Background

For GitHub, we havehttps://coder.com/docs/v2/latest/cli/server#--oauth2-github-allowed-orgs andhttps://coder.com/docs/v2/latest/cli/server#--oauth2-github-allowed-teams that only allows a subset of GitHub users to log in to Coder.

We do not have something similar for OIDC log ins.

Proposal

• Add CODER_OIDC_ALLOWED_GROUPS which accepts a list of strings (group names).
• If a user is not in any of the groups, display an error, similar to the GitHub one
• Usehttps://coder.com/docs/v2/latest/cli/server#--oidc-group-field to define which groups claim is used to validate against
• Display a proper error/warning in the server if the claim is not being sent, similar to how we do for group sync