Implement proper group mapping via SAML #659
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes nextcloud#561 As stated in the issue, it's not desirable to have a group called `admin` in the SAML backend which doesn't indicate to which service admin permissions are granted. This is orthogonal to `saml-attribute-mapping-group_mapping` which simply maps all groups from a SAML attribute to Nextcloud groups, i.e. the attribute's value MUST contain a group called `admin` to make sure that users get admin rights in Nextcloud. When enabled, the name of (another) attribute must be specified which contains a list of SAML-specific groups, e.g. ["nextcloud-admins", "nextcloud-marketing"] that can be mapped to e.g. ["admin", "marketing"] Signed-off-by: Maximilian Bosch <[email protected]>
Ma27
force-pushed
the
group-mappings
branch
from
306a852 to
6d0420c
Compare
|
Did you see #545 which is being in development? |
|
OK interesting, this wasn't referenced in #561. Woudl be interested in knowing the use-case behind that, though :) |
7 tasks
|
Closing due to lack of interest. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #561
As stated in the issue, it's not desirable to have a group called
adminin the SAML backend which doesn't indicate to which service admin permissions are granted.This is orthogonal to
saml-attribute-mapping-group_mappingwhich simply maps all groups from a SAML attribute to Nextcloud groups, i.e. the attribute's value MUST contain a group calledadminto make sure that users get admin rights in Nextcloud.When enabled, the name of (another) attribute must be specified which contains a list of SAML-specific groups, e.g.
that can be mapped to e.g.
cc @jgallucci32, @kevinmccurdybrd, @blizzz