feat: add automatic team assignment

Signed-off-by: Henry <mail@henrygressmann.de>

Author: explodingcamera

CHANGELOG.md

@@ -28,8 +28,10 @@ Since this is not a library, this changelog focuses on the changes that are rele
 - Added left and right arrow keyboard shortcuts for navigating dashboard date ranges
 - Added authenticated batch event ingestion endpoint
 - Added API key management UI
-- Added teams for assigning project read access to groups of users and internal projects visible to signed-in users
+- Added teams for assigning project read access to groups of users
+- Added internal project visibility for all signed-in users
 - Added a configurable maximum session duration
+- Added automatic team assignment for new SSO accounts
 
 ### ⚠️ Breaking Changes
 

Cargo.lock

@@ -42,7 +42,6 @@ Add a small tracking script to your website with a single line of HTML. Works wi
 
 **Single sign-on**\
 Manage accounts with Google Workspaces, Microsoft Entra, or your own OpenID Connect provider like Keycloak or Dex.
-Set `session_duration = "24h"` (or `LIWAN_SESSION_DURATION=24h`) to limit how long a dashboard login lasts. Sessions do not renew, and changing this setting does not shorten existing sessions. Admins can revoke sessions immediately in user settings.
 
 ## License
 

README.md

@@ -14,7 +14,8 @@ pub use api_keys::{ApiKeyAccess, LiwanApiKeys};
 pub use entities::LiwanEntities;
 pub use events::{LiwanEvents, PruneStats};
 pub use external_auth::{
-    ExternalAuthLogin, ExternalAuthProvider, ExternalAuthSettings, ExternalAuthStart, LiwanExternalAuth,
+    ExternalAuthLogin, ExternalAuthProvider, ExternalAuthSettings, ExternalAuthStart, GroupTeamMapping,
+    LiwanExternalAuth,
 };
 pub use onboarding::LiwanOnboarding;
 pub use projects::LiwanProjects;

crates/liwan/src/app/core.rs

@@ -1,4 +1,4 @@
-use std::net::IpAddr;
+use std::{collections::HashMap, net::IpAddr};
 
 use anyhow::{Context, Result, bail};
 use oauth2::{AuthType, EndpointMaybeSet, EndpointNotSet, EndpointSet};
@@ -22,10 +22,27 @@ struct ProviderClaims {
     hd: Option<String>,
     #[serde(default)]
     tid: Option<String>,
+    #[serde(default)]
+    groups: Option<serde_json::Value>,
+    #[serde(default)]
+    hasgroups: bool,
+    #[serde(default, rename = "_claim_names")]
+    claim_names: Option<serde_json::Value>,
+    #[serde(flatten)]
+    other: HashMap<String, serde_json::Value>,
 }
 
 impl AdditionalClaims for ProviderClaims {}
 
+impl ProviderClaims {
+    fn group_values(&self, claim_name: &str) -> (Option<Vec<String>>, bool) {
+        let values = if claim_name == "groups" { self.groups.as_ref() } else { self.other.get(claim_name) };
+        let incomplete =
+            self.hasgroups || self.claim_names.as_ref().is_some_and(|names| names.get(claim_name).is_some());
+        (values.cloned().and_then(|value| serde_json::from_value(value).ok()), incomplete)
+    }
+}
+
 type ProviderIdTokenFields = IdTokenFields<
     ProviderClaims,
     EmptyExtraTokenFields,
@@ -76,6 +93,8 @@ pub(super) struct Provider {
     provider_key: String,
     policy: ProviderPolicy,
     allow_session_reuse: bool,
+    additional_scopes: Vec<String>,
+    group_claim_name: String,
 }
 
 impl Provider {
@@ -110,7 +129,18 @@ impl Provider {
         .set_auth_type(auth_type)
         .set_redirect_uri(RedirectUrl::new(redirect_url.to_string())?);
 
