Skip to content

feat(oidc): Add role based access control #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jacknbeans wants to merge 3 commits into
base: feat/oidc-login-v3
Choose a base branch
from
Open

feat(oidc): Add role based access control #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d4e6a35
feat(oidc): added role based authorization
jacknbeans Jun 19, 2026
df93d06
fix(oidc): added broken changes from cherry-picked commit
jacknbeans Jun 22, 2026
6643aaf
fix(oidc): missed changing from 'react-toast'notifications' to '@app/…
jacknbeans Jun 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions server/lib/settings/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,8 @@ export type OidcProvider = {
logo?: string;
requiredClaims?: string;
scopes?: string;
roleClaim?: string;
userRoles?: string;
newUserLogin?: boolean;
};

Expand Down
42 changes: 33 additions & 9 deletions server/routes/auth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -721,15 +721,15 @@ authRoutes.get('/oidc/login/:slug', async (req, res, next) => {
* is why we're using it regardless. Like PKCE, random state must be generated
* for every redirect to the authorization_endpoint.
*/
if (!config.serverMetadata().supportsPKCE()) {
const state = openIdClient.randomState();
parameters.state = state;
res.cookie('oidc-state', state, {
maxAge: 60000,
httpOnly: true,
secure: req.protocol === 'https',
});
}
// if (!config.serverMetadata().supportsPKCE()) {

@jacknbeans jacknbeans Jun 22, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure why the state generation is commented out if PKCE is supported. My Authelia server throws an error without the state parameter and I believe it breaks the security layers. Since PKCE and state solve different issues, unless I am mistaken in my understanding.

const state = openIdClient.randomState();
parameters.state = state;
res.cookie('oidc-state', state, {
maxAge: 60000,
httpOnly: true,
secure: req.protocol === 'https',
});
// }

let redirectUrl: URL;
try {
Expand Down Expand Up @@ -867,6 +867,30 @@ authRoutes.post('/oidc/callback/:slug', async (req, res, next) => {
return value === true;
});

let hasUserRole = false;
const roleClaim = provider.roleClaim;
if (roleClaim) {
const providerUserRoles = provider.userRoles?.split(',') ?? [];
const userRoles = fullUserInfo[roleClaim];
hasUserRole = providerUserRoles.some((providerUserRole) =>
Array.isArray(userRoles)
? userRoles.some((userRole) => providerUserRole === userRole)
: false
);

if (!hasUserRole) {
logger.info('Failed OIDC login attempt', {
cause: 'Failed to validate user role claims',
ip: req.ip,
userRoleClaims: provider.userRoles,
});
return next({
status: 403,
error: ApiErrorCode.Unauthorized,
});
}
}

if (!hasRequiredClaims) {
logger.info('Failed OIDC login attempt', {
cause: 'Failed to validate required claims',
Expand Down
63 changes: 56 additions & 7 deletions src/components/Settings/EditOidcModal/index.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ import Accordion from '@app/components/Common/Accordion';
import Button from '@app/components/Common/Button';
import Modal from '@app/components/Common/Modal';
import SensitiveInput from '@app/components/Common/SensitiveInput';
import useToasts from '@app/hooks/useToasts';
import globalMessages from '@app/i18n/globalMessages';
import defineMessages from '@app/utils/defineMessages';
import { Transition } from '@headlessui/react';
Expand All @@ -13,7 +14,6 @@ import axios from 'axios';
import { Field, Formik, useFormikContext, type FieldAttributes } from 'formik';
import { useEffect, useState } from 'react';
import { useIntl } from 'react-intl';
import { useToasts } from 'react-toast-notifications';
import { twMerge } from 'tailwind-merge';
import * as Yup from 'yup';

Expand Down Expand Up @@ -41,6 +41,11 @@ const messages = defineMessages('settings.settings.SettingsOidc', {
oidcRequiredClaims: 'Required Claims',
oidcRequiredClaimsTip:
'Space-separated list of boolean claims that are required to log in',
oidcRoleClaim: 'Role Claim',
oidcRoleClaimTip: 'The claim that holds the user roles',
oidcUserRoles: 'User Roles',
oidcUserRolesTip:
'Comma-separated list of roles that a user must have to authorize access',
oidcNewUserLogin: 'Allow New Users',
oidcNewUserLoginTip:
'Create accounts for new users logging in with this provider',
Expand Down Expand Up @@ -98,6 +103,8 @@ export default function EditOidcModal(props: EditOidcModalProps) {
logo: Yup.string(),
requiredClaims: Yup.string(),
scopes: Yup.string(),
roleClaim: Yup.string(),
userRoles: Yup.string(),
newUserLogin: Yup.boolean(),
});

