feat: oidc groups mapping

Author: NextFire

.env.sample

@@ -165,6 +165,9 @@ OIDC_DISPLAY_NAME=OpenID Connect
 # Space separated auth scopes.
 OIDC_SCOPES=openid profile email
 
+# Specify which claim to derive group memberships from
+# Supports any valid JSON path with the JWT payload
+OIDC_GROUPS_CLAIM=
 
 # ––––––––––––––––––––––––––––––––––––––
 # ––––––––––––––  EMAIL  –––––––––––––––

app.json

@@ -109,6 +109,10 @@
       "value": "openid profile email",
       "required": false
     },
+    "OIDC_GROUPS_CLAIM": {
+      "description": "Specify which claim to derive group memberships from. Supports any valid JSON path with the JWT payload",
+      "required": false
+    },
     "SLACK_CLIENT_ID": {
       "description": "See https://api.slack.com/apps to create a new Slack app. You must configure at least one of Slack or Google to control login.",
       "required": false

plugins/oidc/server/auth/oidcRouter.ts

@@ -187,6 +187,9 @@ export function createOIDCRouter(
           }
 
           const ctx = createContext({ ip: context.ip });
+          const groups = env.OIDC_GROUPS_CLAIM
+            ? (get(profile, env.OIDC_GROUPS_CLAIM, []) as string[])
+            : undefined;
           const result = await accountProvisioner(ctx, {
             team: {
               teamId: team?.id,
@@ -199,6 +202,7 @@ export function createOIDCRouter(
               email,
               avatarUrl,
             },
+            groups,
             authenticationProvider: {
               name: config.id,
               providerId,

server/commands/accountProvisioner.ts

@@ -1,6 +1,7 @@
 import path from "path";
 import { readFile } from "fs-extra";
 import invariant from "invariant";
+import { Op } from "sequelize";
 import { CollectionPermission, UserRole } from "@shared/types";
 import WelcomeEmail from "@server/emails/templates/WelcomeEmail";
 import env from "@server/env";
@@ -13,6 +14,8 @@ import {
   AuthenticationProvider,
   Collection,
   Document,
+  Group,
+  GroupUser,
   Team,
   User,
 } from "@server/models";
@@ -51,6 +54,8 @@ type Props = {
     /** The public url of an image representing the team */
     avatarUrl?: string | null;
   };
+  /** Groups the user should be member of */
+  groups?: string[];
   /** Details of the authentication provider being used */
   authenticationProvider: {
     /** The name of the authentication provider, eg "google" */
@@ -85,6 +90,7 @@ async function accountProvisioner(
   {
     user: userParams,
     team: teamParams,
+    groups: groupNames,
     authenticationProvider: authenticationProviderParams,
     authentication: authenticationParams,
   }: Props
@@ -191,6 +197,10 @@ async function accountProvisioner(
     }
   }
 
+  if (groupNames !== undefined) {
+    await reconciliateUserGroups(groupNames, user, team);
+  }
+
   return {
     user,
     team,
@@ -257,3 +267,47 @@ async function provisionFirstCollection(team: Team, user: User) {
 export default traceFunction({
   spanName: "accountProvisioner",
 })(accountProvisioner);
+
+async function reconciliateUserGroups(
+  groupNames: string[],
+  user: User,
+  team: Team
+) {
+  const groups = await Promise.all(
+    groupNames.map(async (groupName) => {
+      // Get existing group
+      let group = await Group.findOne({
+        where: {
+          name: { [Op.iLike]: groupName },
+          teamId: team.id,
+        },
+      });
+      // Create group if it doesn't exist
+      group ??= await Group.create({
+        name: groupName,
+        teamId: user.teamId,
+        createdById: user.id,
+      });
+      // Add user to group
+      await GroupUser.findOrCreate({
+        where: {
+          groupId: group.id,
+          userId: user.id,
+        },
+        defaults: {
+          createdById: user.id,
+        },
+      });
+      return group;
+    })
+  );
+  // Remove user from groups they are no longer a member of
+  await GroupUser.destroy({
+    where: {
+      userId: user.id,
+      groupId: {
+        [Op.notIn]: groups.map((group) => group.id),
+      },
+    },
+  });
+}

server/env.ts

@@ -493,6 +493,14 @@ export class Environment {
    */
   public DD_SERVICE = environment.DD_SERVICE ?? "outline";
 
+  /**
+   * The OIDC profile field that lists group memberships.
+   */
+  @IsOptional()
+  public OIDC_GROUPS_CLAIM = this.toOptionalString(
+    process.env.OIDC_GROUPS_CLAIM
+  );
+
   /**
    * A string representing the version of the software.
    *