[pve-devel] [PATCH SERIES openid/access-control/docs/manager] fix #4411: add support for openid groups

[Mira Limbeck]

On 9/1/24 18:55, Thomas Skinner wrote:
> This patch series adds support for groups for OpenID logins. 
> 
> The following options are implemented:
>   - Configurable claim for retrieving a list of groups and adding them to the 
>     user in PVE
>   - Allowing "synchronization" of groups on login by overriding groups assigned
>     to the user in PVE (this option is off by default)
>   - Replacing invalid characters in group names with a configurable valid characters
>     (by default, this is an underscore '_')
> 
> The logic implemented by this patch expects the groups claim in the ID token/userinfo
> endpoint to send a list of groups.
> 
> This patch also adds support for using additional claims from the OpenID provider
> by exposing all additional claims and their values from the ID token (previously
> only available for the userinfo endpoint). This is necessary for OpenID providers
> that do not support additional information in the userinfo endpoint.

I did a small test of this patch series with a Keycloak 17 as provider.

For the test I added a `Client Scope` in the realm with the predefined
mapper `groups'. The user info can then be checked under Realm -> Client
Scope -> Evaluate -> (select user, evaluate) -> Generated User Info


Tests done:

1)
* no groups defined in PVE
* realm configured with:
  - Groups Claim: `groups`
  - Overwrite Groups: true
* user in keycloak configured with groups: group1, group2, group3
* login with user
* no groups created and/or assigned to the user (missing 3 groups)

2)
* group1 defined in PVE
* realm configured with:
  - Groups Claim: `groups`
  - Overwrite Groups: true
* user in keycloak configured with groups: group1, group2, group3
* login with user
* user was assigned the group1 (missing 2 others)

3)
* group2 defined in PVE
* realm configured with:
  - Groups Claim: `groups`
  - Overwrite Groups: true
* user in keycloak configured with groups: group1, group2, group3
* login with user
* group was switched from group1 to group2

4)
* group1, group2 defined in PVE
* realm configured with:
  - Groups Claim: `groups`
  - Overwrite Groups: false
* user in keycloak configured with groups: group1, group3
* login with user
* group1 was added, group2 was kept

5)
* group1, group2 defined in PVE
* realm configured with:
  - Groups Claim: none (default)
  - Overwrite Groups: <any>
* user in keycloak configured with groups: group1, group2, group3
* login with user
* no changes


It seemed to work reliably once Keycloak was configured correctly. One
thing that was confusing, even with `Overwrite Groups` no groups are set
if they aren't already configured on the PVE cluster.

I haven't tested the character replacement yet.