search

dexidp / dex

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors
https://dexidp.io
Apache License 2.0
9.33k stars 1.68k forks source link

groups: add a concept of a directory of users #175

Closed philips closed 7 years ago

philips commented 8 years ago

Teams are a fairly essential part of an identity service. Unfortunately, OIDC doesn't have a spec for that. The basic operations are:

The two obvious APIs to copy from are either Google or GitHub's.

GitHub teams: https://developer.github.com/v3/orgs/teams/#list-teams Google Directory Groups: https://developers.google.com/admin-sdk/directory/v1/guides/manage-groups

The motivation for groups is to give very coarse grained ACLs to a set of identities. For example I want to restrict a service inside of my cluster to a particular team by providing config to oauth2_proxy: https://github.com/bitly/oauth2_proxy#restrict-auth-to-specific-google-groups-on-your-domain-optional

stepanstipl commented 8 years ago

+1

philips commented 8 years ago

Here is an initial design doc: https://docs.google.com/document/d/1OCKW-8rBCngBFWMMrSGokKqWt-a8lg3WvfrejcETBMA/edit#heading=h.9kkruegwavaf

rsoletob commented 8 years ago

Hello, we are interested in this topic. We have an administration tool for managing users and groups but it doesn't scale well, and we want to adopt an open-source project. We've seen that you're planning to test Cayley + SCIM, according to the Google docs proposal, but we don't know if you have already made some progress on this. Any news on this? Maybe you can share with us a roadmap?

If the solution suits well with our project, we are keen on helping you with this feature.

ping @adrianlop, @miguelcubillo, @gerson24

ericchiang commented 8 years ago

@rsoletob our roadmap is here. Once we've addressed refresh tokens we'll start taking a serious look into groups.

We'll make sure to update this issue with progress. If you have any comments or concerns, we'd love additional input.

fnordahl commented 8 years ago

Connectors should probably also optionally support groups/authorization and be allowed to be a source of this information for dex in some way? The LDAP connector ( #178 ) could be a candidate for this.

ericchiang commented 8 years ago

@fnordahl Just like a local vs remote connector, I think we'll attempt to build some interface for a remote group source. And yes, since LDAP already has these concepts it would be a likely candidate.

ericchiang commented 7 years ago

Dex does not have a native groups implementation, but can pull groups from upstream IDPs. I think this is fine for now.

mvbn6789 commented 3 years ago

so dex will not support multi tenant ?