opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: add warning log if misconfigured groups oidc (#7874)

Browse Source 
* chore: add warning log if misconfigured groups oidc

This is not perfect, but if we find a 'groups' claim and it is not
configured, put out a warning log to give some information
This commit is contained in:
Steven Masley
2023-06-08 08:51:59 -05:00
committed by GitHub
parent 479467473e
commit b2324325fa
6 changed files with 22 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/auth.md
+10 -1
View File
@@ -231,7 +231,7 @@ CODER_TLS_CLIENT_KEY_FILE=/path/to/key.pem
If your OpenID Connect provider supports group claims, you can configure Coder
to synchronize groups in your auth provider to groups within Coder.
To enable group sync, ensure that the `groups` claim is set. If group sync is
To enable group sync, ensure that the `groups` claim is set by adding the correct scope to request. If group sync is
enabled, the user's groups will be controlled by the OIDC provider. This means
manual group additions/removals will be overwritten on the next login.
@@ -242,6 +242,15 @@ CODER_OIDC_SCOPES=openid,profile,email,groups
--oidc-scopes openid,profile,email,groups
```
With the `groups` scope requested, we also need to map the `groups` claim name. Coder recommends using `groups` for the claim name. This step is necessary if your **scope's name** is something other than `groups`.
```console
# as an environment variable
CODER_OIDC_GROUP_FIELD=groups
# as a flag
--oidc-group-field groups
```
On login, users will automatically be assigned to groups that have matching
names in Coder and removed from groups that the user no longer belongs to.