Add Users to Group via oidc privider e.g. authentik
On vikunja oidc login:
Group will be searched for in vikunja "by name"
if two groups with same name appear, log error.msg and do nothing
if group does not exist, team will be created with user as member (no admin)
if group does exist, user will be added as member
Feature needs specification:
Management of admin rights of user for groups via oidc
Manage groups that should be created/deleted on oidc provider (via custom claim/scope in oauth_token)
change: scope has to be hard coded in vikunja/frontend atm
There are several things that have to be done to complete this PR:
1.) add tests to openid_test.go
2.) manage admin rights via oidc
This is a draft PR to adress https://kolaente.dev/vikunja/api/issues/950
Works like following:
- Add Users to Group via oidc privider e.g. authentik
- On vikunja oidc login:
- Group will be searched for in vikunja "by name"
- if two groups with same name appear, log error.msg and do nothing
- if group does not exist, team will be created with user as member (no admin)
- if group does exist, user will be added as member
Feature needs specification:
* Management of admin rights of user for groups via oidc
* Manage groups that should be created/deleted on oidc provider (via custom claim/scope in oauth_token)
* change: scope has to be hard coded in vikunja/frontend atm
There are several things that have to be done to complete this PR:
1.) add tests to openid_test.go
2.) manage admin rights via oidc
Why don't you use the existing Create function for Teams? Only because of the Admin property? Why do you want to create teams without an admin in the first place?
In any case, this function almost entierly duplicates with the existing one - please refactor it so that only one is used.
Why don't you use the existing `Create` function for Teams? Only because of the `Admin` property? Why do you want to create teams without an admin in the first place?
In any case, this function almost entierly duplicates with the existing one - please refactor it so that only one is used.
I don't like the idea of matching the team by names. What happens if there are multiple teams of the same name?
I think it's better to use IDs of an existing team. That would also avoid creating new Teams and the rights issues associated with that.
I don't like the idea of matching the team by names. What happens if there are multiple teams of the same name?
I think it's better to use IDs of an existing team. That would also avoid creating new Teams and the rights issues associated with that.
The interface of the oidc provider lets you create groups, which are delivered to vikunja via oauth_token "groups".
It has no notion of the vikunja teams' ids.
As the scopes are implemented now, you could also include a custom claim (which atm are somewhat hard coded in vikunja/frontend) and send ids and search for teams, but then the oidc admin would have to search for team ids in the respective application.
But that's a possible change I could implemented.
My proposal via names includes:
if two teams were found with the same name, then nothing is gonna happen and problems have to be resolved manually by admin (namely: rename teams).
The interface of the oidc provider lets you create groups, which are delivered to vikunja via oauth_token "groups".
It has no notion of the vikunja teams' ids.
As the scopes are implemented now, you could also include a custom claim (which atm are somewhat hard coded in vikunja/frontend) and send ids and search for teams, but then the oidc admin would have to search for team ids in the respective application.
But that's a possible change I could implemented.
My proposal via names includes:
if two teams were found with the same name, then nothing is gonna happen and problems have to be resolved manually by admin (namely: rename teams).
The interface of the oidc provider lets you create groups, which are delivered to vikunja via oauth_token "groups".
It has no notion of the vikunja teams' ids.
As the scopes are implemented now, you could also include a custom claim (which atm are somewhat hard coded in vikunja/frontend) and send ids and search for teams, but then the oidc admin would have to search for team ids in the respective application.
But that's a possible change I could implemented.
My proposal via names includes:
if two teams were found with the same name, then nothing is gonna happen and problems have to be resolved manually by admin (namely: rename teams).
The interface of the oidc provider lets you create groups, which are delivered to vikunja via oauth_token "groups".
It has no notion of the vikunja teams' ids.
As the scopes are implemented now, you could also include a custom claim (which atm are somewhat hard coded in vikunja/frontend) and send ids and search for teams, but then the oidc admin would have to search for team ids in the respective application.
But that's a possible change I could implemented.
