search

dexidp / dex

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors
https://dexidp.io
Apache License 2.0
9.4k stars 1.69k forks source link

google connector: support group claim on JWT #3448

Open zufardhiyaulhaq opened 6 months ago

zufardhiyaulhaq commented 6 months ago

Preflight Checklist

Problem Description

Since dex can gather all Google groups that belong to a user. we can extend the functionality to also support group claims on the JWT, even Google doesn't support this.

Currently, dex is only able to whitelist before sending the JWT to the user.

by adding a google group list on the JWT, we can further filter from the application side or from a proxy that supports JWT verification.

Proposed Solution

from the codebase, we can enforce this. but need help to make it configurable. this is some workaround that I did when forking the dex https://github.com/dexidp/dex/pull/3449

Alternatives Considered

N/A

Additional Information

N/A

zufardhiyaulhaq commented 5 months ago

Hi @nabokihms I am not sure which one should I tag,

I believe this is good feature since we can implement RBAC based on google group when extracting JWT from client on 3rd party gateway,