Allow entitlements to be used as application access bindings

[Anderen2]

Is your feature request related to a problem? Please describe.
When using Entitlements for applications, we currently have to specify users/groups twice to provide access. Once for the relevant entitlement, and then also for the Policy/Group/User Bindings.

Additionally, for applications that does not support the OIDC groups scope (and therefore cannot use Entitlements), I cannot see a good way of creating application specific/scoped groups.
Eg. while I may create a group, and provide that group access to an application. I cannot restrict that group to only be used for that specific application, neither can I easily see from the group which applications it provides access for.

Describe the solution you'd like
Ability to either manually, or automatically use Entitlements for Application Bindings. Eg. if you create an Entitlement for an application, and add "app-users" as a group for that entitlement, the "app-users" group should also get access to the Application itself.

This to solve two things:

1. Avoid duplicate work, all users with an Entitlement binding (normally? are there exceptions?) also requires access to the application itself. Currently users/groups that need access to an application must be defined twice, once in the relevant Entitlement, and then also in the "Policy / Group / User Bindings" tab to allow access.
2. Allows you to "group" users only using a Application Entitlement. Eg. if creating a view Entitlement for an application, and adding user/group bindings there.

Describe alternatives you've considered
N/A

Additional context
Mock-up image:

[marcportabellaclotet-mt]

You can use create a expression policy and bind it to the app. This works in my case:

from authentik.core.models import Application, ApplicationEntitlement, Group

application = Application.objects.get(slug="${your-app-slug}")
entitlements = request.user.app_entitlements(application)
if len(entitlements) == 0:
  return False
return True

This way, you don't have to mantain the groups binded to your app.

[DrummyFloyd]

any update about this ?

[DrummyFloyd]

You can use create a expression policy and bind it to the app. This works in my case:

from authentik.core.models import Application, ApplicationEntitlement, Group

application = Application.objects.get(slug="${your-app-slug}")
entitlements = request.user.app_entitlements(application)
if len(entitlements) == 0:
  return False
return True

This way, you don't have to mantain the groups binded to your app.

i do somethign similar but a bit more generic

from authentik.core.models import Application

application = request.obj
if not isinstance(application, Application):
    return False

return bool(request.user.app_entitlements(application))