return _c
+}
+
+// SetNillableClaimsUserID sets the "claims_user_id" field if the given value is not nil.
+func (_c *UserIdentityCreate) SetNillableClaimsUserID(v *string) *UserIdentityCreate {
+	if v != nil {
+		_c.SetClaimsUserID(*v)
+	}
+	return _c
+}
+
+// SetClaimsUsername sets the "claims_username" field.
+func (_c *UserIdentityCreate) SetClaimsUsername(v string) *UserIdentityCreate {
+	_c.mutation.SetClaimsUsername(v)
+	return _c
+}
+
+// SetNillableClaimsUsername sets the "claims_username" field if the given value is not nil.
+func (_c *UserIdentityCreate) SetNillableClaimsUsername(v *string) *UserIdentityCreate {
+	if v != nil {
+		_c.SetClaimsUsername(*v)
+	}
+	return _c
+}
+
+// SetClaimsPreferredUsername sets the "claims_preferred_username" field.
+func (_c *UserIdentityCreate) SetClaimsPreferredUsername(v string) *UserIdentityCreate {
+	_c.mutation.SetClaimsPreferredUsername(v)
+	return _c
+}
+
+// SetNillableClaimsPreferredUsername sets the "claims_preferred_username" field if the given value is not nil.
+func (_c *UserIdentityCreate) SetNillableClaimsPreferredUsername(v *string) *UserIdentityCreate {
+	if v != nil {
+		_c.SetClaimsPreferredUsername(*v)
+	}
+	return _c
+}
+
+// SetClaimsEmail sets the "claims_email" field.
+func (_c *UserIdentityCreate) SetClaimsEmail(v string) *UserIdentityCreate {
+	_c.mutation.SetClaimsEmail(v)
+	return _c
+}
+
+// SetNillableClaimsEmail sets the "claims_email" field if the given value is not nil.
+func (_c *UserIdentityCreate) SetNillableClaimsEmail(v *string) *UserIdentityCreate {
+	if v != nil {
+		_c.SetClaimsEmail(*v)
+	}
+	return _c
+}
+
+// SetClaimsEmailVerified sets the "claims_email_verified" field.
+func (_c *UserIdentityCreate) SetClaimsEmailVerified(v bool) *UserIdentityCreate {
+	_c.mutation.SetClaimsEmailVerified(v)
+	return _c
+}
+
+// SetNillableClaimsEmailVerified sets the "claims_email_verified" field if the given value is not nil.
+func (_c *UserIdentityCreate) SetNillableClaimsEmailVerified(v *bool) *UserIdentityCreate {
+	if v != nil {
+		_c.SetClaimsEmailVerified(*v)
+	}
+	return _c
+}
+
+// SetClaimsGroups sets the "claims_groups" field.
+func (_c *UserIdentityCreate) SetClaimsGroups(v []string) *UserIdentityCreate {
+	_c.mutation.SetClaimsGroups(v)
+	return _c
+}
+
+// SetConsents sets the "consents" field.
+func (_c *UserIdentityCreate) SetConsents(v []byte) *UserIdentityCreate {
+	_c.mutation.SetConsents(v)
+	return _c
+}
+
+// SetCreatedAt sets the "created_at" field.
+func (_c *UserIdentityCreate) SetCreatedAt(v time.Time) *UserIdentityCreate {
+	_c.mutation.SetCreatedAt(v)
+	return _c
+}
+
+// SetLastLogin sets the "last_login" field.
+func (_c *UserIdentityCreate) SetLastLogin(v time.Time) *UserIdentityCreate {
+	_c.mutation.SetLastLogin(v)
+	return _c
+}
+
+// SetBlockedUntil sets the "blocked_until" field.
+func (_c *UserIdentityCreate) SetBlockedUntil(v time.Time) *UserIdentityCreate {
+	_c.mutation.SetBlockedUntil(v)
+	return _c
+}
+
+// SetID sets the "id" field.
+func (_c *UserIdentityCreate) SetID(v string) *UserIdentityCreate {
+	_c.mutation.SetID(v)
+	return _c
+}
+
+// Mutation returns the UserIdentityMutation object of the builder.
+func (_c *UserIdentityCreate) Mutation() *UserIdentityMutation {
+	return _c.mutation
+}
+
+// Save creates the UserIdentity in the database.
+func (_c *UserIdentityCreate) Save(ctx context.Context) (*UserIdentity, error) {
+	_c.defaults()
+	return withHooks(ctx, _c.sqlSave, _c.mutation, _c.hooks)
+}
+
+// SaveX calls Save and panics if Save returns an error.
