fix: add groups scope to OAuth2 OpenID Connect configuration#62
fix: add groups scope to OAuth2 OpenID Connect configuration#62rcdailey wants to merge 1 commit intoopencloud-eu:mainfrom
Conversation
The groups scope is required for proper role-based access control (RBAC) with OIDC providers like Authelia, Keycloak, and Authentik. Without it, these providers cannot return group membership claims in the UserInfo response, preventing applications from implementing proper authorization. This change adds "groups" to the oauth2_openid_scope string resource, enabling OIDC providers to return group information when supported. The change is backward compatible as providers ignore unsupported scopes per the OIDC specification.
|
Looking at a similar PR for the desktop app: opencloud-eu/desktop#336 It seems that the chances of this being accepted will be very low. @samolego had a valid question there that went unanswered:
It would be nice to have the answer to that. In the meantime, I'd be happy to explore the solution @butonic recommended in this comment. I assume this would apply to all clients, not just the desktop one. Eager to get feedback from the maintainers. |
Are you sure about that? This also seems to be a problem in practice: opencloud-eu/desktop#336 (comment) |
|
Added "DO NOT MERGE" label for now as per @butonic 's statement
Related: See also opencloud-eu/desktop#246 (comment) |
guruz
left a comment
guruz
left a comment
There was a problem hiding this comment.
See comment above. Placeholder PR.
3 participants
Summary
Adds the
groupsscope to the OAuth2 OpenID Connect configuration to enable role-based access control (RBAC) with OIDC providers.Changes
groupstooauth2_openid_scopeinopencloudApp/src/main/res/values/setup.xmlContext
The
groupsscope is a de facto standard across major OIDC providers (Authelia, Keycloak, Authentik, Azure AD, Okta). Without it, OIDC providers cannot return group membership claims in the UserInfo response, preventing applications from implementing proper authorization based on user roles.This change is backward compatible - per the OIDC specification, providers ignore unsupported scopes, so the OAuth flow will continue to work with providers that don't support the groups scope.