groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-12 20:31:36 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add configurable OIDC group-to-role mapping

Browse source 
Currently OIDC group-based role assignment only recognizes groups named
'admin', 'user', or 'guest' (case-insensitive), and denies login when a
user's groups match none of them. This makes group-based roles unusable
with identity providers whose group names differ, and offers no way to
admit such users with a default role.

Add two optional server settings:
- authOpenIDAdminGroups: comma-separated group names mapped to the admin
  role, in addition to the built-in names.
- authOpenIDGroupDefaultRole: role assigned when no group matches,
  instead of denying login.

Both default to empty, preserving current behavior. Includes the auth
settings UI fields, en-us strings, and unit tests for setUserGroup.
This commit is contained in:
Boris Rybalkin 2026-06-06 19:02:17 +01:00
parent cbda0360aa
commit d6cfdd3bec
5 changed files with 108 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
server/auth/OidcAuthStrategy.js
View file

@ -192,10 +192,12 @@ class OidcAuthStrategy {
if (!userinfo[groupClaimName]) throw new Error(`Group claim ${groupClaimName} not found in userinfo`)
const groupsList = userinfo[groupClaimName].map((group) => group.toLowerCase())
const adminGroups = (Database.serverSettings.authOpenIDAdminGroups || '').split(',').map((group) => group.trim().toLowerCase()).filter(Boolean)
const groupsList = userinfo[groupClaimName].map((group) => group.toLowerCase()).map((group) => (adminGroups.includes(group) ? 'admin' : group))
const rolesInOrderOfPriority = ['admin', 'user', 'guest']
let userType = rolesInOrderOfPriority.find((role) => groupsList.includes(role))
const defaultRole = (Database.serverSettings.authOpenIDGroupDefaultRole || '').toLowerCase()
let userType = rolesInOrderOfPriority.find((role) => groupsList.includes(role)) || (rolesInOrderOfPriority.includes(defaultRole) ? defaultRole : undefined)
if (userType) {
if (user.type === 'root') {
// Check OpenID Group