My proposal via names includes:
if two teams were found with the same name, then nothing is gonna happen and problems have to be resolved manually by admin (namely: rename teams).
But what about adding a user to a group called "1" for a team of id one? Is this something the provider has implemented on its own or is part of the spec? If there's a spec for it we should use that.
Which provider are you using?
But what about adding a user to a group called "1" for a team of id one? Is this something the provider has implemented on its own or is part of the spec? If there's a spec for it we should use that.
Which provider are you using?
Manage groups that should be created/deleted on oidc provider (via custom claim/scope in oauth_token)
You mean groups that could be managed from the oidc provider?
> Manage groups that should be created/deleted on oidc provider (via custom claim/scope in oauth_token)
You mean groups that could be managed from the oidc provider?
Our specific use case would make it mandatory to manage groups via oidc provider.
The first user, that logs in and creates the team might not neccessarily be admin of this respective group.
It is possible to send more information via "scopes" included in the oauth_token.
That is the background of this change.
Our specific use case would make it mandatory to manage groups via oidc provider.
The first user, that logs in and creates the team might not neccessarily be admin of this respective group.
It is possible to send more information via "scopes" included in the oauth_token.
That is the background of this change.
Make "migration" "import everywhere"
Add checking for migration status before trying to migrate
Add get status from migrations
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#47
Fix saving
Use mixin everywhere
Format attachment dates
Add format date mixing
Use moment js on task list page
Use moment js on home page tasks
Add moment js
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#50
Fix email field type
Co-authored-by: Jan Tojnar <jtojnar@gmail.com>
Reviewed-on: vikunja/frontend#58
Reviewed-by: konrad <konrad@kola-entertainments.de>
Fix input validation for new tasks
Better layout for input validation for new lists
Add input length validation for new namepaces
Add input length validation for new lists
Add input length validation for new tasks
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#70
Use fancy checkbox for archiving namespace
Show is archived badge for namespaces
Fix is archived badge in navigation bar
Add check to filter out archived lists or namespaces
Show if a list is archived in menu
Hide edit task if the list is archived
Hide marking tasks as done if the list is archived
Show is archived message on list
Add archiving a list
Add archiving a namespace
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#73
Show colors for namespaces bigger
Show colors for lists and namespaces
Add changing color for lists
Add changing color for namespace
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#74
Save sort order to local storage
Save selected columns to localStorage
Loading spinner
More sorting
Add sorting
Styling and hiding of column filter
Add checkbox to show/hide columns
Use fancycheckbox everywhere
Fix is done badge
Change sort order in table view
Add is done column to table
Better text handling
Refactor is done into seperate component
Add pagination to table view
Add assignees to table view
Fix redirecting to table view
Add date tooltip to date field
Add date tooltip to date field
labels for table view
Styling
Add basic table view
Extend priority label
Split list view in mixins
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#76
Change all snake/camelCase mix and match to camelCase everywhere
Fix conversion to not interfer with service interceptors
Add dynamic conversion between camelCase and snake_case to services
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#105
Fix not telling the user about invalid totp passcodes when logging in
Add disabling totp authentication
Add totp passcode when logging in
Add totp settings
Add general post method function
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#109
Add error message when trying to create an invalid new task in a bucket
Prevent creation of new buckets if the bucket title is empty
Disable deleting a bucket if it's the last one
Disable dragging tasks when they are being updated
Fix transition when opening tasks
Send the user to list view by default
Show loading spinner when updating multiple tasks
Add loading spinner when moving tasks
Add loading animation when bucket is loading / updating etc
Add bucket title edit
Fix creating new buckets
Add loading animation
Add removing buckets
Fix creating a new bucket after tasks were moved
Fix warning about labels on tasks
Fix labels on tasks not updating after retrieval from api
Fix property width
Add closing and mobile design
Make the task detail popup look good
Move list views
Move task detail view in a popup
Add link to tasks
Add saving the new task position after it was moved
Fix creating new bucket
Fix creating a new task
Cleanup
Disable user selection for task cards
Fix drag placeholder
Add dragging style to task
Add placeholder + change animation duration
More cleanup
Cleanup / docs
Working of dragging and dropping tasks
Adjust markup and styling for new library
Change kanban library to something that works
Add basic calculation of new positions
Don't try to create empty tasks
Add indicator if a task is done
