mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-06 09:09:38 +03:00
Using OIDC - Limit access to AD Group #3978
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @BartNSTCL on GitHub (Aug 18, 2023).
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
I have a virtual machine running in Azure and I'd like to be able to limit the access to login or the server to one particular group in the AD, for example AZ.TCL.Users. This would contain all the users that would be allowed to log in to bookstack.
I wasn't sure if I needed to use the setting OIDC_GROUPS_CLAIM since we already have access groups set up. Maybe we need to create one called AZ.TCL.Users and then branch from there? In the past, we used the ClaimsIdentity in C#, pulled the 'name' and checked for a particular prefix. I didn't want to resort to messing with the code if there something close we could use.
Exact BookStack Version
v23.06.2
Log Content
No response
PHP Version
8.1
Hosting Environment
Ubuntu 22.04.3 LTS, installed using installation script
@ssddanbrown commented on GitHub (Aug 18, 2023):
Hi @BartNSTCL,
There's no way to specifically filter OIDC users from the BookStack side of things, at least without getting into hacks/workarounds. You could use group sync, and allow others from OIDC into the system by provide no permissions by default.
TBH, for systems like OIDC my perspective is for the auth system to be authority on who has access. From what I remember of AzureAD, you should be able to somewhat control who has access to the application from that side of things?
@BartNSTCL commented on GitHub (Aug 18, 2023):
Yeah, I felt I would have to go the Azure route. I see a way to give the group access but I didn't see an easy way to restrict everyone else. I might end up putting a ticket with microsoft about it.
@ssddanbrown commented on GitHub (Aug 18, 2023):
Do you have an "Assignment Required?" option as described on this page?: https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-restrict-your-app-to-a-set-of-users#update-the-app-to-require-user-assignment
@BartNSTCL commented on GitHub (Aug 18, 2023):
Man, I looked all over for that! I think I have it set. I'll have to test with someone else since I'm already set as an Admin. Thanks for all the help!
@ssddanbrown commented on GitHub (Aug 22, 2023):
Happy I could help. Will therefore close this off, but feel free to still comment if needed and I can re-open this.
From experience Azure changes seem to lag so be sure to give any app config changes an hour or so to be sure.