DefGuard · t-aleksander · Aug 19, 2025 · Aug 14, 2025 · Aug 18, 2025 · Aug 18, 2025
diff --git a/...dc105a0411bd634a080391e41f431f966c17.json → ...cb62c4bd9b646846740333d8ae3d154d1d77.json b/...dc105a0411bd634a080391e41f431f966c17.json → ...cb62c4bd9b646846740333d8ae3d154d1d77.json
diff --git a/...f6464ef320242782b486f7e17c7742eec1f0.json → ...40392f423c16cd326716994fcb1f45c84eee.json b/...f6464ef320242782b486f7e17c7742eec1f0.json → ...40392f423c16cd326716994fcb1f45c84eee.json
diff --git a/...508dbd1407c8963b3fb240ad24b84fdf5fab.json → ...77cbad81d77c2db2b67dca90de198721b483.json b/...508dbd1407c8963b3fb240ad24b84fdf5fab.json → ...77cbad81d77c2db2b67dca90de198721b483.json
diff --git a/...9a3c89e0725d2d2d7a1aa6739f1870a4fd05.json → ...4818139cdfac6ed6c15603f6e6806c63ac6f.json b/...9a3c89e0725d2d2d7a1aa6739f1870a4fd05.json → ...4818139cdfac6ed6c15603f6e6806c63ac6f.json
diff --git a/...0fc67194a7de7cf7241d938b25f068525411.json → ...d29e22e58f33e902c06bbf6163ee48ae802a.json b/...0fc67194a7de7cf7241d938b25f068525411.json → ...d29e22e58f33e902c06bbf6163ee48ae802a.json
diff --git a/...a956656c9ef58f46ede7bc8225900ade4579.json → ...1bab2a0e2020e33653ef34ab1ea7df67a0cb.json b/...a956656c9ef58f46ede7bc8225900ade4579.json → ...1bab2a0e2020e33653ef34ab1ea7df67a0cb.json
diff --git a/...6ceb4e139f131e33a032dd4b719a937de935.json → ...c56cc1e6b0c6fbf1907cce4bbe0a1bde88ff.json b/...6ceb4e139f131e33a032dd4b719a937de935.json → ...c56cc1e6b0c6fbf1907cce4bbe0a1bde88ff.json
diff --git a/Cargo.toml b/Cargo.toml
@@ -88,7 +88,11 @@ tokio = { version = "1", features = [
 ] }
 tokio-stream = "0.1"
 tokio-util = "0.7"
-tonic = { version = "0.14", features = ["gzip", "tls-native-roots"] }
+tonic = { version = "0.14", features = [
+    "gzip",
+    "tls-native-roots",
+    "tls-ring",
+] }
 tonic-health = "0.14"
 totp-lite = { version = "2.0" }
 tower-http = { version = "0.6", features = ["fs", "trace"] }

diff --git a/crates/defguard_core/src/db/mod.rs b/crates/defguard_core/src/db/mod.rs
@@ -1,10 +1,10 @@
 pub mod models;
 
-use crate::MIGRATOR;
-
 use sqlx::postgres::{PgConnectOptions, PgPool, PgPoolOptions};
 use utoipa::ToSchema;
 
+use crate::MIGRATOR;
+
 #[derive(Clone, Debug, Deserialize, PartialEq, Serialize, ToSchema, Eq, Default, Hash)]
 pub struct NoId;
 pub type Id = i64;

diff --git a/crates/defguard_core/src/db/models/biometric_auth.rs b/crates/defguard_core/src/db/models/biometric_auth.rs
@@ -1,14 +1,13 @@
+use base64::{Engine, engine::general_purpose, prelude::BASE64_STANDARD};
+use ed25519_dalek::{Signature, Verifier, VerifyingKey};
+use model_derive::Model;
+use sqlx::{PgExecutor, query_as};
+use thiserror::Error;
+
 use crate::{
     db::{Id, NoId},
     random::gen_alphanumeric,
 };
-use base64::engine::general_purpose;
-use base64::{Engine, prelude::BASE64_STANDARD};
-use ed25519_dalek::Verifier;
-use ed25519_dalek::{Signature, VerifyingKey};
-use model_derive::Model;
-use sqlx::{PgExecutor, query_as};
-use thiserror::Error;
 
 #[derive(Error, Debug)]
 pub enum BiometricAuthError {
@@ -47,6 +46,7 @@ impl BiometricAuth {
             pub_key,
         }
     }
+
     pub fn validate_pubkey(pub_key: &str) -> Result<(), BiometricAuthError> {
         let decoded = BASE64_STANDARD.decode(pub_key)?;
         if decoded.len() != ed25519_dalek::PUBLIC_KEY_LENGTH {
@@ -145,11 +145,12 @@ fn verify(
 
 #[cfg(test)]
 mod test {
-    use super::*;
     use base64::engine::general_purpose;
     use ed25519_dalek::Signer;
     use matches::assert_matches;
 
+    use super::*;
+
     #[test]
     fn test_verify_valid_sig() {
         let mut csprng = rand_core::OsRng;

diff --git a/crates/defguard_core/src/db/models/mod.rs b/crates/defguard_core/src/db/models/mod.rs
@@ -29,13 +29,12 @@ use std::collections::HashSet;
 use sqlx::{Error as SqlxError, PgConnection, PgPool, query_as};
 use utoipa::ToSchema;
 
-use crate::db::models::biometric_auth::BiometricAuth;
-
 use self::{
     device::UserDevice,
     user::{MFAMethod, User},
 };
 use super::{Group, Id};
+use crate::db::models::biometric_auth::BiometricAuth;
 
