mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-11 07:42:58 +03:00
🚀 Feature: Restrict acces to user-groups #451
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @stephanvane on GitHub.
Feature description
Hi,
I'm thinking about using pocket-id to handle authentication for multiple services. Each of them will have their own OIDC client.
The problem is that not every app has the same list of users. I'd like to be able to configure pocket-id in a way that, for example, allows:
Pitch
The 'user group' settings seemed suitable for this, but as far as I can find there is no way to restrict an OIDC client to only one (or more) user-groups.
Any thoughts? 😄
@stephanvane commented on GitHub:
Thank you for all the suggestions. Unfortunately it's often not that easy to let the client handle this. For example Immich, a pretty popular project, doesn't have any field to define a specific group to allow access for.
I'm sure they could add this, but it would be a pretty big task to expect every client to do this.
Keycloak supports realms
The way that pocket-id is designed now, would mean that I'd have to deploy one instance for every service that I want to give people access to.
To be able to share one user among multiple projects/realms would be perfect. But even a simpler solution where we can have multiple projects/realms with each their own set of users (leading to multiple accounts for some users) would be a pretty nice addition!
@stonith404 commented on GitHub:
@stephanvane In my opinion multiple projects/realms are an overkill for Pocket ID. The main goal of the project is to remain a simple OIDC provider. For more complex use cases, I would recommend using Keycloak.
@phil3741 commented on GitHub:
You can assign Custom Claims not only to users, but also to user groups.
e.g. I defined a Custom Claim "roles" -> "admin" for certain users and use that in my Caddy Reverse proxy (with AuthCrunch), where i defined an authorization policy based on this role.
That works for me to restrict admin access to certain apps via pocket ID
@stonith404 commented on GitHub:
I think this is something that should be handled by the client. Or do other providers like Keycloak support client authorization permissions?
@simono41 commented on GitHub:
Well, I only know that with Grafana (i.e. the OIDC client itself) that you have to be a member of a certain group and if not, then the certain user doesn't work for the login.
The user must either be in the grafana_admin group, and or be in the Admin group for the normal admin. If he is not in one or both groups, the user is not created.