SamlProvider has many linked Identities

app/models/identity.rb

 class Identity < ActiveRecord::Base
-  prepend EE::Identity
-
   def self.uniqueness_scope
     :provider
   end
 
+  prepend EE::Identity
+
   include Sortable
   include CaseSensitivity
 

db/schema.rb

@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20180425131009) do
+ActiveRecord::Schema.define(version: 20180502125859) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -1257,8 +1257,10 @@ ActiveRecord::Schema.define(version: 20180425131009) do
     t.datetime "created_at"
     t.datetime "updated_at"
     t.string "secondary_extern_uid"
+    t.integer "saml_provider_id"
   end
 
+  add_index "identities", ["saml_provider_id"], name: "index_identities_on_saml_provider_id", where: "(saml_provider_id IS NOT NULL)", using: :btree
   add_index "identities", ["user_id"], name: "index_identities_on_user_id", using: :btree
 
   create_table "index_statuses", force: :cascade do |t|
@@ -2770,6 +2772,7 @@ ActiveRecord::Schema.define(version: 20180425131009) do
   add_foreign_key "gpg_signatures", "gpg_keys", on_delete: :nullify
   add_foreign_key "gpg_signatures", "projects", on_delete: :cascade
   add_foreign_key "group_custom_attributes", "namespaces", column: "group_id", on_delete: :cascade
+  add_foreign_key "identities", "saml_providers", name: "fk_aade90f0fc", on_delete: :cascade
   add_foreign_key "index_statuses", "projects", name: "fk_74b2492545", on_delete: :cascade
   add_foreign_key "internal_ids", "namespaces", name: "fk_162941d509", on_delete: :cascade
   add_foreign_key "internal_ids", "projects", on_delete: :cascade

ee/app/models/ee/identity.rb

@@ -3,11 +3,19 @@ module EE
     extend ActiveSupport::Concern
 
     prepended do
-      validates :secondary_extern_uid, allow_blank: true, uniqueness: { scope: :provider, case_sensitive: false }
+      belongs_to :saml_provider
+
+      validates :secondary_extern_uid, allow_blank: true, uniqueness: { scope: uniqueness_scope, case_sensitive: false }
 
       scope :with_secondary_extern_uid, ->(provider, secondary_extern_uid) do
         iwhere(secondary_extern_uid: normalize_uid(provider, secondary_extern_uid)).with_provider(provider)
       end
     end
+
+    module ClassMethods
+      def uniqueness_scope
+        [*super, :saml_provider_id]
+      end
+    end
   end
 end

ee/app/models/saml_provider.rb

 class SamlProvider < ActiveRecord::Base
   belongs_to :group
+  has_many :identities
 
   validates :group, presence: true, top_level_group: true
   validates :sso_url, presence: true, url: { protocols: %w(https) }

ee/db/migrate/20180317020334_add_saml_provider_to_identities.rb

+class AddSamlProviderToIdentities < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+  disable_ddl_transaction!
+
+  def change
+    add_column :identities, :saml_provider_id, :integer
+  end
+end

ee/db/migrate/20180502125859_add_saml_provider_index_and_constraint_to_identities.rb

+class AddSamlProviderIndexAndConstraintToIdentities < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_index :identities, :saml_provider_id, where: 'saml_provider_id IS NOT NULL'
+    add_concurrent_foreign_key :identities, :saml_providers, column: :saml_provider_id, on_delete: :cascade
+  end
+
+  def down
+    remove_foreign_key :identities, column: :saml_provider_id
+    remove_concurrent_index :identities, :saml_provider_id
+  end
+end

ee/spec/models/saml_provider_spec.rb

@@ -3,6 +3,7 @@ require 'spec_helper'
 describe SamlProvider do
   describe "Associations" do
     it { is_expected.to belong_to :group }
+    it { is_expected.to have_many :identities }
   end
 
   describe 'Validations' do

spec/models/identity_spec.rb

@@ -3,6 +3,7 @@ require 'spec_helper'
 describe Identity do
   describe 'relations' do
     it { is_expected.to belong_to(:user) }
+    it { is_expected.to belong_to(:saml_provider) }
   end
 
   describe 'fields' do
@@ -104,4 +105,13 @@ describe Identity do
       end
     end
   end
+
+  context 'with saml_provider' do
+    it 'allows user to have records with different groups' do
+      _identity_one = create(:identity, provider: 'group_saml', saml_provider: create(:saml_provider))
+      identity_two = create(:identity, provider: 'group_saml', saml_provider: create(:saml_provider))
+
+      expect(identity_two).to be_valid
+    end
+  end
 end