Dec 8, 2023 · Dec 6, 2023 · Dec 6, 2023 · Dec 6, 2023 · Dec 6, 2023 · Dec 6, 2023
diff --git a/cli/server.go b/cli/server.go
 IgnoreUserInfo:      vals.OIDC.IgnoreUserInfo.Value(),
 GroupField:          vals.OIDC.GroupField.String(),
 GroupFilter:         vals.OIDC.GroupRegexFilter.Value(),
 GroupAllowList:      vals.OIDC.GroupAllowList.Value(),
 CreateMissingGroups: vals.OIDC.GroupAutoCreate.Value(),
 GroupMapping:        vals.OIDC.GroupMapping.Value,
 UserRoleField:       vals.OIDC.UserRoleField.String(),
diff --git a/coderd/userauth.go b/coderd/userauth.go
 // the OIDC provider. Any group not matched by this regex will be ignored.
 // If the group filter is nil, then no group filtering will occur.
 GroupFilter *regexp.Regexp
 // GroupAllowList is a list of groups that are allowed to log in.
 // If the list length is 0, then the allow list will not be applied and
 // this feature is disabled.
 GroupAllowList []string
 // GroupMapping controls how groups returned by the OIDC provider get mapped
 // to groups within Coder.
 // map[oidcGroupName]coderGroupName
 // If the GroupField is the empty string, then groups from OIDC are not used.
 // This is so we can support manual group assignment.
 if api.OIDCConfig.GroupField != "" {
 // allow list is a map of groups that are allowed to log in.
 allowed := make(map[string]bool)
 for _, group := range api.OIDCConfig.GroupAllowList {
 allowed[group] = true
 }
 // If the allow list is empty, then the user is allowed to log in.
 // Otherwise, they must belong to at least 1 group in the allow list.
 inAllowList := len(allowed) == 0

 usingGroups = true
 groupsRaw, ok := mergedClaims[api.OIDCConfig.GroupField]
 if ok {
 if mappedGroup, ok := api.OIDCConfig.GroupMapping[group]; ok {
 group = mappedGroup
 }
 if _, ok := allowed[group]; ok {
 inAllowList = true
 }
 groups = append(groups, group)
 }
 }

 if !inAllowList {
 return usingGroups, groups, &httpError{
 code:             http.StatusForbidden,
 msg:              "You aren't a member of an authorized group!",
 detail:           fmt.Sprintf("You must be a member of one of the following groups: %v", api.OIDCConfig.GroupAllowList),
 renderStaticPage: false,
 }
 }
 }

 // This conditional is purely to warn the user they might have misconfigured their OIDC
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
 IgnoreUserInfo      clibase.Bool                        `json:"ignore_user_info" typescript:",notnull"`
 GroupAutoCreate     clibase.Bool                        `json:"group_auto_create" typescript:",notnull"`
 GroupRegexFilter    clibase.Regexp                      `json:"group_regex_filter" typescript:",notnull"`
 GroupAllowList      clibase.StringArray                 `json:"group_allow_list" typescript:",notnull"`
 GroupField          clibase.String                      `json:"groups_field" typescript:",notnull"`
 GroupMapping        clibase.Struct[map[string]string]   `json:"group_mapping" typescript:",notnull"`
 UserRoleField       clibase.String                      `json:"user_role_field" typescript:",notnull"`
 Group:       &deploymentGroupOIDC,
 YAML:        "groupRegexFilter",
 },
 {
 Name:        "OIDC Allowed Groups",
 Description: "If provided any group name not in the list will not be allowed to authenticate. This allows for restricting access to a specific set of groups. This filter is applied after the group mapping and before the regex filter.",
 Flag:        "oidc-allowed-groups",
 Env:         "CODER_OIDC_ALLOWED_GROUPS",
 Default:     "",
 Value:       &c.OIDC.GroupAllowList,
 Group:       &deploymentGroupOIDC,
 YAML:        "groupAllowed",
 },
 {
 Name:        "OIDC User Role Field",
 Description: "This field must be set if using the user roles sync feature. Set this to the name of the claim used to store the user's role. The roles should be sent as an array of strings.",
Original file line number	Diff line number	Diff line change
Expand Up		@@ -161,6 +161,7 @@ func createOIDCConfig(ctx context.Context, vals codersdk.DeploymentValues) (co
		IgnoreUserInfo: vals.OIDC.IgnoreUserInfo.Value(),
		GroupField: vals.OIDC.GroupField.String(),
		GroupFilter: vals.OIDC.GroupRegexFilter.Value(),
		GroupAllowList: vals.OIDC.GroupAllowList.Value(),
		CreateMissingGroups: vals.OIDC.GroupAutoCreate.Value(),
		GroupMapping: vals.OIDC.GroupMapping.Value,
		UserRoleField: vals.OIDC.UserRoleField.String(),
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -701,6 +701,10 @@ type OIDCConfig struct {
		// the OIDC provider. Any group not matched by this regex will be ignored.
		// If the group filter is nil, then no group filtering will occur.
		GroupFilter *regexp.Regexp
		// GroupAllowList is a list of groups that are allowed to log in.
		// If the list length is 0, then the allow list will not be applied and
		// this feature is disabled.
		GroupAllowList []string
Emyrk marked this conversation as resolved. Show resolvedHide resolved
		// GroupMapping controls how groups returned by the OIDC provider get mapped
		// to groups within Coder.
		// map[oidcGroupName]coderGroupName
Expand DownExpand Up		@@ -1014,6 +1018,15 @@ func (api *API) oidcGroups(ctx context.Context, mergedClaims map[string]interfac
		// If the GroupField is the empty string, then groups from OIDC are not used.
		// This is so we can support manual group assignment.
		if api.OIDCConfig.GroupField != "" {
		// allow list is a map of groups that are allowed to log in.
		allowed := make(map[string]bool)
		for _, group := range api.OIDCConfig.GroupAllowList {
		allowed[group] = true
		}
		// If the allow list is empty, then the user is allowed to log in.
		// Otherwise, they must belong to at least 1 group in the allow list.
		inAllowList := len(allowed) == 0
Emyrk marked this conversation as resolved. Show resolvedHide resolved

