search

owncloud / ocis

:atom_symbol: ownCloud Infinite Scale Stack
https://doc.owncloud.com/ocis/next/
Apache License 2.0
1.41k stars 184 forks source link

[ocis] [FR] Import also groups from Keycloak #5538

Closed ChrisEdS closed 4 months ago

ChrisEdS commented 1 year ago

Is your feature request related to a problem? Please describe.

If a Keycloak IdP is used for authentication, the groups from Keycloak could also be used for ownCloud.

Describe the solution you'd like

At the moment only the users from Keycloak are used in ownCloud, without LDAP/AD integration the groups have to be created manually in ownCloud, also the assignment of the users to the groups has to be done within ownCloud.

The solution would also be to import the groups from Keycloak and also respect the assignment of the users to the groups from Keycloak.

michaelstingl commented 1 year ago

SCIM? (RFC 7644)

Related:

stale[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 10 days if no further activity occurs. Thank you for your contributions.

micbar commented 1 year ago

This is already possible when you setup LDAP federation.

ChrisEdS commented 1 year ago

Yeah, well, my idea was to use only Keycloak for Groups und User Management

micbar commented 1 year ago

oCIS uses LDAP all the time. In the default it uses the built-in libreIDM. Maybe we could federate that?

rhafer commented 1 year ago

I think was this request is referring to is to autoprovision group memberships similar to how we autoprovision users (and role assignments) upon first login when (for users PROXY_AUTOPROVISION_ACCOUNTS=true is needed). Keycloak (and other IDPs) is able to sent group the memberships via claims in the tokens/userinfo.

Adding support for this makes perfect sense IMO. We already discussed this before. Though we should probably first fix the remaining issues the user auto provisoning (like e.g. renames)

stale[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 10 days if no further activity occurs. Thank you for your contributions.

stale[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 10 days if no further activity occurs. Thank you for your contributions.

tbsbdr commented 1 year ago

PB1

dragotin commented 1 year ago

Offering for SCIM for keycloak: https://scim-for-keycloak.de/

tbsbdr commented 5 months ago

Acceptance Criteria

via oidc:

note