Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FR] Add role/group mapping for oidc authentication #713

Open
Ch1mCh4 opened this issue Feb 7, 2025 · 0 comments
Open

[FR] Add role/group mapping for oidc authentication #713

Ch1mCh4 opened this issue Feb 7, 2025 · 0 comments
Labels
enhancement New feature or request

Comments

@Ch1mCh4
Copy link

Ch1mCh4 commented Feb 7, 2025

Is your feature request related to a problem? Please describe.
Currently, DFIR-IRIS only maps the OIDC user information to USERNAME and EMAIL environment variables. However, there is no mechanism to automatically map user roles/groups from OIDC. This means that user group assignments must be manually configured after user creation, which is inefficient and requires additional administrative effort.

Describe the solution you'd like
Introduce a new environment variable OIDC_MAPPING_USERGROUP, which maps to a key provided by the OIDC authentication response that contains the user's group or role information.

  • This variable should be used to determine the group membership of a user.
  • If a new user is created, they should automatically be assigned to the appropriate group based on this value.
  • If an existing user logs in and their role has changed, the group assignment should be updated accordingly.

This would streamline user management by ensuring that role-based access control is dynamically handled via OIDC.

Describe alternatives you've considered

Manually assigning users to groups after creation, which is time-consuming and error-prone.

Additional context

we work with iris in a kubernetes cluster which provides an oidc provider via keycloak through which users can authenticate themselves to various applications (including iris). The users can be assigned a role such as administrator or analyst in keycloak which is then taken over by the applications.

@Ch1mCh4 Ch1mCh4 added the enhancement New feature or request label Feb 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant