[Missing Documented Feature] Azure AD docs describe group-to-role mapping that the code doesn't implement

Open Beginner friendly
  • Is something wrong?
#93 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Active
Tech stack
azure
Domain
authentication, documentation

Research direction

Start with docs/integration/azure_ad.md and compare its group mapping and Graph permission guidance with the current login settings described in the issue. Mark the unsupported mapping as planned and document the permissions the current flow needs; done when the page no longer presents unused group mapping or Graph permissions as current requirements.

Written by the indexing model from the issue text.

Description

Summary

docs/integration/azure_ad.md tells admins to:

  • create four Entra groups: CHAOTICA-Administrators, -Managers, -Consultants and -Sales
  • set "GROUPS_CLAIM": "groups" and "MIRROR_GROUPS": True

It also shows ADFS_GROUP_TO_ROLE_MAPPING, create_user_from_claims() and assign_roles_from_claims().

At b7c4f6c, none of this exists outside the docs:

  • The settings are hard-coded off: settings.py sets "GROUPS_CLAIM": None and "MIRROR_GROUPS": False, and no environment variable can change either.
  • There's no mapping: no ADFS_GROUP_TO_ROLE_MAPPING and no code that turns claims into roles.

So groups created from the docs do nothing, and every SSO user arrives with the default User role. The page also asks for application-level Graph permissions (User.ReadBasic.All, and optionally Group.Read.All and Directory.Read.All) that the current login flow doesn't use. That makes admins grant more than they need to.

Suggested fix

Either of these:

  • Mark the section as planned, not current. Say that only delegated openid, profile, email and User.Read are needed today.
  • Implement it, with two things to watch:
    • Entra sends group object IDs in the groups claim, not names. The mapping should key on IDs, or use app roles (roles claim) instead.
    • MIRROR_GROUPS replaces all of a user's Django groups on every login, which would wipe roles assigned in the app. A dedicated mapping that only adds or removes the mapped global role is safer.
Dominant language
HTML
Stars
6
Forks
4
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from brainthee/CHAOTICA

All issues in brainthee/CHAOTICA

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.