+func (_c *UserIdentityCreate) SaveX(ctx context.Context) *UserIdentity {
+	v, err := _c.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// Exec executes the query.
+func (_c *UserIdentityCreate) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_c *UserIdentityCreate) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// defaults sets the default values of the builder before save.
+func (_c *UserIdentityCreate) defaults() {
+	if _, ok := _c.mutation.ClaimsUserID(); !ok {
+		v := useridentity.DefaultClaimsUserID
+		_c.mutation.SetClaimsUserID(v)
+	}
+	if _, ok := _c.mutation.ClaimsUsername(); !ok {
+		v := useridentity.DefaultClaimsUsername
+		_c.mutation.SetClaimsUsername(v)
+	}
+	if _, ok := _c.mutation.ClaimsPreferredUsername(); !ok {
+		v := useridentity.DefaultClaimsPreferredUsername
+		_c.mutation.SetClaimsPreferredUsername(v)
+	}
+	if _, ok := _c.mutation.ClaimsEmail(); !ok {
+		v := useridentity.DefaultClaimsEmail
+		_c.mutation.SetClaimsEmail(v)
+	}
+	if _, ok := _c.mutation.ClaimsEmailVerified(); !ok {
+		v := useridentity.DefaultClaimsEmailVerified
+		_c.mutation.SetClaimsEmailVerified(v)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (_c *UserIdentityCreate) check() error {
+	if _, ok := _c.mutation.UserID(); !ok {
+		return &ValidationError{Name: "user_id", err: errors.New(`db: missing required field "UserIdentity.user_id"`)}
+	}
+	if v, ok := _c.mutation.UserID(); ok {
+		if err := useridentity.UserIDValidator(v); err != nil {
+			return &ValidationError{Name: "user_id", err: fmt.Errorf(`db: validator failed for field "UserIdentity.user_id": %w`, err)}
+		}
+	}
+	if _, ok := _c.mutation.ConnectorID(); !ok {
+		return &ValidationError{Name: "connector_id", err: errors.New(`db: missing required field "UserIdentity.connector_id"`)}
+	}
+	if v, ok := _c.mutation.ConnectorID(); ok {
+		if err := useridentity.ConnectorIDValidator(v); err != nil {
+			return &ValidationError{Name: "connector_id", err: fmt.Errorf(`db: validator failed for field "UserIdentity.connector_id": %w`, err)}
+		}
+	}
+	if _, ok := _c.mutation.ClaimsUserID(); !ok {
+		return &ValidationError{Name: "claims_user_id", err: errors.New(`db: missing required field "UserIdentity.claims_user_id"`)}
+	}
+	if _, ok := _c.mutation.ClaimsUsername(); !ok {
+		return &ValidationError{Name: "claims_username", err: errors.New(`db: missing required field "UserIdentity.claims_username"`)}
+	}
+	if _, ok := _c.mutation.ClaimsPreferredUsername(); !ok {
+		return &ValidationError{Name: "claims_preferred_username", err: errors.New(`db: missing required field "UserIdentity.claims_preferred_username"`)}
+	}
+	if _, ok := _c.mutation.ClaimsEmail(); !ok {
+		return &ValidationError{Name: "claims_email", err: errors.New(`db: missing required field "UserIdentity.claims_email"`)}
+	}
+	if _, ok := _c.mutation.ClaimsEmailVerified(); !ok {
+		return &ValidationError{Name: "claims_email_verified", err: errors.New(`db: missing required field "UserIdentity.claims_email_verified"`)}
+	}
+	if _, ok := _c.mutation.Consents(); !ok {
+		return &ValidationError{Name: "consents", err: errors.New(`db: missing required field "UserIdentity.consents"`)}
+	}
+	if _, ok := _c.mutation.CreatedAt(); !ok {
+		return &ValidationError{Name: "created_at", err: errors.New(`db: missing required field "UserIdentity.created_at"`)}
+	}
+	if _, ok := _c.mutation.LastLogin(); !ok {
+		return &ValidationError{Name: "last_login", err: errors.New(`db: missing required field "UserIdentity.last_login"`)}
+	}
