I configured in the core organization (A) the OIDC provider and connected it to a nextcloud user_oidc client. Additionally I mapped the roles required in nextcloud in the client settings. This includes roles of dependent organizations (B). But the roles of organization B are not provided to nextcloud.
Describe the solution you'd like
For our use case, best would be to allow steering the behavior via the client settings:
- In the core organization (A) settings, the following sections allow to select dependent organization (B) entries for: Included groups/roles and Restrict Access to Roles
Option A
- I think this is good, as it is flexible and keep it, but when a dependent organization (B) role is selected a toggle should become available to explicitly allow / replicate that roles towards the client. If this toggle is not switched on, it should not be allowed to store it, as it does not add value.
Option B
- It could also be designed the other way around, to make it more clear: add a toggle "enable to transmit roles of other organizations", then in a checklist, mark the organizations to be included in the scope. Then filter the roles and attributes list for the the ones available in the organization.
Side note:
- I haven't tested to login with a Org B roles only profile which exists in Org A, but assume it would fail. As the role B is currently not provided, even though the client settings allow login.
- When I try to login to nextcloud using the Org B, it results in {"error":"OIDC service setup failed: Invalid key supplied"}...which is fine as it is not setup.
Describe alternatives you've considered
When looking into the dependent organization (B) settings, I can configure also there an OIDC provider / client. I don't want to pursue this path, because it will create non-unique users on nextcloud. I want to follow the recommendation of unique id's per identity provider, as it is more future save. Currently I use the https://github.com/nextcloud/user_oidc app, uuid as id so it is resilient from name changes and the provider prefix setting.
I configured in the core organization (A) the OIDC provider and connected it to a nextcloud user_oidc client. Additionally I mapped the roles required in nextcloud in the client settings. This includes roles of dependent organizations (B). But the roles of organization B are not provided to nextcloud.
Describe the solution you'd like
For our use case, best would be to allow steering the behavior via the client settings:
Option A
Option B
Side note:
Describe alternatives you've considered
When looking into the dependent organization (B) settings, I can configure also there an OIDC provider / client. I don't want to pursue this path, because it will create non-unique users on nextcloud. I want to follow the recommendation of unique id's per identity provider, as it is more future save. Currently I use the https://github.com/nextcloud/user_oidc app, uuid as id so it is resilient from name changes and the provider prefix setting.