Groups from LDAP

[mw-0]

Preflight Checklist

• I could not find a solution in the existing issues, docs, nor discussions
• I have joined the ZITADEL chat

Describe your problem

Like a lot of people we have users in legacy AD. We currently use Keycloak for OIDC which includes the ad groups of the user in the userinfo endpoint. This can then be used for rbac inside the apps.

Describe your ideal solution

On Keycloak you can return the user groups as part of either userinfo or access token with the groups mapper.

Version

No response

Environment

Self-hosted

Additional Context

No response

[fforootd]

Hm we could extend our LDAP provider or create an action to map this infos around.

[k8ieone]

This feels like a must have. Even simple IDPs like Dex or Authelia are able to return group membership info from an LDAP server.

[fforootd]

Sure that is true, we should be able to extend this.

The reason we did hold back is basically because claims like groups do not exist in the standard.

So the best course on our end would be to allow people to use an action to map across the values into a token.

[fforootd]

CC @hifabienne I guess this is something worth to extend actions ldap support

[hifabienne]

Yes, I think actions is the right place for this.
I will put the issue to the product backlog for now, and we monitor the need of our customers/community, and will prioritise accordingly.
Meanwhile, if you're interested in implementing it yourself, we also welcome pull requests.

[cedegi]

I think, this could be a great improvement.

For us at wavestack we had three requests within the last two weeks by users, asking for managing projects with groups or even had this as an requirement for their usecase. Their is definitely a need for this and it could make things way more comfortable.

For now, this is not a requirement for c5 criteria (https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/CloudComputing/Anforderungskatalog/2020/C5_2020.pdf?__blob=publicationFile&v=2), but this could also change in the future.

Lets keep in touch for this, if you have any questions how a good implementation could look like.

[ghstahl]

I want the same thing but coming in as someone switching from Auth0 to zitadel.
btw: Some go code to pull groups.
azuread user groups

This is the options when I configure an AzureAD OIDC sso in Auth0.