+	if _, ok := _c.mutation.BlockedUntil(); !ok {
+		return &ValidationError{Name: "blocked_until", err: errors.New(`db: missing required field "UserIdentity.blocked_until"`)}
+	}
+	if v, ok := _c.mutation.ID(); ok {
+		if err := useridentity.IDValidator(v); err != nil {
+			return &ValidationError{Name: "id", err: fmt.Errorf(`db: validator failed for field "UserIdentity.id": %w`, err)}
+		}
+	}
+	return nil
+}
+
+func (_c *UserIdentityCreate) sqlSave(ctx context.Context) (*UserIdentity, error) {
+	if err := _c.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := _c.createSpec()
+	if err := sqlgraph.CreateNode(ctx, _c.driver, _spec); err != nil {
+		if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return nil, err
+	}
+	if _spec.ID.Value != nil {
+		if id, ok := _spec.ID.Value.(string); ok {
+			_node.ID = id
+		} else {
+			return nil, fmt.Errorf("unexpected UserIdentity.ID type: %T", _spec.ID.Value)
+		}
+	}
+	_c.mutation.id = &_node.ID
+	_c.mutation.done = true
+	return _node, nil
+}
+
+func (_c *UserIdentityCreate) createSpec() (*UserIdentity, *sqlgraph.CreateSpec) {
+	var (
+		_node = &UserIdentity{config: _c.config}
+		_spec = sqlgraph.NewCreateSpec(useridentity.Table, sqlgraph.NewFieldSpec(useridentity.FieldID, field.TypeString))
+	)
+	if id, ok := _c.mutation.ID(); ok {
+		_node.ID = id
+		_spec.ID.Value = id
+	}
+	if value, ok := _c.mutation.UserID(); ok {
+		_spec.SetField(useridentity.FieldUserID, field.TypeString, value)
+		_node.UserID = value
+	}
+	if value, ok := _c.mutation.ConnectorID(); ok {
+		_spec.SetField(useridentity.FieldConnectorID, field.TypeString, value)
+		_node.ConnectorID = value
+	}
+	if value, ok := _c.mutation.ClaimsUserID(); ok {
+		_spec.SetField(useridentity.FieldClaimsUserID, field.TypeString, value)
+		_node.ClaimsUserID = value
+	}
+	if value, ok := _c.mutation.ClaimsUsername(); ok {
+		_spec.SetField(useridentity.FieldClaimsUsername, field.TypeString, value)
+		_node.ClaimsUsername = value
+	}
+	if value, ok := _c.mutation.ClaimsPreferredUsername(); ok {
+		_spec.SetField(useridentity.FieldClaimsPreferredUsername, field.TypeString, value)
+		_node.ClaimsPreferredUsername = value
+	}
+	if value, ok := _c.mutation.ClaimsEmail(); ok {
+		_spec.SetField(useridentity.FieldClaimsEmail, field.TypeString, value)
+		_node.ClaimsEmail = value
+	}
+	if value, ok := _c.mutation.ClaimsEmailVerified(); ok {
+		_spec.SetField(useridentity.FieldClaimsEmailVerified, field.TypeBool, value)
+		_node.ClaimsEmailVerified = value
+	}
+	if value, ok := _c.mutation.ClaimsGroups(); ok {
+		_spec.SetField(useridentity.FieldClaimsGroups, field.TypeJSON, value)
+		_node.ClaimsGroups = value
+	}
+	if value, ok := _c.mutation.Consents(); ok {
+		_spec.SetField(useridentity.FieldConsents, field.TypeBytes, value)
+		_node.Consents = value
+	}
+	if value, ok := _c.mutation.CreatedAt(); ok {
+		_spec.SetField(useridentity.FieldCreatedAt, field.TypeTime, value)
+		_node.CreatedAt = value
+	}
+	if value, ok := _c.mutation.LastLogin(); ok {
+		_spec.SetField(useridentity.FieldLastLogin, field.TypeTime, value)
+		_node.LastLogin = value
+	}
+	if value, ok := _c.mutation.BlockedUntil(); ok {
+		_spec.SetField(useridentity.FieldBlockedUntil, field.TypeTime, value)
+		_node.BlockedUntil = value
+	}
+	return _node, _spec
+}
+
+// UserIdentityCreateBulk is the builder for creating many UserIdentity entities in bulk.
+type UserIdentityCreateBulk struct {
+	config
+	err      error
+	builders []*UserIdentityCreate
+}
+
+// Save creates the UserIdentity entities in the database.
