hwiplandGusted
1ea5605eae
Currently, Forgejo supports configuring static group team mappings for
an OIDC authentication source that map OIDC groups to Forgejo
organizations and teams. For example, the following mapping
```json
{"Developer": {"MyForgejoOrganization": ["MyForgejoTeam1", "MyForgejoTeam2"]}}
```
automatically adds a user in the OIDC group `Developer` to the teams
`MyForgejoTeam1` and `MyForgejoTeam2` in organization
`MyForgejoOrganization`.
In order to support more dynamic mappings and to avoid having to update
the mappings for new organizations and teams, add an additional
configuration option that supports mappings with placeholders like in
the following example:
```json
["group-{org}-{team}", "other:{org}/{team}"]
```
In this example, the mappings add a user in OIDC groups
`group-org1-team1`, `group-org2-team2`, and `other:org3/team3` to team
`team1` in organization `org1`, team `team2` in organization `org2`, and
to team `team3` in organization `org3`.
Additionally, this adds a configuration option to dynamically remove
users from organization teams. If enabled, a user is removed from all
teams that are not added via a static or dynamic mapping. Thus, users
are only in teams that are added via such a mapping and no other teams.
Docs: forgejo/docs!1950
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11656
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
66 lines
1.7 KiB
Go
66 lines
1.7 KiB
Go
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package oauth2
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"forgejo.org/models/auth"
|
|
"forgejo.org/modules/json"
|
|
)
|
|
|
|
// Source holds configuration for the OAuth2 login source.
|
|
type Source struct {
|
|
Provider string
|
|
ClientID string
|
|
ClientSecret string
|
|
OpenIDConnectAutoDiscoveryURL string
|
|
CustomURLMapping *CustomURLMapping
|
|
IconURL string
|
|
|
|
Scopes []string
|
|
AttributeSSHPublicKey string
|
|
RequiredClaimName string
|
|
RequiredClaimValue string
|
|
GroupClaimName string
|
|
AdminGroup string
|
|
GroupTeamMap string
|
|
GroupTeamMapRemoval bool
|
|
DynGroupMaps string
|
|
DynGroupMapsRemoval bool
|
|
QuotaGroupClaimName string
|
|
QuotaGroupMap string
|
|
QuotaGroupMapRemoval bool
|
|
RestrictedGroup string
|
|
SkipLocalTwoFA bool `json:",omitempty"`
|
|
AllowUsernameChange bool
|
|
|
|
// reference to the authSource
|
|
authSource *auth.Source
|
|
}
|
|
|
|
// FromDB fills up an OAuth2Config from serialized format.
|
|
func (source *Source) FromDB(bs []byte) error {
|
|
return json.UnmarshalHandleDoubleEncode(bs, &source)
|
|
}
|
|
|
|
// ToDB exports an SMTPConfig to a serialized format.
|
|
func (source *Source) ToDB() ([]byte, error) {
|
|
return json.Marshal(source)
|
|
}
|
|
|
|
// ProvidesSSHKeys returns if this source provides SSH Keys
|
|
func (source *Source) ProvidesSSHKeys() bool {
|
|
return len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0
|
|
}
|
|
|
|
// SetAuthSource sets the related AuthSource
|
|
func (source *Source) SetAuthSource(authSource *auth.Source) {
|
|
source.authSource = authSource
|
|
}
|
|
|
|
func init() {
|
|
auth.RegisterTypeConfig(auth.OAuth2, &Source{})
|
|
}
|