Add moving tasks between buckets
Make empty buckets a little smaller
Add gimmick for button description
Fix color
Fix scrolling bucket layout
Add creating a new bucket
Add hiding the task input field
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#118
Fix member/admin button overflowing
Fix changing team member admin status
Fix adding team members
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#121
Merge branch 'master' into feature/vuex
Cleanup
Move namespaces handling to store
Move fullpage setting to store
Move online/offline handling to store
Remove debug log
Fix loading namepaces
Rename errorMsg
Handle registering through the store
Use store to determine wether or not a user is authenticated on login page
Use store in edit team
Use store to get the current user's avatar
Use store to figure out if the current user belongs to a team
Use store to figure out if the current user is list admin
Use store to get user info when listing labels
Use store to get username on home
Use store to figure out if the user is namespace admin
Use the store for configuration
Use the store to check if a user is authenticated everywhere
Only renew token if the user is logged in
Fix renewing auth from jwt token
Move logout to store
Move renew token to store
Move log in to store
Only show enabled migrators
Only show registration button if registration is enabled
Put all config information from the backend in the store
Remove old config handler
Move config state to seperate module
Add vuex and get the motd through it
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#126
Fix due date disappearing after moving it
Fix removing labels not being updated in store
Fix adding labels not being updated in store
Fix removing assignees not being updated in store
Fix adding assignees not being updated in store
Fix due date not resetting
Fix task attachments not updating in store after being modified in popup view
Fix due date not updating in store after being modified in popup view
Fix using filters for overview views
Fix not re-loading tasks when switching between overviews
Only show undone tasks on task overview page
Update task in bucket when updating in task detail view
Put all bucket related stuff in store
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#130
Merge branch 'master' into fix/title-fields
Change task text field to title
Change namespace name field to title
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#134
Make backgrounds list responsive
Show initial collection of backgrounds
Remove test data
Fix "backgroundInformation is null" when navigating
Fix kanban height
Remove debug log
Move list title to top header
Add styling for title in top header
Set the current list (and background) when loading settings
Only load the background if it changed
Make task detail view look good again
Fix bottom spacing
Make list and table view look good again
Make pages with background at least 100vh
Fix kanban height
Make extra buttons look good again
Move list title and view-switcher in one row
Add styling for backgrounds
Set background globally
Add getting list background and putting it in vuex
Add setting list background
Move list background setting to seperate list
Add search timeout to not search on every keypress
Add getting thumbnails through api
Add basic search for unsplash backgrounds
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#144
Set done filter based on passed params
Make due date filter actually work
Move filters into seperate config
Merge branch 'master' into feature/task-filters
Change done task filter text
Make sure done tasks are always shown in table view
Table view filter improvements
Add done filter to table view
Fix indent
Add filter icon
Move search and filter container
Add filter for done tasks
Hide done tasks by default
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#149
Formatting
Show loading if a file is uploading
Only show image files in upload
Hide background settings if none are available
Fix showing uploaded background after uploading a new one
Add background upload
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#151
Format
Add migration to Settings
Merge branch 'master' into feature/hide-hints
Hide hints on start page if a user has tasks
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#159
Center list backgrounds
Better alignment of new namespace and filter button
Make creating new namespace button clear
Hide archived lists unless the user wants it
Make all cards responsive
Cleanup
Show it if a namespace is archived
Show if a list is archived
Fix not updating the list in store after updating the background
Make task cards smaller
Display list backgrounds in cards and look good while doing it
lighter shadow
Change background to stripes
Set list backgrounds as card backgrounds
Add background color check to color appropriatly
Move color check to mixin
Use background color from tasks
Change list card color
Make create new namespace button stick to the right
Shadow all the things
Don't keep list backgrounds set when navigating back
Make links to list clickable
Add seperate page for namespaces
Co-authored-by: kolaente <k@knt.li>
Reviewed-on: vikunja/frontend#160
This is a draft PR to adress vikunja/api#950
Works like following:
Feature needs specification:
There are several things that have to be done to complete this PR:
1.) add tests to openid_test.go
2.) manage admin rights via oidc
viehlieb referenced this pull request2022-10-12 13:21:17 +00:00
How can we test this?
