Feature: Restrict OIDC login by claim

[fzakfeld]

Related to

Web-Backend (APIs), Configuration

Impact

nice to have

Missing Feature

Currently all users of a configured OIDC provider can login and users are created automatically. It should be possible to only let OIDC users through when they have a specific claim, e.g. a role or group.

Implementation

If the claims look this

{
    "username": "foo",
    "groups": ["semaphore", "otherapp"]
}

Then I'd like to check if the "groups" claim contains "semaphore"

Design

Thinking about a config option with a Go Template which does the evaluation. This would be a flexible way of checking for specific strings, a string in a lists etc.