-        Ok(Self { client: oidc_client, provider_key, policy, allow_session_reuse: settings.allow_session_reuse })
+        Ok(Self {
+            client: oidc_client,
+            provider_key,
+            policy,
+            allow_session_reuse: settings.allow_session_reuse,
+            additional_scopes: settings.additional_scopes.split_whitespace().map(str::to_string).collect(),
+            group_claim_name: if settings.provider == ExternalAuthProvider::Microsoft {
+                "groups".to_string()
+            } else {
+                settings.group_claim_name.clone()
+            },
+        })
     }
 
     pub(super) fn authorize(&self) -> Authorization {
@@ -125,6 +155,8 @@ impl Provider {
             .add_scope(Scope::new("profile".to_string()))
             .add_scope(Scope::new("email".to_string()))
             .set_pkce_challenge(challenge);
+        let request =
+            self.additional_scopes.iter().fold(request, |request, scope| request.add_scope(Scope::new(scope.clone())));
         let request = if self.allow_session_reuse { request } else { request.add_prompt(CoreAuthPrompt::Login) };
         let (url, state, nonce) = request.url();
         Authorization { url, state: state.secret().clone(), secret: FlowSecret { nonce, verifier } }
@@ -167,10 +199,13 @@ impl Provider {
             .map(|value| value.as_str().to_string())
             .or_else(|| claims.email().map(|value| value.as_str().to_string()))
             .or_else(|| claims.name().and_then(|name| name.get(None)).map(|value| value.as_str().to_string()));
+        let (groups, groups_overage) = claims.additional_claims().group_values(&self.group_claim_name);
         Ok(ExternalIdentity {
             provider_key: self.provider_key.clone(),
             subject: claims.subject().as_str().to_string(),
             username_hint,
+            groups,
+            groups_overage,
         })
     }
 }
@@ -298,4 +333,25 @@ mod tests {
             "https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/v2.0"
         );
     }
+
+    #[test]
+    fn reads_configured_group_claims_and_detects_incomplete_lists() {
+        let claims: ProviderClaims = serde_json::from_value(serde_json::json!({
+            "groups": ["engineering"],
+            "roles": ["analyst"],
+        }))
+        .unwrap();
+        assert_eq!(claims.group_values("groups"), (Some(vec!["engineering".into()]), false));
+        assert_eq!(claims.group_values("roles"), (Some(vec!["analyst".into()]), false));
+        assert_eq!(claims.group_values("missing"), (None, false));
+
+        let malformed: ProviderClaims = serde_json::from_value(serde_json::json!({ "roles": [7] })).unwrap();
+        assert_eq!(malformed.group_values("roles"), (None, false));
+
+        let incomplete: ProviderClaims = serde_json::from_value(serde_json::json!({
+            "groups": [7], "hasgroups": true, "_claim_names": { "groups": "src1" }
+        }))
+        .unwrap();
+        assert_eq!(incomplete.group_values("groups"), (None, true));
+    }
 }

crates/liwan/src/app/core/external_auth/mod.rs

@@ -3,7 +3,10 @@ mod db;
 
 pub mod models;
 pub use core::reports;
-pub use core::{ExternalAuthLogin, ExternalAuthProvider, ExternalAuthSettings, ExternalAuthStart, LiwanExternalAuth};
+pub use core::{
+    ExternalAuthLogin, ExternalAuthProvider, ExternalAuthSettings, ExternalAuthStart, GroupTeamMapping,
+    LiwanExternalAuth,
+};
 use std::sync::Arc;
 
 use crate::{config::Config, utils::writable::check_directory_writable};

crates/liwan/src/app/core/external_auth/provider.rs

@@ -0,0 +1,4 @@
+alter table external_auth_settings add column default_team_id text;
+alter table external_auth_settings add column group_team_mappings text not null default '[]';
+alter table external_auth_settings add column additional_scopes text not null default '';
+alter table external_auth_settings add column group_claim_name text not null default '';

crates/liwan/src/app/mod.rs

@@ -19,7 +19,7 @@ use serde::{Deserialize, Serialize};
 use tower_governor::{GovernorLayer, governor::GovernorConfigBuilder};
 
 use crate::{
-    app::{ExternalAuthProvider, ExternalAuthSettings},
+    app::{ExternalAuthProvider, ExternalAuthSettings, GroupTeamMapping},
     config::Config,
     web::{
         RouterState,
@@ -98,6 +98,10 @@ struct ExternalAuthSettingsResponse {
     tenant_id: Option<String>,
     allow_user_creation: bool,
     allow_session_reuse: bool,
+    default_team_id: Option<String>,
+    group_team_mappings: Vec<GroupTeamMapping>,
+    additional_scopes: String,
+    group_claim_name: String,
     callback_url: String,
 }
 
@@ -117,6 +121,10 @@ struct UpdateExternalAuthSettings {
     tenant_id: Option<String>,
     allow_user_creation: bool,
     allow_session_reuse: bool,
+    default_team_id: Option<String>,
+    group_team_mappings: Vec<GroupTeamMapping>,
+    additional_scopes: String,
+    group_claim_name: String,
 }
 
