Add support for Okta Group claims to set user role

[peejaychilds]

Please give a short description what your pull request is for

Allow the Socialite Okta support to ask for groups claim, and then use those okta groups to map to User level's

DO NOT DELETE THE UNDERLYING TEXT

Please note

Please read this information carefully. You can run ./lnms dev:check to check your code before submitting.

• Have you followed our code guidelines?
• If my Pull Request does some changes/fixes/enhancements in the WebUI, I have inserted a screenshot of it.
• If my Pull Request makes discovery/polling/yaml changes, I have added/updated test data.

Testers

If you would like to test this pull request then please run: ./scripts/github-apply <pr_id>, i.e ./scripts/github-apply 5926
After you are done testing, you can remove the changes with ./scripts/github-remove. If there are schema changes, you can ask on discord how to revert.

[Jellyfrog]

You need to remove the Okta specific code
And change the logic so you specify the scope name for groups instead of hardcoded "groups"

And last, need to make the group name mapping configurable

[murrant]

@Jellyfrog shouldn't the "group" name line up with "role" names in LibreNMS? Or do want to require explicit mapping? Or should there be a "user group" concept in LibreNMS?

[Jellyfrog]

@Jellyfrog shouldn't the "group" name line up with "role" names in LibreNMS? Or do want to require explicit mapping? Or should there be a "user group" concept in LibreNMS?

Well since we don't have groups in LibreNMS, I think this is the best way atm. We cant expect people to create a group in AD called "admin" for example :)

[librenms-bot]

This pull request has been mentioned on LibreNMS Community. There might be relevant details there:

https://community.librenms.org/t/saml2-group-mapping-giving-access-level/21356/2

[murrant]

I think code design is good now. Code style could use a clean up pass (I can tell you copied code from some older parts of LibreNMS). If I submit a cleanup, would you test it after?

[Jellyfrog]

I'll give it a go to try it out on some other provider.

Stale

[peejaychilds]

I have put the refactored changes through our lower testing environments and it works as expected @murrant 🙏

[Jellyfrog]

Like I wrote on discord, this doesn't work at all for azuread.
The problem is socialite doesn't use the id/access-token jwt content to get info about the user, it does a separate request to some user info endpoint, and in azures case it doesnt contain group info. there is a separate endpoint for that.

And I'm guessing it won't work for a lot of providers out there, need to test a few at least, else this will just lead to a billion questions.

[peejaychilds]

I noticed the gui is borked for the Groups->Roles mapping.

I assume perhaps have to make a new config type rather than use ldap-groups and then make some type of javascript helper function to help with the populating the select boxes?

We don't really ever look in the GUI but I guess it would be nice if it worked as expected.

Should I have a go at this?

[Jellyfrog]

So I did some more testing and github doesn't work
And Google via saml2 doesnt work(but quite Close actually.)

This kinda means I'm against adding it in its current state, have to give it some thought.

[peejaychilds]

So I did some more testing and github doesn't work And Google via saml2 doesnt work(but quite Close actually.)

This kinda means I'm against adding it in its current state, have to give it some thought.

But it does work for Okta, which makes it pretty useful for shops with Okta with a fairly minor impact.

I'm assuming getting all the other providers to work would involve some upstream work to get it all nicely abstracted to be generic

[rgilijamse]

As I understand it, the problem is that claims/groups do not work for providers other than Okta. Would it otherwise be possible to separate just the 'Default Role' part of this PR and merge that? That should work for all providers, and is a useful feature on it's own.

[murrant]

Hmm it is hard to predict the upstream api. I'm uncertain if we should continue on this approach or try to set up a way to add per-provider code.

Yes, extracting the default role would be be easily mergable.

[WindoC]

Is there any plan to add the default_role feature on the next version?

Please add it is very useful for me. Thanks!

[librenms-bot]

This pull request has been mentioned on LibreNMS Community. There might be relevant details there:

https://community.librenms.org/t/socialite-permissions/21656/2

[librenms-bot]

This pull request has been mentioned on LibreNMS Community. There might be relevant details there:

https://community.librenms.org/t/sso-not-showing-devices-after-set-up/21949/4

[murrant]

@peejaychilds roles have been merged, can you rebase this?

[peejaychilds]

replaced via #15592