Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ocis] [FR] Import also groups from Keycloak #5538

Closed
ChrisEdS opened this issue Feb 9, 2023 · 11 comments
Closed

[ocis] [FR] Import also groups from Keycloak #5538

ChrisEdS opened this issue Feb 9, 2023 · 11 comments
Assignees
@rhafer
Labels
Category:Enhancement Add new functionality

Comments

@ChrisEdS
Copy link
Contributor

ChrisEdS commented Feb 9, 2023

Is your feature request related to a problem? Please describe.

If a Keycloak IdP is used for authentication, the groups from Keycloak could also be used for ownCloud.

Describe the solution you'd like

At the moment only the users from Keycloak are used in ownCloud, without LDAP/AD integration the groups have to be created manually in ownCloud, also the assignment of the users to the groups has to be done within ownCloud.

The solution would also be to import the groups from Keycloak and also respect the assignment of the users to the groups from Keycloak.
@michaelstingl
Copy link
Contributor

michaelstingl commented Feb 9, 2023 •
edited
Loading

SCIM? (RFC 7644)

Related:

@stale
Copy link

stale bot commented Apr 11, 2023

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 10 days if no further activity occurs. Thank you for your contributions.

@stale stale bot added the Status:Stale label Apr 11, 2023
@micbar
Copy link
Contributor

micbar commented Apr 13, 2023

This is already possible when you setup LDAP federation.

@stale stale bot removed the Status:Stale label Apr 13, 2023
@ChrisEdS
Copy link
Contributor Author

Yeah, well, my idea was to use only Keycloak for Groups und User Management

@micbar
Copy link
Contributor

micbar commented Apr 13, 2023

oCIS uses LDAP all the time. In the default it uses the built-in libreIDM. Maybe we could federate that?

@rhafer
Copy link
Contributor

rhafer commented Apr 13, 2023

I think was this request is referring to is to autoprovision group memberships similar to how we autoprovision users (and role assignments) upon first login when (for users PROXY_AUTOPROVISION_ACCOUNTS=true is needed). Keycloak (and other IDPs) is able to sent group the memberships via claims in the tokens/userinfo.

Adding support for this makes perfect sense IMO. We already discussed this before. Though we should probably first fix the remaining issues the user auto provisoning (like e.g. renames)

@stale
Copy link

stale bot commented Jun 15, 2023

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 10 days if no further activity occurs. Thank you for your contributions.

@stale stale bot added the Status:Stale label Jun 15, 2023
@stale
Copy link

stale bot commented Sep 16, 2023

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 10 days if no further activity occurs. Thank you for your contributions.

@stale stale bot added the Status:Stale label Sep 16, 2023
@rhafer rhafer added Category:Enhancement Add new functionality and removed Status:Stale labels Sep 18, 2023
@rhafer rhafer mentioned this issue Sep 25, 2023
Closed
@tbsbdr
Copy link
Contributor

tbsbdr commented Oct 31, 2023

PB1

  • @nicholas-wilson-au could you please ask the customer which protocol should be used in that case? (SCIM is not supported by keycloak)

@dragotin
Copy link
Contributor

Offering for SCIM for keycloak: https://scim-for-keycloak.de/

This was referenced Dec 14, 2023
Closed
Closed
@tbsbdr tbsbdr moved this from Qualification to Backlog in Infinite Scale Team Board Jun 13, 2024
@nabim777 nabim777 mentioned this issue Jun 14, 2024
Merged
8 tasks
@tbsbdr
Copy link
Contributor

tbsbdr commented Jun 17, 2024 •
edited
Loading

Acceptance Criteria

via oidc:

note

@micbar micbar changed the title [FR] Import also groups from Keycloak [ocis] [FR] Import also groups from Keycloak Jun 17, 2024
@rhafer rhafer moved this from Backlog to In progress in Infinite Scale Team Board Jun 18, 2024
@rhafer rhafer self-assigned this Jun 18, 2024
rhafer added a commit to rhafer/ocis that referenced this issue Jun 19, 2024
@rhafer
keycloak deployment: Add demo groups
c5ffb06 
Update the keycloak example to include the demo groups. Also add a new
client scope "groups" and enable for all owncloud clients.

Related issue: owncloud#5538
@rhafer rhafer mentioned this issue Jun 19, 2024
Merged
rhafer added a commit that referenced this issue Jun 19, 2024
@rhafer
keycloak deployment: Add demo groups
936d12f 
Update the keycloak example to include the demo groups. Also add a new
client scope "groups" and enable for all owncloud clients.

Related issue: #5538
ownclouders pushed a commit that referenced this issue Jun 19, 2024
@rhafer
keycloak deployment: Add demo groups
0d76f19 
Update the keycloak example to include the demo groups. Also add a new
client scope "groups" and enable for all owncloud clients.

Related issue: #5538
rhafer added a commit to rhafer/ocis that referenced this issue Jul 2, 2024
@rhafer
autoprovisioning: sync group memberships
dba52c9 
Add support for autoprovisioning group memberships from OIDC claims.
Users are added to and removed from groups based on the value of an OIDC
claim. If a group does not exist, it is created.

Closes: owncloud#5538
rhafer added a commit to rhafer/ocis that referenced this issue Jul 2, 2024
@rhafer
autoprovisioning: sync group memberships
12e3465 
Add support for autoprovisioning group memberships from OIDC claims.
Users are added to and removed from groups based on the value of an OIDC
claim. If a group does not exist, it is created.

Closes: owncloud#5538
rhafer added a commit to rhafer/ocis that referenced this issue Jul 2, 2024
@rhafer
autoprovisioning: sync group memberships
e43474a 
Add support for autoprovisioning group memberships from OIDC claims.
Users are added to and removed from groups based on the value of an OIDC
claim. If a group does not exist, it is created.

Closes: owncloud#5538
rhafer added a commit to rhafer/ocis that referenced this issue Jul 4, 2024
@rhafer
autoprovisioning: sync group memberships
5833fc5 
Add support for autoprovisioning group memberships from OIDC claims.
Users are added to and removed from groups based on the value of an OIDC
claim. If a group does not exist, it is created.

Closes: owncloud#5538
rhafer added a commit to rhafer/ocis that referenced this issue Jul 8, 2024
@rhafer
autoprovisioning: sync group memberships
148bf4c 
Add support for autoprovisioning group memberships from OIDC claims.
Users are added to and removed from groups based on the value of an OIDC
claim. If a group does not exist, it is created.

Closes: owncloud#5538
@micbar micbar closed this as completed in 0d65908 Jul 8, 2024
@github-project-automation github-project-automation bot moved this from In progress to Done in Infinite Scale Team Board Jul 8, 2024
@amrita-shrestha amrita-shrestha mentioned this issue Sep 18, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rhafer rhafer

Labels
Category:Enhancement Add new functionality
Projects
Infinite Scale Team Board
Status: Done
Milestone
No milestone
Development

No branches or pull requests
6 participants
@michaelstingl @rhafer @dragotin @micbar @tbsbdr @ChrisEdS