		usingGroups = true
		groupsRaw, ok := mergedClaims[api.OIDCConfig.GroupField]
		if ok {
Expand All		@@ -1040,9 +1053,21 @@ func (api *API) oidcGroups(ctx context.Context, mergedClaims map[string]interfac
		if mappedGroup, ok := api.OIDCConfig.GroupMapping[group]; ok {
		group = mappedGroup
		}
		if _, ok := allowed[group]; ok {
		inAllowList = true
		}
		groups = append(groups, group)
		}
		}

		if !inAllowList {
		return usingGroups, groups, &httpError{
		code: http.StatusForbidden,
		msg: "You aren't a member of an authorized group!",
		detail: fmt.Sprintf("You must be a member of one of the following groups: %v", api.OIDCConfig.GroupAllowList),
		renderStaticPage: false,
		}
		}
		}

		// This conditional is purely to warn the user they might have misconfigured their OIDC
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -291,6 +291,7 @@ type OIDCConfig struct {
		IgnoreUserInfo clibase.Bool `json:"ignore_user_info" typescript:",notnull"`
		GroupAutoCreate clibase.Bool `json:"group_auto_create" typescript:",notnull"`
		GroupRegexFilter clibase.Regexp `json:"group_regex_filter" typescript:",notnull"`
		GroupAllowList clibase.StringArray `json:"group_allow_list" typescript:",notnull"`
		GroupField clibase.String `json:"groups_field" typescript:",notnull"`
		GroupMapping clibase.Struct[map[string]string] `json:"group_mapping" typescript:",notnull"`
		UserRoleField clibase.String `json:"user_role_field" typescript:",notnull"`
Expand DownExpand Up		@@ -1187,6 +1188,16 @@ when required by your organization's security policy.`,
		Group: &deploymentGroupOIDC,
		YAML: "groupRegexFilter",
		},
		{
		Name: "OIDC Allowed Groups",
		Description: "If provided any group name not in the list will not be allowed to authenticate. This allows for restricting access to a specific set of groups. This filter is applied after the group mapping and before the regex filter.",
		Flag: "oidc-allowed-groups",
		Env: "CODER_OIDC_ALLOWED_GROUPS",
		Default: "",
		Value: &c.OIDC.GroupAllowList,
		Group: &deploymentGroupOIDC,
		YAML: "groupAllowed",
		},
		{
		Name: "OIDC User Role Field",
		Description: "This field must be set if using the user roles sync feature. Set this to the name of the claim used to store the user's role. The roles should be sent as an array of strings.",
Expand Down