+func (_c *UserIdentityCreateBulk) Save(ctx context.Context) ([]*UserIdentity, error) {
+	if _c.err != nil {
+		return nil, _c.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(_c.builders))
+	nodes := make([]*UserIdentity, len(_c.builders))
+	mutators := make([]Mutator, len(_c.builders))
+	for i := range _c.builders {
+		func(i int, root context.Context) {
+			builder := _c.builders[i]
+			builder.defaults()
+			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
+				mutation, ok := m.(*UserIdentityMutation)
+				if !ok {
+					return nil, fmt.Errorf("unexpected mutation type %T", m)
+				}
+				if err := builder.check(); err != nil {
+					return nil, err
+				}
+				builder.mutation = mutation
+				var err error
+				nodes[i], specs[i] = builder.createSpec()
+				if i < len(mutators)-1 {
+					_, err = mutators[i+1].Mutate(root, _c.builders[i+1].mutation)
+				} else {
+					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
+					// Invoke the actual operation on the latest mutation in the chain.
+					if err = sqlgraph.BatchCreate(ctx, _c.driver, spec); err != nil {
+						if sqlgraph.IsConstraintError(err) {
+							err = &ConstraintError{msg: err.Error(), wrap: err}
+						}
+					}
+				}
+				if err != nil {
+					return nil, err
+				}
+				mutation.id = &nodes[i].ID
+				mutation.done = true
+				return nodes[i], nil
+			})
+			for i := len(builder.hooks) - 1; i >= 0; i-- {
+				mut = builder.hooks[i](mut)
+			}
+			mutators[i] = mut
+		}(i, ctx)
+	}
+	if len(mutators) > 0 {
+		if _, err := mutators[0].Mutate(ctx, _c.builders[0].mutation); err != nil {
+			return nil, err
+		}
+	}
+	return nodes, nil
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (_c *UserIdentityCreateBulk) SaveX(ctx context.Context) []*UserIdentity {
+	v, err := _c.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// Exec executes the query.
+func (_c *UserIdentityCreateBulk) Exec(ctx context.Context) error {
+	_, err := _c.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_c *UserIdentityCreateBulk) ExecX(ctx context.Context) {
+	if err := _c.Exec(ctx); err != nil {
+		panic(err)
+	}
+}

storage/ent/db/useridentity_delete.go

@@ -0,0 +1,88 @@
+// Code generated by ent, DO NOT EDIT.
+
+package db
+
+import (
+	"context"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/dexidp/dex/storage/ent/db/predicate"
+	"github.com/dexidp/dex/storage/ent/db/useridentity"
+)
+
+// UserIdentityDelete is the builder for deleting a UserIdentity entity.
+type UserIdentityDelete struct {
+	config
+	hooks    []Hook
+	mutation *UserIdentityMutation
+}
+
+// Where appends a list predicates to the UserIdentityDelete builder.
+func (_d *UserIdentityDelete) Where(ps ...predicate.UserIdentity) *UserIdentityDelete {
+	_d.mutation.Where(ps...)
+	return _d
+}
+
+// Exec executes the deletion query and returns how many vertices were deleted.
+func (_d *UserIdentityDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, _d.sqlExec, _d.mutation, _d.hooks)
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_d *UserIdentityDelete) ExecX(ctx context.Context) int {
+	n, err := _d.Exec(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return n
+}
+
+func (_d *UserIdentityDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(useridentity.Table, sqlgraph.NewFieldSpec(useridentity.FieldID, field.TypeString))
+	if ps := _d.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	affected, err := sqlgraph.DeleteNodes(ctx, _d.driver, _spec)
+	if err != nil && sqlgraph.IsConstraintError(err) {
+		err = &ConstraintError{msg: err.Error(), wrap: err}
+	}
+	_d.mutation.done = true
+	return affected, err
+}
+
+// UserIdentityDeleteOne is the builder for deleting a single UserIdentity entity.
+type UserIdentityDeleteOne struct {
+	_d *UserIdentityDelete
+}
+
+// Where appends a list predicates to the UserIdentityDelete builder.
+func (_d *UserIdentityDeleteOne) Where(ps ...predicate.UserIdentity) *UserIdentityDeleteOne {
+	_d._d.mutation.Where(ps...)
+	return _d
+}
+
+// Exec executes the deletion query.
+func (_d *UserIdentityDeleteOne) Exec(ctx context.Context) error {
+	n, err := _d._d.Exec(ctx)
+	switch {
+	case err != nil:
+		return err
+	case n == 0:
+		return &NotFoundError{useridentity.Label}
+	default:
+		return nil
+	}
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (_d *UserIdentityDeleteOne) ExecX(ctx context.Context) {
+	if err := _d.Exec(ctx); err != nil {
+		panic(err)
+	}
+}