 #[cfg(feature = "openid")]
 #[derive(Deserialize, Serialize)]

diff --git a/crates/defguard_core/src/db/models/user.rs b/crates/defguard_core/src/db/models/user.rs
@@ -902,6 +902,7 @@ impl User<Id> {
             Ok(Self::find_by_email(&mut *conn, username_or_email).await?)
         }
     }
+
     pub(crate) async fn find_many_by_emails<'e, E>(
         executor: E,
         emails: &[&str],

diff --git a/crates/defguard_core/src/enterprise/db/models/openid_provider.rs b/crates/defguard_core/src/enterprise/db/models/openid_provider.rs
@@ -115,6 +115,7 @@ pub struct OpenIdProvider<I = NoId> {
     #[model(ref)]
     // The groups to sync from the directory, exact match
     pub directory_sync_group_match: Vec<String>,
+    pub jumpcloud_api_key: Option<String>,
 }
 
 impl OpenIdProvider {
@@ -136,6 +137,7 @@ impl OpenIdProvider {
         okta_private_jwk: Option<String>,
         okta_dirsync_client_id: Option<String>,
         directory_sync_group_match: Vec<String>,
+        jumpcloud_api_key: Option<String>,
     ) -> Self {
         Self {
             id: NoId,
@@ -155,6 +157,7 @@ impl OpenIdProvider {
             okta_private_jwk,
             okta_dirsync_client_id,
             directory_sync_group_match,
+            jumpcloud_api_key,
         }
     }
 
@@ -166,8 +169,8 @@ impl OpenIdProvider {
                 display_name = $5, google_service_account_key = $6, google_service_account_email = $7, admin_email = $8, \
                 directory_sync_enabled = $9, directory_sync_interval = $10, directory_sync_user_behavior = $11, \
                 directory_sync_admin_behavior = $12, directory_sync_target = $13, \
-                okta_private_jwk = $14, okta_dirsync_client_id = $15, directory_sync_group_match = $16 \
-                WHERE id = $17",
+                okta_private_jwk = $14, okta_dirsync_client_id = $15, directory_sync_group_match = $16, jumpcloud_api_key = $17 \
+                WHERE id = $18",
                 self.name,
                 self.base_url,
                 self.client_id,
@@ -184,6 +187,7 @@ impl OpenIdProvider {
                 self.okta_private_jwk,
                 self.okta_dirsync_client_id,
                 &self.directory_sync_group_match,
+                self.jumpcloud_api_key,
                 provider.id,
             )
             .execute(pool)
@@ -208,7 +212,7 @@ impl OpenIdProvider<Id> {
             directory_sync_interval, directory_sync_user_behavior  \"directory_sync_user_behavior: DirectorySyncUserBehavior\", \
             directory_sync_admin_behavior  \"directory_sync_admin_behavior: DirectorySyncUserBehavior\", \
             directory_sync_target  \"directory_sync_target: DirectorySyncTarget\", \
-            okta_private_jwk, okta_dirsync_client_id, directory_sync_group_match \
+            okta_private_jwk, okta_dirsync_client_id, directory_sync_group_match, jumpcloud_api_key \
             FROM openidprovider WHERE name = $1",
             name
         )
@@ -227,7 +231,7 @@ impl OpenIdProvider<Id> {
             directory_sync_interval, directory_sync_user_behavior \"directory_sync_user_behavior: DirectorySyncUserBehavior\", \
             directory_sync_admin_behavior  \"directory_sync_admin_behavior: DirectorySyncUserBehavior\", \
             directory_sync_target  \"directory_sync_target: DirectorySyncTarget\", \
-            okta_private_jwk, okta_dirsync_client_id, directory_sync_group_match \
+            okta_private_jwk, okta_dirsync_client_id, directory_sync_group_match, jumpcloud_api_key \
             FROM openidprovider LIMIT 1"
         )
         .fetch_optional(executor)

diff --git a/crates/defguard_core/src/enterprise/db/models/snat.rs b/crates/defguard_core/src/enterprise/db/models/snat.rs
@@ -1,14 +1,15 @@
 use std::net::IpAddr;
 
-use crate::{
-    db::{Id, NoId},
-    enterprise::snat::error::UserSnatBindingError,
-};
 use model_derive::Model;
 use serde::{Deserialize, Serialize};
 use sqlx::{PgExecutor, query_as};
 use utoipa::ToSchema;
 
+use crate::{
+    db::{Id, NoId},
+    enterprise::snat::error::UserSnatBindingError,
+};
+
 #[derive(Clone, Debug, Deserialize, Model, Serialize, ToSchema)]
 #[table(user_snat_binding)]
 pub struct UserSnatBinding<I = NoId> {

diff --git a/crates/defguard_core/src/enterprise/directory_sync/google.rs b/crates/defguard_core/src/enterprise/directory_sync/google.rs
@@ -105,6 +105,7 @@ impl From<User> for DirectoryUser {
         Self {
             email: val.primary_email,
             active: !val.suspended,
+            id: None,
         }
     }
 }
@@ -425,17 +426,18 @@ impl DirectorySync for GoogleDirectorySync {
 
     async fn get_user_groups(
         &self,
-        user_id: &str,
+        user_email: &str,
     ) -> Result<Vec<DirectoryGroup>, DirectorySyncError> {
-        debug!("Getting groups of user {user_id}");
-        let response = self.query_user_groups(user_id).await?;
-        debug!("Got groups response for user {user_id}");
+        debug!("Getting groups of user {user_email}");
+        let response = self.query_user_groups(user_email).await?;
+        debug!("Got groups response for user {user_email}");
         Ok(response.groups)
     }
 
     async fn get_group_members(
         &self,
         group: &DirectoryGroup,
+        _all_users_helper: Option<&[DirectoryUser]>,
     ) -> Result<Vec<String>, DirectorySyncError> {
         debug!("Getting group members of group {}", group.name);
         let response = self.query_group_members(group).await?;