Speed up OIDC login by reconciling org/team memberships in bulk

[2and3makes23]

This aims at improving #661

SUMMARY

Unify the two per-mapping pipeline steps (update_user_orgs, update_user_teams) into a single
update_user_org_team_mappings step that follows the LDAP backend's desired-state approach:

• compute the desired org/team membership in memory, create missing orgs/teams once via awx.sso.common.create_org_and_teams, then apply every change via one bulk
• reconcile_users_org_team_mappings call. The default SOCIAL_AUTH_PIPELINE
  (awx/settings/defaults.py) now runs the merged step only.

This removes the per-org/per-team get_or_create plus immediate m2m add/remove that ran on every
login, eliminating the noticeable login delay once more than a few orgs/teams are mapped.

Changes

• _update_m2m_from_expression now matches LDAP's _update_m2m_from_groups, evaluating a mapping
  expression to a tri-state (True/False/None).
• Desired-state computation is shared via _compute_org_desired_states / _compute_team_desired_states,
  keeping the merged default and the legacy entry points in lockstep.
• Per-login lookups are scoped to the configured maps instead of scanning whole tables:
  • create_org_and_teams returns early for empty maps and only reads referenced orgs
    (get_orgs_by_ids(names=...), using the unique Organization.name index); the full scan is kept
    only for the SAML attribute-based removal path.
  • Team-existence checks are scoped to the mapped organization, so a team whose name exists in
    another org is still created where the mapping expects it.
  • reconcile_users_org_team_mappings scopes the team lookup by organization name, hitting the
    composite (organization, name) index instead of scanning the Team table.

Kept for backwards compatibility

• update_user_orgs and update_user_teams remain for custom SOCIAL_AUTH_PIPELINE settings that
  still reference them. They keep their original per-domain behavior - orgs only, teams only - so
  custom pipelines don't start managing the other domain, while still using the same bulk helpers
  and keeping the performance win.

Tests

• Unit test pins the default SOCIAL_AUTH_PIPELINE to the merged step (legacy entry points not part
  of it).
• Functional tests cover expression matching (match() start-anchored semantics), merged-step
  org/team membership cases, per-domain wrapper behavior, and the scoped lookups - using direct
  role-membership assertions to avoid Role.__contains__ ancestor masking.
• The sso functional conftest replicates the DAB resource_registry ServiceID post_migrate hack
  so the tests run standalone with --nomigrations.

ISSUE TYPE

• New or Enhanced Feature

COMPONENT NAME

• Other (SSO login path in awx/sso)

ASCENDER VERSION

Tested with 25.5.1

ADDITIONAL INFO

There is more potential to increase performance (e.g. mentioned here), but these changes seemed to be the lowest hanging fruits with a large impact on OIDC login performance.

We experienced a delay of multiple seconds until forwarding to Ascender frontend. With this there is no noticable delay anymore.

[Copilot]

Pull request overview

This PR refactors the Social Auth (OIDC) login pipeline to reconcile organization/team memberships using a single desired-state bulk operation (mirroring the LDAP backend) to reduce per-login database churn and improve login latency.

Changes:

• Replace per-mapping get_or_create + immediate M2M updates with a merged update_user_org_team_mappings step that computes desired state in memory and reconciles in bulk.
• Improve team creation correctness in create_org_and_teams by scoping existence checks by (organization, team_name) (supporting same team name across multiple orgs).
• Add unit/functional coverage to ensure defaults use the merged pipeline step and to validate tri-state expression evaluation behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
awx/sso/social_pipeline.py	Introduces merged Social Auth pipeline step and tri-state expression evaluation, delegating legacy wrappers to the merged step.
awx/sso/common.py	Adjusts org/team creation logic (team existence scoped by org); adds an early-return guard.
awx/settings/defaults.py	Switches default SOCIAL_AUTH_PIPELINE to the merged org/team mapping step.
awx/sso/tests/unit/test_pipelines.py	Adds a unit test asserting the default pipeline uses the merged step and not the legacy wrappers.
awx/sso/tests/functional/test_social_pipeline.py	Adds functional tests for tri-state expression evaluation and merged reconciliation behavior.
awx/sso/tests/functional/conftest.py	Adds a test-only post-migrate hook to create ServiceID so SSO functional tests can run in isolation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[cigamit]

Copilot found a few things, only the first one is really important. Fix that and this should be good to merge.

[2and3makes23]

I tried to incorporate all recommendations, also ran a few more checks and added some more smaller improvements + tests.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (2)

awx/sso/social_pipeline.py:42

• Using type(re.compile('')) inside isinstance() recompiles an empty regex pattern on every call, which adds avoidable overhead in this per-login hot path. Prefer using a cached pattern type (e.g., re.Pattern) for the isinstance checks.

        if isinstance(opts, (str, type(re.compile('')))):
            opts = [opts]

        for expression in opts:
            if isinstance(expression, str):

awx/sso/social_pipeline.py:96

• _compute_org_desired_states() resets desired_org_states[organization_name] for every entry. If multiple ORGANIZATION_MAP items resolve to the same organization_name via organization_alias, the later entry overwrites earlier desired states, which can drop previously computed role grants/removals compared to the historical per-entry behavior.

        desired_org_states[organization_name] = {}

        # Social auth currently supports organization admins and users.
        org_roles_and_expressions = {
            'admin_role': 'admins',