 #[derive(Deserialize, JsonSchema)]
@@ -180,6 +188,12 @@ async fn update_settings(
             }
             ExternalAuthProvider::Google => true,
         };
+    if !same_client_registration
+        && !request.group_team_mappings.is_empty()
+        && request.group_team_mappings == existing.group_team_mappings
+    {
+        http_bail!(StatusCode::BAD_REQUEST, "reconfigure group mappings when changing the provider registration");
+    }
     let client_secret = if request.clear_client_secret {
         None
     } else if let Some(client_secret) = request.client_secret {
@@ -200,6 +214,10 @@ async fn update_settings(
         tenant_id: request.tenant_id,
         allow_user_creation: request.allow_user_creation,
         allow_session_reuse: request.allow_session_reuse,
+        default_team_id: request.default_team_id,
+        group_team_mappings: request.group_team_mappings,
+        additional_scopes: request.additional_scopes,
+        group_claim_name: request.group_claim_name,
     };
     if let Err(error) = app.external_auth.update_settings(&settings).await {
         tracing::debug!(%error, "external authentication settings validation failed");
@@ -299,6 +317,10 @@ fn settings_response(app: &RouterState, settings: ExternalAuthSettings) -> Exter
         tenant_id: settings.tenant_id,
         allow_user_creation: settings.allow_user_creation,
         allow_session_reuse: settings.allow_session_reuse,
+        default_team_id: settings.default_team_id,
+        group_team_mappings: settings.group_team_mappings,
+        additional_scopes: settings.additional_scopes,
+        group_claim_name: settings.group_claim_name,
         callback_url: app.external_auth.callback_url().to_string(),
     }
 }

crates/liwan/src/migrations/app/V8__external_auth_teams.sql

@@ -20,7 +20,11 @@ fn settings(overrides: Value) -> Value {
         "allowedDomain": null,
         "tenantId": null,
         "allowUserCreation": false,
-        "allowSessionReuse": true
+        "allowSessionReuse": true,
+        "defaultTeamId": null,
+        "groupTeamMappings": [],
+        "additionalScopes": "",
+        "groupClaimName": ""
     });
     settings.as_object_mut().unwrap().extend(overrides.as_object().unwrap().clone());
     settings
@@ -134,6 +138,53 @@ async fn invalid_enabled_settings_are_not_persisted() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn team_assignment_settings_are_validated() -> Result<()> {
+    let (app, client, cookies) = authenticated_client(UserRole::Admin).await?;
+    let team_id = app.teams.create("Engineering")?;
+    let headers = || vec![("cookie".to_string(), cookies.clone())];
+    let response = client
+        .put_with_headers(
+            "/api/dashboard/admin/auth",
+            settings(json!({
+                "defaultTeamId": team_id,
+                "groupTeamMappings": [{ "groupId": "engineering", "teamId": team_id }],
+                "groupClaimName": "groups",
+                "additionalScopes": "groups"
+            })),
+            headers(),
+        )
+        .await;
+    response.assert_status_success();
+    let body: Value = response.json();
+    assert_eq!(body["defaultTeamId"], team_id);
+    assert_eq!(body["groupTeamMappings"][0]["groupId"], "engineering");
+    assert_eq!(body["additionalScopes"], "groups");
+
+    let response = client
+        .put_with_headers(
+            "/api/dashboard/admin/auth",
+            settings(json!({
+                "defaultTeamId": team_id,
+                "groupClaimName": "groups",
+                "groupTeamMappings": [
+                    { "groupId": "engineering", "teamId": team_id },
+                    { "groupId": "engineering", "teamId": team_id }
+                ]
+            })),
+            headers(),
+        )
+        .await;
+    response.assert_status_bad_request();
+
+    let response = client
+        .put_with_headers("/api/dashboard/admin/auth", settings(json!({ "defaultTeamId": "missing" })), headers())
+        .await;
+    response.assert_status_bad_request();
+    assert_eq!(app.external_auth.settings()?.default_team_id.as_deref(), Some(team_id.as_str()));
+    Ok(())
+}
+
 #[tokio::test]
 async fn oidc_start_uses_discovery_pkce_and_state_cookie() -> Result<()> {
     let (issuer, server) = mock_oidc_provider().await?;