Provide an OIDC implementation that fetches user groups and updates the user according to IdP

Frappe Framework
, ,
1

Hi,

is anyone interested in implementing a “correct” OIDC implementation, that fetches and updates the user information from identity provider (like enabled/disabled, and fetching the groups of the use), rather than just logging in and creating the user and then never check from the IdP anymore?

In addition, at the moment if signup is disabled, my users will not be able also to login using their IdP accounts (if it is their first time). However, I do want them to be able to login using the IdP (even it seems to be their first login or signup because they do not exist in ERPNext yet).

This is going to be helpful in:

  • Fetching the groups of users from the IdP and updating them when changed in the Idp accordingly.
  • Being able to enable/disable the user when disabled in the IdP.

So in the end, this will enable a centralized management of user, not just create the user and then forget about it. I found a similar proposal as a GitHub feature request, but it has been open for about 8 years and but it seems to not getting enough attention, although this is really a hard-core enterprise feature.

I may help as far as possible also in this implementation if anyone is interested.

Maybe we should not necessarily reimplement everything from scratch, we may just extend the current social login integration (when possible).

UPDATE

After testing the Social Login app thoroughly, I can say that we really need a real OIDC client implementation, that allows the user to login (even for the first time, when the sign up is disabled), sync the user info updates, and of course fetch the groups from the claim.

Would be any timeline to implement this?

2

Well, I implemented it by myself as a custom app. It is totally isolated, so no worry about your current setup.

OIDC Extended

An extension to the ERPNext Social Login authentication method (OIDC) that incorporates new features designed to meet the needs of enterprises.

Features:

  • Group to Role mapping: maps the received groups as token claim to ERPNext roles.
  • Customizable claim names.
  • Specify the default role for the users that haven’t logged in yet.
  • Automatically creates users from trusted identity providers even if signup is disabled in the site.

image

2 Likes
3

Nice!

Just a suggestion, in the next iteration make the id_token properties configurable. In callback.py

The keys may differ. Let the current strings be default like "sub" for user id.

“email” can be “verified_email” or something else. “groups” can be “roles”

Different providers may have different keys.

1 Like
4

Thank you for your feedback, @revant_one!

You are right, I was planning to do that in the next version. I have just implemented it.

image

1 Like