[FR] Just-in-time provisioning of users, with ldap authentication

[c8y3]

Is your feature request related to a problem? Please describe.
When DFIR-IRIS is configured with ldap authentication mode, it is not possible to login users that are present in the ldap, but not already created in DFIR-IRIS. (the login page displays the authentication error: "Error: Wrong credentials. Please try again.")
Since, the users are present in ldap, I would like them to access DFIR-IRIS without having to provision them manually.

Describe the solution you'd like
It would be nice for DFIR-IRIS to automatically create users the first time they log in with their ldap credentials.

Describe alternatives you've considered
As a work-around, we thought about writing an external script which retrieves all ldap users and creates them via the REST API in DFIR-IRIS. But, this is not that simple, since new users may be added to the ldap at any time. So we need to launch this script periodically.
Maybe, as another alternative for DFIR-IRIS, when in ldap mode, the application could entirely rely on data present in the ldap, rather than creating users locally in its database?

[whikernel]

Hi @c8y3

Yes indeed we might add this as an option. It was done on purpose but having both is probably the way to go.
We're adding it to the roadmap 👍
We'll still need to have the user in DB to keep consistency in all the relationships. This is another thing on the roadmap, being able to delete a user for real while changing his account to a "ghost account".

Cheers

[legoguy1000]

I was about to make an issue for this

iris-web/source/app/configuration.py

Line 214 in 6f1c198

authentication_create_user_if_not_exists = config.load('IRIS', 'AUTHENTICATION_CREATE_USER_IF_NOT_EXIST')

not actually being used anywhere. This is currently a blocker for our use with OIDC since we were hoping to not have to create users individually.

I would also not make it just for LDAP but OIDC too and any SSO in the future. With the current OIDC implementation, it requires oauth2-proxy which can restrict access by groups so auto creating users should be safe.