search

Luzifer / nginx-sso

SSO authentication provider for the auth_request nginx module
Apache License 2.0
286 stars 41 forks source link

Is it possible to use OpenID roles/attributes? #60

Open bbigras opened 4 years ago

bbigras commented 4 years ago

I'm using keycloak for OpenID. I can create groups/roles and set attributes to users.

Is there any way to use those with the ACLs or maybe pass them to my application server with proxy pass?

Luzifer commented 4 years ago

This sounds like a specific implementation regarding to KeyCloak. The way to do this would be to implement a provider for KeyCloak and then using that. That provider could pass groups to the ACLs which are read from the server.

So: Generally speaking it's possible, right now - without the provider - it is not.

mxey commented 3 years ago

Groups or roles are provided as claims in the OIDC tokens (when asking the issuer for the appropiate scope). nginx-sso supports OIDC, but it does not provide the claims as groups for authorization. This is not specific to Keycloak as the issuer.