Expand All @@ -111,7 +118,7 @@ export default function EditOidcModal(props: EditOidcModalProps) {
});

props.onOk();
} catch (e) {
} catch {
addToast(intl.formatMessage(messages.saveError), {
appearance: 'error',
autoDismiss: true,
Expand All @@ -128,10 +135,12 @@ export default function EditOidcModal(props: EditOidcModalProps) {
issuerUrl: props.provider?.issuerUrl ?? '',
clientId: props.provider?.clientId ?? '',
clientSecret: props.provider?.clientSecret ?? '',
logo: props.provider?.logo,
requiredClaims: props.provider?.requiredClaims,
scopes: props.provider?.scopes,
newUserLogin: props.provider?.newUserLogin,
logo: props.provider?.logo ?? '',
requiredClaims: props.provider?.requiredClaims ?? '',
scopes: props.provider?.scopes ?? '',
roleClaim: props.provider?.roleClaim ?? '',
userRoles: props.provider?.userRoles ?? '',
newUserLogin: props.provider?.newUserLogin ?? false,
}}
validationSchema={oidcSettingsSchema}
onSubmit={onSubmit}
Expand All @@ -149,7 +158,7 @@ export default function EditOidcModal(props: EditOidcModalProps) {
autoDismiss: true,
appearance: 'success',
});
} catch (e) {
} catch {
addToast(intl.formatMessage(messages.toastTestFailed), {
autoDismiss: true,
appearance: 'error',
Expand Down Expand Up @@ -394,6 +403,46 @@ export default function EditOidcModal(props: EditOidcModalProps) {
)}
</div>
</div>
<div className="form-row">
<label htmlFor="oidcRoleClaim" className="text-label">
{intl.formatMessage(messages.oidcRoleClaim)}
<span className="label-tip">
{intl.formatMessage(messages.oidcRoleClaimTip)}
</span>
</label>
<div className="form-input-area">
<Field
id="oidcRoleClaim"
name="roleClaim"
type="text"
/>
{errors.roleClaim &&
touched.roleClaim &&
typeof errors.roleClaim === 'string' && (
<div className="error">{errors.roleClaim}</div>
)}
</div>
</div>
<div className="form-row">
<label htmlFor="oidcUserRoles" className="text-label">
{intl.formatMessage(messages.oidcUserRoles)}
<span className="label-tip">
{intl.formatMessage(messages.oidcUserRolesTip)}
</span>
</label>
<div className="form-input-area">
<Field
id="oidcUserRoles"
name="userRoles"
type="text"
/>
{errors.userRoles &&
touched.userRoles &&
typeof errors.userRoles === 'string' && (
<div className="error">{errors.userRoles}</div>
)}
</div>
</div>
<div className="form-row">
<label
htmlFor="oidcNewUserLogin"
Expand Down
4 changes: 2 additions & 2 deletions src/components/Settings/SettingsOidc/index.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ import Button from '@app/components/Common/Button';
import ConfirmButton from '@app/components/Common/ConfirmButton';
import Modal from '@app/components/Common/Modal';
import EditOidcModal from '@app/components/Settings/EditOidcModal';
import useToasts from '@app/hooks/useToasts';
import globalMessages from '@app/i18n/globalMessages';
import defineMessages from '@app/utils/defineMessages';
import { Transition } from '@headlessui/react';
Expand All @@ -11,7 +12,6 @@ import type { OidcProvider, OidcSettings } from '@server/lib/settings';
import axios from 'axios';
import { useState } from 'react';
import { useIntl } from 'react-intl';
import { useToasts } from 'react-toast-notifications';
import useSWR from 'swr';

const messages = defineMessages('components.Settings.SettingsOidc', {
Expand Down Expand Up @@ -52,7 +52,7 @@ export default function SettingsOidc(props: SettingsOidcProps) {
`/api/v1/settings/oidc/${provider.slug}`
);
revalidate(response.data);
} catch (e) {
} catch {
addToast(intl.formatMessage(messages.deleteError), {
autoDismiss: true,
appearance: 'error',
Expand Down
2 changes: 1 addition & 1 deletion src/components/Settings/SettingsUsers/index.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import PermissionEdit from '@app/components/PermissionEdit';
import QuotaSelector from '@app/components/QuotaSelector';
import SettingsOidc from '@app/components/Settings/SettingsOidc';
import useSettings from '@app/hooks/useSettings';
import useToasts from '@app/hooks/useToasts';
import globalMessages from '@app/i18n/globalMessages';
import defineMessages from '@app/utils/defineMessages';
import { ArrowDownOnSquareIcon, CogIcon } from '@heroicons/react/24/outline';
Expand All @@ -15,7 +16,6 @@ import axios from 'axios';
import { Field, Form, Formik } from 'formik';
import { useState } from 'react';
import { useIntl } from 'react-intl';
import { useToasts } from 'react-toast-notifications';
import useSWR, { mutate } from 'swr';
import * as yup from 'yup';

Expand Down