Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitdb5a8aa

Browse files
committed
feat: group allow list in OIDC settings
Users not in the group allowlist cannot authenticate with Coder.
1 parent726e7b1 commitdb5a8aa

File tree

3 files changed

+37
-0
lines changed

3 files changed

+37
-0
lines changed

‎cli/server.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,7 @@ func createOIDCConfig(ctx context.Context, vals *codersdk.DeploymentValues) (*co
161161
IgnoreUserInfo:vals.OIDC.IgnoreUserInfo.Value(),
162162
GroupField:vals.OIDC.GroupField.String(),
163163
GroupFilter:vals.OIDC.GroupRegexFilter.Value(),
164+
GroupAllowList:vals.OIDC.GroupAllowList.Value(),
164165
CreateMissingGroups:vals.OIDC.GroupAutoCreate.Value(),
165166
GroupMapping:vals.OIDC.GroupMapping.Value,
166167
UserRoleField:vals.OIDC.UserRoleField.String(),

‎coderd/userauth.go

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -701,6 +701,10 @@ type OIDCConfig struct {
701701
// the OIDC provider. Any group not matched by this regex will be ignored.
702702
// If the group filter is nil, then no group filtering will occur.
703703
GroupFilter*regexp.Regexp
704+
// GroupAllowList is a list of groups that are allowed to log in.
705+
// If the list length is 0, then the allow list will not be applied and
706+
// this feature is disabled.
707+
GroupAllowList []string
704708
// GroupMapping controls how groups returned by the OIDC provider get mapped
705709
// to groups within Coder.
706710
// map[oidcGroupName]coderGroupName
@@ -1014,6 +1018,15 @@ func (api *API) oidcGroups(ctx context.Context, mergedClaims map[string]interfac
10141018
// If the GroupField is the empty string, then groups from OIDC are not used.
10151019
// This is so we can support manual group assignment.
10161020
ifapi.OIDCConfig.GroupField!="" {
1021+
// allow list is a map of groups that are allowed to log in.
1022+
allowed:=make(map[string]bool)
1023+
for_,group:=rangeapi.OIDCConfig.GroupAllowList {
1024+
allowed[group]=true
1025+
}
1026+
// If the allow list is empty, then the user is allowed to log in.
1027+
// Otherwise, they must belong to at least 1 group in the allow list.
1028+
inAllowList:=len(allowed)==0
1029+
10171030
usingGroups=true
10181031
groupsRaw,ok:=mergedClaims[api.OIDCConfig.GroupField]
10191032
ifok {
@@ -1040,9 +1053,21 @@ func (api *API) oidcGroups(ctx context.Context, mergedClaims map[string]interfac
10401053
ifmappedGroup,ok:=api.OIDCConfig.GroupMapping[group];ok {
10411054
group=mappedGroup
10421055
}
1056+
if_,ok:=allowed[group];ok {
1057+
inAllowList=true
1058+
}
10431059
groups=append(groups,group)
10441060
}
10451061
}
1062+
1063+
if!inAllowList {
1064+
returnusingGroups,groups,&httpError{
1065+
code:http.StatusForbidden,
1066+
msg:"You aren't a member of an authorized group!",
1067+
detail:fmt.Sprintf("You must be a member of one of the following groups: %v",api.OIDCConfig.GroupAllowList),
1068+
renderStaticPage:false,
1069+
}
1070+
}
10461071
}
10471072

10481073
// This conditional is purely to warn the user they might have misconfigured their OIDC

‎codersdk/deployment.go

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -291,6 +291,7 @@ type OIDCConfig struct {
291291
IgnoreUserInfo clibase.Bool`json:"ignore_user_info" typescript:",notnull"`
292292
GroupAutoCreate clibase.Bool`json:"group_auto_create" typescript:",notnull"`
293293
GroupRegexFilter clibase.Regexp`json:"group_regex_filter" typescript:",notnull"`
294+
GroupAllowList clibase.StringArray`json:"group_allow_list" typescript:",notnull"`
294295
GroupField clibase.String`json:"groups_field" typescript:",notnull"`
295296
GroupMapping clibase.Struct[map[string]string]`json:"group_mapping" typescript:",notnull"`
296297
UserRoleField clibase.String`json:"user_role_field" typescript:",notnull"`
@@ -1187,6 +1188,16 @@ when required by your organization's security policy.`,
11871188
Group:&deploymentGroupOIDC,
11881189
YAML:"groupRegexFilter",
11891190
},
1191+
{
1192+
Name:"OIDC Allowed Groups",
1193+
Description:"If provided any group name not in the list will not be allowed to authenticate. This allows for restricting access to a specific set of groups. This filter is applied after the group mapping and before the regex filter.",
1194+
Flag:"oidc-allowed-groups",
1195+
Env:"CODER_OIDC_ALLOWED_GROUPS",
1196+
Default:"",
1197+
Value:&c.OIDC.GroupAllowList,
1198+
Group:&deploymentGroupOIDC,
1199+
YAML:"groupAllowed",
1200+
},
11901201
{
11911202
Name:"OIDC User Role Field",
11921203
Description:"This field must be set if using the user roles sync feature. Set this to the name of the claim used to store the user's role. The roles should be sent as an array of strings.",

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp