[Enhancement]: Allow specification of OIDC user role and permissions with attribute mappings

[DonQuinleone]

Describe the feature/enhancement

I have managed to configure OIDC authentication for ABS, which is working brilliantly, but if I want to make someone an admin or give them additional permissions, this still has to be done via ABS' admin page.

It would be much better if we could manage roles and permissions via the OIDC provider, so can you add support for claims and attribute mappings to add this functionality please?

[Sapd]

I think I would implement it like this:

{
  "sub": "1234567890",
  "name": "John Doe",
  "email": "john.doe@example.com",
  "groups": ["user"], // Can include user, admin or guest, highest will be taken. Names configurable and scopename configurable
  "abspermissions": { // name of the scope configurable
    "canDownload": true,
    "canUpload": false,
    "canDelete": false,
    "canAccessExplicitContent": true,
    "canAccessAllLibraries": false,
    "allowedLibraries": ["Library1", "Library2"],
    "canAccessAllTags": false,
    "allowedTags": ["Tag1", "Tag2"]
  }
}

While making the name of the claim groups, abspermissions configurable.
Also name of the groups itself would be configurable, so name of user, admin, guest.
But I would however not make the name of the permissions inside abspermissions configurable given the complexity, one should be able to just add that json into the claims of the Idp.

So in the end basically we would have 5 new options in the Admin-Page to configure. All being optional.

What do you think?

[DonQuinleone]

@Sapd This sounds like a great approach.

I don't think it's necessary to make the names of the "user", "admin" and "guest" groups customisable, since we can just map our own group names to these at the IdP. Simpler to keep these aligned with what are used at present.

I do like the suggestion of making the two scope names configurable, however.

Very happy to help with testing once a PR has been submitted.

Thanks!

[Sapd]

Implemented in PR #2769

[advplyr]

Added in v2.9.0