[QUESTION] OIDC User and Group Admin differentiation

[dasunsrule32]

Question

Is there a way to differentiate admins and users when using OIDC? Is it possible to assign a configuration of type: admin to an OIDC user or group? Not sure if that is implemented or not. Thank you.

@twsouthwick

Category

Authentication

Please tick the boxes

• [X] You are using a supported version of Dashy (check the first two digits of the version number)
• [X] You've checked that this question hasn't already been raised
• [X] You've checked the docs and troubleshooting guide
• [X] You agree to the code of conduct

[dasunsrule32]

Is there a way to get DEBUG logs to dump to the container logs? I'm trying to dump exactly what is being consumed by Dashy when an OIDC account logs in. Maybe I can try assigning a type to what Dashy sees the email, username, etc as a type: admin. Might work..

[CrazyWolf13]

For me it always worked to intercept the URL from auth-server right before logging in into dashy, then you can decode this with I think https://jwt.io/ and you will see which data gets provided to dashy

Edit: this is not working for me for dashy, possibly due to the public client in the oidc specs, sorry.

[dasunsrule32]

I looked at the code and the default scope is: openid profile email roles groups. So the data is definitely there as long as it isn't overwritten by a custom scope in the conf.yml.

https://github.com/Lissy93/dashy/blob/master/src/utils/OidcAuth.js#L23

With the way I configured it in the docs, the following is a sample of data being sent to Dashy from authentik:

{
    "iss": "https://auth.domain.com/application/o/dashy/",
    "sub": "*********************",
    "aud": "************************",
    "exp": **********,
    "iat": *************,
    "auth_time": *****************,
    "acr": "goauthentik.io/providers/oauth2/default",
    "amr": [
        "user",
        "mfa"
    ],
    "email": "test@domain.com",
    "email_verified": true,
    "name": "Test User",
    "given_name": "Test User",
    "preferred_username": "test",
    "nickname": "test",
    "groups": [
        "authentik Admins",
        "Cloudflare Users",
        "pgAdmin Admins",
        "KASM Admins",
        "TrueNAS SCALE Admins",
        "Mealie Admins",
        "Mealie Users",
        "Dashy Admins"
    ]
}