Use groups from OpenID Connect SSO provider

[Frando]

Hi,
we're using Outline with Keycloak as an OpenID Connect (OIDC) single-sign on provider. This works great.
In Keycloak, we maintain group membership for our users. If I see things correctly, it is currently not possible to use these groups in Outline.

This would be great to have. We'd like to split our Outline wiki in different sections, accessible to different parts of the member audience. This is possible in a nice and simple way by setting up groups in Outline and then setting the per-collection permissions accordingly.

However, we would love to not have to do this manually, as all the required groups and group memberships are already maintained in our Keycloak user store. For example Nextcloud has a feature (through the social login extension) that allows to map OIDC groups (exposed in a groups claim) to Nextcloud group, or optionally auto-create Nextcloud groups for all groups i a OIDC claim that do not yet exist.

This feature would be great to have in Outline, as it would allow us to have a single source of truth for group memberships and not have to maintain the group memberships in outline seperately.

Thanks!
Frando

[Frando]

I created a pull request for this feature: #3785

[almereyda]

Thank you for this example implementation!

We have seen preliminary work in this direction after #2555 (comment) and #2568, which ultimately stalled.

I will be keen to test this PR against the GitLab OIDC IDP, and especially like the idea of decoupling the login flow related implementation into the userGroupUpdater.

[lexermal]

How does the progress look like?

[16flotho]

Waiting too...

[thomotron]

Unfortunately this is the one thing holding us back from implementing Outline in our stack. Keen to see this merged.

[routerino]

I could have sworn there is a way to assign groups via SSO, but I'm not finding it now.

Perhaps Outline could implement SCIM instead? Given that SCIM is API/JSON driven, that's probably not a large ask, and most major providers (including keycloak, albeit via plugin) supports SCIM.

[Frando]

Hi all, after having no tangible path forward for #3785 I chose a different path and wrote a small webhook server with Deno. It subscribes to users.signin events from Outline, and syncs up their groups from Keycloak via the Outline and Keycloak REST APIs. It works well.

I just open-sourced it here: https://gist.github.com/Frando/aa561ca7e6c72ab64b5d17df911c0b1f
Feel invited to try it out and report feedback here or on the gist.