TheAfriForge/gitforge
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2026-07-12 20:48:40 +00:00
Code Issues Projects Releases Packages Wiki Activity

feat: add dynamic group mappings for OIDC (#11656)

Browse source 
Currently, Forgejo supports configuring static group team mappings for
an OIDC authentication source that map OIDC groups to Forgejo
organizations and teams. For example, the following mapping

```json
{"Developer": {"MyForgejoOrganization": ["MyForgejoTeam1", "MyForgejoTeam2"]}}
```

automatically adds a user in the OIDC group `Developer` to the teams
`MyForgejoTeam1` and `MyForgejoTeam2` in organization
`MyForgejoOrganization`.

In order to support more dynamic mappings and to avoid having to update
the mappings for new organizations and teams, add an additional
configuration option that supports mappings with placeholders like in
the following example:

```json
["group-{org}-{team}", "other:{org}/{team}"]
```

In this example, the mappings add a user in OIDC groups
`group-org1-team1`, `group-org2-team2`, and `other:org3/team3` to team
`team1` in organization `org1`, team `team2` in organization `org2`, and
to team `team3` in organization `org3`.

Additionally, this adds a configuration option to dynamically remove
users from organization teams. If enabled, a user is removed from all
teams that are not added via a static or dynamic mapping. Thus, users
are only in teams that are added via such a mapping and no other teams.

Docs: forgejo/docs!1950

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11656
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
This commit is contained in:
hwipl 2026-05-22 12:38:20 +02:00 • committed by Gusted
commit 1ea5605eae
18 changed files with 803 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

8
templates/admin/auth/edit.tmpl
View file

@ -384,6 +384,14 @@
<label>{{ctx.Locale.Tr "admin.auths.oauth2_map_group_to_team_removal"}}</label>
<input name="oauth2_group_team_map_removal" type="checkbox" {{if $cfg.GroupTeamMapRemoval}}checked{{end}}>
</div>
<div class="field">
<label>{{ctx.Locale.Tr "admin.auths.oauth2_dyn_group_maps"}}</label>
<textarea name="oauth2_dyn_group_maps" rows="5" placeholder='["group-{org}-{team}", "other-{org}-{team}"]'>{{$cfg.DynGroupMaps}}</textarea>
</div>
<div class="ui checkbox">
<label>{{ctx.Locale.Tr "admin.auths.oauth2_dyn_group_maps_removal"}}</label>
<input name="oauth2_dyn_group_maps_removal" type="checkbox" {{if $cfg.DynGroupMapsRemoval}}checked{{end}}>
</div>
<div class="field">
<label for="oauth2_quota_group_claim_name">{{ctx.Locale.Tr "admin.auths.oauth2_quota_group_claim_name"}}</label>
<input id="oauth2_quota_group_claim_name" name="oauth2_quota_group_claim_name" value="{{$cfg.QuotaGroupClaimName}}">

8
templates/admin/auth/source/oauth.tmpl
View file

@ -121,6 +121,14 @@
<label>{{ctx.Locale.Tr "admin.auths.oauth2_map_group_to_team_removal"}}</label>
<input name="oauth2_group_team_map_removal" type="checkbox" {{if .oauth2_group_team_map_removal}}checked{{end}}>
</div>
<div class="field">
<label>{{ctx.Locale.Tr "admin.auths.oauth2_dyn_group_maps"}}</label>
<textarea name="oauth2_dyn_group_maps" rows="5" placeholder='["group-{org}-{team}", "other-{org}-{team}"]'>{{.oauth2_dyn_group_maps}}</textarea>
</div>
<div class="ui checkbox">
<label>{{ctx.Locale.Tr "admin.auths.oauth2_dyn_group_maps_removal"}}</label>
<input name="oauth2_dyn_group_maps_removal" type="checkbox" {{if .oauth2_dyn_group_maps_removal}}checked{{end}}>
</div>
<div class="field">
<label for="oauth2_quota_group_claim_name">{{ctx.Locale.Tr "admin.auths.oauth2_quota_group_claim_name"}}</label>
<input id="oauth2_quota_group_claim_name" name="oauth2_quota_group_claim_name" value="{{.oauth2_quota_group_claim_name}}">