feat(auth): add Generic OIDC group-to-team mapping for SSO (#2120)#3695
feat(auth): add Generic OIDC group-to-team mapping for SSO (#2120)#3695hughhennelly wants to merge 1 commit intoIBM:mainfrom
Conversation
Signed-off-by: hughhennnelly <hughhennelly06@gmail.com>
|
Thanks @hughhennelly. Solid implementation following the EntraID pattern from #2129. Good test coverage (14 tests). Two notes: (1) this PR modifies |
lucarlig
left a comment
There was a problem hiding this comment.
-
In
mcpgateway/services/sso_service.py, the new generic OIDC normalization path always includesemail_verified: user_data.get("email_verified"). When the IdP omits that claim, it becomesNone, and_is_email_verified_claim()treats the now-present non-truthy value as unverified. That means generic OIDC logins can be rejected for providers that do not sendemail_verified. -
The same generic normalization path reimplements group extraction and only accepts list-valued claims. The existing helper handled scalar strings too. If an IdP returns a single
groups/rolesstring, group-derived admin promotion and RBAC mapping are silently skipped. -
.gitlab-ci.ymllooks unrelated to this feature and should probably be dropped from the PR.
The new generic bootstrap/config wiring looks reasonable overall, but I’d fix the auth regressions and trim the unrelated CI file before merging.
Related Issue
Closes #2120
Summary
Implements Generic OIDC group-to-team mapping for SSO authentication, following the pattern established by EntraID role mapping in PR #2129.
What's included:
Config Settings: 5 new
SSO_GENERIC_*environment variables (groups_claim, admin_groups, role_mappings, default_role, sync_roles_on_login)Bootstrap Support: Generic OIDC provider now includes
provider_metadatawith group mapping configurationGroup Extraction: Updated
_normalize_user_infoto extract groups from configurable claims for generic OIDC providersAdmin Group Mapping: Generic OIDC admin group support in
_should_user_be_admin(case-insensitive matching)Role Mapping: Generic OIDC support in
_map_groups_to_roleswith early exit when no mappings configuredTests: 14 unit tests covering group extraction, admin assignment, role mapping, and sync opt-out
Existing Test Fix: Updated mock settings in
test_sso_bootstrap.pyto include newsso_generic_*attributesSecurity
None— no automatic admin access for Generic OIDC usersSSO_GENERIC_ADMIN_GROUPSconfigurationsync_rolesflag allows provider-level control over role synchronizationNo migration needed
The
provider_metadatacolumn already exists from PR #2129.All lint checks (black, isort, ruff, flake8, interrogate) pass.