feat: add support for mapping user admin status from OIDC claims - #1033
Conversation
1cda078 to
7c460e4
Compare
Some IdPs don't provide or only provide the claims in the ID token / userinfo. Most clients will check both claims.
| switch roles := subject.(type) { | ||
| case string: | ||
| return r.resolveSlice([]string{roles}), nil | ||
| case []string: |
There was a problem hiding this comment.
This doesn't work. the groups are provided here as []any. (I've already adjusted this).
|
|
||
| // RBACResolver allows for arbitrary input to be mapped to roles for | ||
| // use in a permission system. | ||
| type RBACResolver interface { |
There was a problem hiding this comment.
I feel like this is pretty overengineered. All this matching and conversion should be done in a single function. This makes this IMO easier to understand. (I've already adjusted this)
7c460e4 to
20629d3
Compare
|
@eternal-flame-AD Could you take a look at these changes? I've made some larger adjustments and would like a second pair of eyes (: I've tested this with authentik and Authelia with different combinations of settings and groups. |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #1033 +/- ##
==========================================
+ Coverage 75.49% 75.77% +0.27%
==========================================
Files 66 66
Lines 3559 3620 +61
==========================================
+ Hits 2687 2743 +56
- Misses 662 666 +4
- Partials 210 211 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
sure, will do tonight :) |
Co-Authored-By: Jannis Mattheis <contact@jmattheis.de>
7c187c9 to
585b9e3
Compare
3 participants
an optional new configuration setting allows operators to define a JMESPath expression to calculate the admin status of a user based on their OIDC claims. this feature can also be used to deny users access alltogether, by mapping their claims to a special role value.
closes #957