Group sync in combination with local assigned roles #3346

New Issue

OVERLORD · 2026-02-05T06:25:56+03:00

OVERLORD commented

2026-02-05 06:25:56 +03:00

Originally created by @jacac on GitHub (Nov 17, 2022).

Describe the feature you'd like

Allow group sync OIDC_REMOVE_FROM_GROUPS=true or LDAP_REMOVE_FROM_GROUPS=true to be used in combination with locally assigned roles. Basically OIDC or LDAP would only remove roles they assigned themselves.

Describe the benefits this would bring to existing BookStack users

We have about 8 roles which covers about 400 users managed through OIDC. We also have 40+ roles which are managed in Bookstack directly. Enabling the sync role requires us to replicate those 40 roles and all new roles in OIDC. Setting sync to false means that I need to monitor all 400 users if any of them need their role changed.

Can the goal of this request already be achieved via other means?

If all roles are replicated externally and managed this way.

Have you searched for an existing open/closed issue?

I have searched for existing issues and none cover my fundemental request

How long have you been using BookStack?

1 to 5 years

Additional context

Add another column in role_user like internal with a boolean value. Depending on that the roles get synced from external authentication providers.

Originally created by @jacac on GitHub (Nov 17, 2022). ### Describe the feature you'd like Allow group sync `OIDC_REMOVE_FROM_GROUPS=true` or `LDAP_REMOVE_FROM_GROUPS=true` to be used in combination with locally assigned roles. Basically OIDC or LDAP would only remove roles they assigned themselves. ### Describe the benefits this would bring to existing BookStack users We have about 8 roles which covers about 400 users managed through OIDC. We also have 40+ roles which are managed in Bookstack directly. Enabling the sync role requires us to replicate those 40 roles and all new roles in OIDC. Setting sync to false means that I need to monitor all 400 users if any of them need their role changed. ### Can the goal of this request already be achieved via other means? If all roles are replicated externally and managed this way. ### Have you searched for an existing open/closed issue? - [X] I have searched for existing issues and none cover my fundemental request ### How long have you been using BookStack? 1 to 5 years ### Additional context Add another column in `role_user` like `internal` with a boolean value. Depending on that the roles get synced from external authentication providers.

OVERLORD added the 🔨 Feature Request label 2026-02-05 06:25:56 +03:00

OVERLORD closed this issue

2026-02-05 06:26:02 +03:00

OVERLORD commented

2026-02-05 06:26:06 +03:00

@ssddanbrown commented on GitHub (Nov 17, 2022):

Thanks for the request @jacac.

From my perspective, this would be adding of complexity and configurability for minor-level configuration options for something that's quite use-case specific and without significant demand need, so it's not something I'd be keen to add.

As an alternative though, maybe there's an additional event point we could add to our logical theme system so custom logic could be applied to the group sync so this kind of thing could be added as instance-specific custom logic if desired.

@ssddanbrown commented on GitHub (Nov 17, 2022): Thanks for the request @jacac. From my perspective, this would be adding of complexity and configurability for minor-level configuration options for something that's quite use-case specific and without significant demand need, so it's not something I'd be keen to add. As an alternative though, maybe there's an additional event point we could add to our [logical theme system](https://github.com/BookStackApp/BookStack/blob/development/dev/docs/logical-theme-system.md) so custom logic could be applied to the group sync so this kind of thing could be added as instance-specific custom logic if desired.

OVERLORD commented

2026-02-05 06:26:10 +03:00

@ssddanbrown commented on GitHub (Dec 12, 2022):

Since there's been no follow-up to the above, and since this is not something I'd look to support in the core by default, I'm going to go ahead and close this off.

@ssddanbrown commented on GitHub (Dec 12, 2022): Since there's been no follow-up to the above, and since this is not something I'd look to support in the core by default, I'm going to go ahead and close this off.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#3346