Feature: Add the ability to auto assign users imported from an OIDC provider to a project with a default role

[solec0der]

Related to

Web-Backend (APIs), Configuration

Impact

nice to have for enterprise usage

Missing Feature

We use semaphore with an external OIDC provider to allow our users to use their company-managed account for Semaphore. Currently, whenever a new user logs in the first time, the user is currently not linked to a project, which is what I would expect.

We are missing a way to configure an automatic assignment to a project including a default role, if a user logs in the first time using a configured OIDC provider.

This would make onboarding much smoother.

Implementation

I would assume that there is some code executed upon first login through an external auth provider, since a user is created in the user table. Therefore, a possible design could look like this:

• Add new configuration properties to the oidc provider section. Something like this:

{
  "oidc_providers": {
    "mysso": {
      "display_name": "Sign in with MySSO",
      "color": "orange",
      "icon": "login",
      "provider_url": "https://mysso-provider.com",
      "client_id": "***",
      "client_secret": "***",
      "redirect_url": "https://your-domain.com/api/auth/oidc/mysso/redirect",
      "project_mappings": [
        {
          "project_id": "1",
          "default_role": "manager"
        }
      ]
    }
  }
}

Then, in the code, where the user is created in the semaphore database, check if the user is an external user and if it is, check the OIDC provider configuration to see, if there are project mappings configured. If that's the case, map the user.

Design

No response