search

nextcloud / user_saml

:lock: App for authenticating Nextcloud users using SAML https://apps.nextcloud.com/apps/user_saml
https://portal.nextcloud.com/article/configuring-single-sign-on-10.html
GNU Affero General Public License v3.0
96 stars 76 forks source link

SAML-based admin group membership not possible since v6 #813

Open blizzz opened 9 months ago

blizzz commented 9 months ago

I updated SAML plugin to v6.1 (It seems it can't be reverted back anymore). Now we have two admin groups. I think one is local admin groups with super admin users, and the other one SAML_admin with the users from SAML. This broke admin group assignments. Is there no way to make a SAML user super admin anymore with the new Group Backend?

_Originally posted by @GaugeTheory in https://github.com/nextcloud/user_saml/issues/810#issuecomment-1956680641_

blizzz commented 9 months ago

On the hand it could be considered acceptable for a group called "admin" to not create an own one. But removal would not work. Instead of having exceptions, it's better to implement IIsAdmin interface, so that the SAML backend can say itself who is admin and who not. Would need yet another setting field to declare the admin group(s).