Map OIDC groups to Orgs/Teams

[KN4CK3R]

Fixes #19555

Test-Instructions: #21441 (comment)

This PR implements the mapping of user groups provided by OIDC providers to orgs teams in Gitea. The main part is a refactoring of the existing LDAP code to make it usable from different providers.

Refactorings:

• Moved the router auth code from module to service because of import cycles
• Changed some model methods to take a Context parameter
• Moved the mapping code from LDAP to a common location

I've tested it with Keycloak but other providers should work too. The JSON mapping format is the same as for LDAP.

[garymoon]

This is awesome, thanks @KN4CK3R! 💙

I can confirm this works with OKTA. It should be noted that it requires the filtering in the app's "SignOn" tab under "Groups claim filter" to match the relevant groups (see this document).

Any other reviewers note that the error UpdateExternalUser failed: external login user link does not exists is a red herring (see this issue).

[KN4CK3R]

Thank you for the review! I noticed that error too, didn't know there was an issue already. I will have a look...

Fixed in #21504

[Morriz]

@KN4CK3R was a docker compatible image created from this PR? I would like to test this...

[KN4CK3R]

I don't think so.

[Morriz]

Then I will have to wait with testing I guess. I would say the current standard for packaging k8s native apps is in a docker compatible image...

[Morriz]

@lunny is this PR mergeable?

[KN4CK3R]

To help and speed up testing here are instructions for Keycloak:

1. create a new realm gitea-test
   

2. create a new client in this realm
   
   

3. copy the client id and credentials
   

4. configure the group mapper (client > client scopes > select scope > add mapper) choose Group Membership
   
   
   

5. add a new group in the realm with the name TestOrgGroup

6. add a new user in the realm
   

7. create a new authentication source with the name keycloak
   
   Use <keycloak url>/realms/gitea-test/.well-known/openid-configuration as auto discovery url.
   Use {"/TestOrgGroup":{"TestOrg":["OpenIDTeam"]}} as mapping. /TestOrgGroup = name of Keycloak group (with slash) TestOrg = existing Gitea organization OpenIDTeam = existing team in organziation

8. set the redirect url in the Keycloak client setting
   

9. login with the authentication source and the keycloak_user and check the organizations of that user
   

[kdumontnu]

Has anybody tried this with an Azure OIDC application? I am not able to make this work and I am not sure if the Azure configuration is correct. I will also try to push the docker image we are using to test this feature just in case it is useful for someone that wants to test this out.

@dloez Were you able to get this sorted out?

[kdumontnu]

💯 We've tested and confirmed working with Okta

[garymoon]

I can confirm that addition to and removal from teams is still working with OKTA groups.

I had a shot at doing it with Azure AD, but couldn't for the life of me get it to send me groups. If anyone has any hints about what specifically I need to change I'm happy to try further.
Failed OAuth callback: (invalid_client) AADSTS650053: The application 'Gitea' asked for scope 'groups' that doesn't exist on the resource '00000003-0000-0000-c000-000000000000'. Contact the app vendor.

[KN4CK3R]

Does this help you? https://docs.cribl.io/stream/usecase-azure-ad/#configure-token-and-claims

[lunny]

LG-TM bot

[kousu]

This is excellent! Does anyone know what I need to fill in in https://gitea.example.org/admin/auths/${login_source_id} to make this work with GitHub?

[13tm3nt3r]

@dloez and I have finally made this work using Azure. Thank you!
Below I'll explain all the required steps to achieve the mapping of Azure user groups to different teams in Gitea, without having on-premise AD, just in case there is someone that wants to do this like us.

AZURE CONFIGURATION

1. Create an application in App Registrations. The Redirect URI is not needed to be configured at this point.
   
   As you can see, there is one Enterprise Application that has been created linked to this App Registration.
   

2. In the registered app, in the Authentication section, enable public client flows:
   

3. In the registered app, in the Certificates & secrets section, create a new secret and SAVE the Secret ID given, as this will disappear when you close this section.
   

4. In the registered app, in the Token configuration section, click on Add groups claim and select the option that will assign only groups that are assigned to the application (this step will be completed in the step 7).
   

5. In the registered app, in the API permissions section, add a delegated permission called "Group.Read.All". You will have to grant admin consent.
   

6. In the Enterprise Application created, in Properties, change the Assignment requirement? option to YES. This will allow every user to sign in or register without admin permission.
   

7. In the Enterprise Application created, in Users and groups section, add the group/groups that you want to map to teams in Gitea. In our case, the group is called "ce-operations".
   

GITEA CONFIGURATION

1. In the site configuration, under Authentication Sources section, create a new OAuth2 one.
   Give it an Authentication Name and use OpenID Connect as the OAuth2 Provider.
   Take the "Application (client) ID" of the registered app from Azure and put it in the Client ID (Key) option.
   Use the secret that you created previously and put it in the Client Secret option.
   

2. For the "OpenID Connect Auto Discovery URL" option, go to Azure and in the registered app Overview, click on "Endpoints" and copy the OpenID Connect metadata document.
   

3. In "Addition Scopes" you can add "openid email profile".

4. In "Claim name providing group names for this source.", type "groups".

5. And finally, in "Map claimed groups to Organization teams.", write the Object ID of the group that you want to map from Azure (in our case, the Object ID of the Azure group "ce-operations"), the name of the organization where you want users to be added automatically (in our case "creamteam"), and the team of the organization (in our case "Developers"). NOTE: organization and team HAVE TO BE ALREADY CREATED.
   

6. Update the Authentication Source and test it with OpenID login option. Your user should be added to the organization and team specified.
   

Hope this helps anyone that wants to use SSO with Azure and add automatically their users to an organization team 😃.

[techknowlogick]

@13tm3nt3r I hope you don't mind, but I didn't want to lose your instructions to a closed ticket so I copied your instructions and put them in a draft blog post: https://gitea.com/gitea/blog/pulls/239 I put you as the author for the blog post to ensure your credits are kept. Please let me know if I should adjust anything in it.