From 415ddaa3dacd0b59e1b843af675e15c812c5a644 Mon Sep 17 00:00:00 2001
From: Pradeep Mudlapur <13034211+mdpradeep@users.noreply.github.com>
Date: Sun, 22 Oct 2023 00:08:01 +0530
Subject: [PATCH] Minimalistic support for group filtering in oidc connector
(#3074)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Pradeep Mudlapur <pradeep@juliacomputing.com>
Co-authored-by: Maksim Nabokikh <max.nabokih@gmail.com>
Co-authored-by: Márk Sági-Kazár <sagikazarmark@users.noreply.github.com>
---
connector/oidc/oidc.go | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/connector/oidc/oidc.go b/connector/oidc/oidc.go
index ff4713c2..fecfe620 100644
--- a/connector/oidc/oidc.go
+++ b/connector/oidc/oidc.go
@@ -15,6 +15,7 @@ import (
"golang.org/x/oauth2"
"github.com/dexidp/dex/connector"
+ groups_pkg "github.com/dexidp/dex/pkg/groups"
"github.com/dexidp/dex/pkg/httpclient"
"github.com/dexidp/dex/pkg/log"
)
@@ -50,7 +51,8 @@ type Config struct {
InsecureSkipEmailVerified bool `json:"insecureSkipEmailVerified"`
// InsecureEnableGroups enables groups claims. This is disabled by default until https://github.com/dexidp/dex/issues/1065 is resolved
- InsecureEnableGroups bool `json:"insecureEnableGroups"`
+ InsecureEnableGroups bool `json:"insecureEnableGroups"`
+ AllowedGroups []string `json:"allowedGroups"`
// AcrValues (Authentication Context Class Reference Values) that specifies the Authentication Context Class Values
// within the Authentication Request that the Authorization Server is being requested to use for
@@ -180,6 +182,7 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
httpClient: httpClient,
insecureSkipEmailVerified: c.InsecureSkipEmailVerified,
insecureEnableGroups: c.InsecureEnableGroups,
+ allowedGroups: c.AllowedGroups,
acrValues: c.AcrValues,
getUserInfo: c.GetUserInfo,
promptType: c.PromptType,
@@ -207,6 +210,7 @@ type oidcConnector struct {
httpClient *http.Client
insecureSkipEmailVerified bool
insecureEnableGroups bool
+ allowedGroups []string
acrValues []string
getUserInfo bool
promptType string
@@ -425,6 +429,18 @@ func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.I
}
}
}
+
+ // Validate that the user is part of allowedGroups
+ if len(c.allowedGroups) > 0 {
+ groupMatches := groups_pkg.Filter(groups, c.allowedGroups)
+
+ if len(groupMatches) == 0 {
+ // No group membership matches found, disallowing
+ return identity, fmt.Errorf("user not a member of allowed groups")
+ }
+
+ groups = groupMatches
+ }
}
cd := connectorData{
--
GitLab