@ -1095,6 +1095,28 @@ func (err ErrTeamDoesNotExist) HTTPError() web.HTTPError {return web.HTTPError{HTTPCode: http.StatusNotFound, Code: ErrCodeTeamDoesNotExist, Message: "This team does not exist."}}type ErrTeamsDoNotExist struct {Can you add this to the error docs?
@ -282,6 +310,37 @@ func (t *Team) Create(s *xorm.Session, a web.Auth) (err error) {})}func (t *Team) CreateNoAdmin(s *xorm.Session, a web.Auth) (err error) {Why don't you use the existing
Createfunction for Teams? Only because of theAdminproperty? Why do you want to create teams without an admin in the first place?In any case, this function almost entierly duplicates with the existing one - please refactor it so that only one is used.
For now we can also be simplistic and just search for groups, if not exists: create group with user as admin member.
@ -65,0 +63,4 @@Name string `json:"name"`PreferredUsername string `json:"preferred_username"`Nickname string `json:"nickname"`Group []string `json:"groups"`Why not call it
teams?true
@ -189,2 +191,4 @@// Check if we have seen this user beforeu, err := getOrCreateUser(s, cl, idToken.Issuer, idToken.Subject)log.Errorf("Issuer %s: %v", idToken.Issuer, err)This should be
Debugf.@ -195,2 +200,4 @@}// Check if we have seen this user beforeteams, err := GetOrCreateTeamsByNames(s, cl.Group, u)I don't like the idea of matching the team by names. What happens if there are multiple teams of the same name?
I think it's better to use IDs of an existing team. That would also avoid creating new Teams and the rights issues associated with that.
The interface of the oidc provider lets you create groups, which are delivered to vikunja via oauth_token "groups".
It has no notion of the vikunja teams' ids.
As the scopes are implemented now, you could also include a custom claim (which atm are somewhat hard coded in vikunja/frontend) and send ids and search for teams, but then the oidc admin would have to search for team ids in the respective application.
But that's a possible change I could implemented.
My proposal via names includes:
if two teams were found with the same name, then nothing is gonna happen and problems have to be resolved manually by admin (namely: rename teams).
The interface of the oidc provider lets you create groups, which are delivered to vikunja via oauth_token "groups".
It has no notion of the vikunja teams' ids.
As the scopes are implemented now, you could also include a custom claim (which atm are somewhat hard coded in vikunja/frontend) and send ids and search for teams, but then the oidc admin would have to search for team ids in the respective application.
But that's a possible change I could implemented.
My proposal via names includes:
if two teams were found with the same name, then nothing is gonna happen and problems have to be resolved manually by admin (namely: rename teams).
But what about adding a user to a group called "1" for a team of id one? Is this something the provider has implemented on its own or is part of the spec? If there's a spec for it we should use that.
Which provider are you using?
The provider would be authentik.
@ -197,0 +208,4 @@for _, team := range teams {tm := models.TeamMember{TeamID: team.ID, Username: u.Username}if err = tm.Create(s, u); err != nil {switch t := err.(type) {Why the switch case with only one case?
You mean groups that could be managed from the oidc provider?
Our specific use case would make it mandatory to manage groups via oidc provider.
The first user, that logs in and creates the team might not neccessarily be admin of this respective group.
It is possible to send more information via "scopes" included in the oauth_token.
That is the background of this change.
Like who should be admin of that team?