OIDC: Disallow changing admin permissions for oidc users when OIDC group mapping is configured
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Active
- Tech stack
- go
- Domain
- authentication, authorization, backend
Research direction
Start by reviewing the OIDC login flow and the admin-permission synchronization introduced by #1033. Clarify whether the intended change is to block local permission edits, disable local login for linked users, or both. Done should include an agreed behavior and tests covering linked OIDC identities, password changes, local authentication, and permission updates.
Written by the indexing model from the issue text.
Description
When a local user is linked with a oidc identity. Or an oidc identity changes the password. They can still use local login. We currently don't really define a account type, so if the password is set, the user can use local auth. If the oidc_id is set, the user can login via oidc.
With the addition of #1033 the admin permissions are synced on oidc login and we maybe want to restrict changing the admin permissions for oidc users.
We also maybe want to disable local login when the user is linked to an oidc identity.
- Dominant language
- Go
- Stars
- 16.1k
- Forks
- 894
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 6
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from gotify/server
-
WebUI sends duplicate DELETE /message/{id} when leaving the page with pending deletesPossibly taken @shivampwm2020 claimed this today. Opena:bug
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
gotify/server#1068 · 1 reaction ·
Maintainers usually reply within 2 days
-
Session elevation duration is unbounded, and large values silently overflow to a past timestampPossibly taken @piyush295 claimed this 16 days ago. Opena:bug
Difficulty 3/5 1-2 days Newbie friendliness 78/100
gotify/server#1051 · 2 comments ·
Maintainers usually reply within 2 days
-
a:bug
Difficulty 4/5 3-5 days Newbie friendliness 48/100
gotify/server#1047 · 6 comments ·
Maintainers usually reply within 2 days
-
a:feature
Difficulty 5/5 Over a week Newbie friendliness 35/100
Maintainers usually reply within 2 days
-
a:feature
Difficulty 5/5 Over a week Newbie friendliness 30/100
Maintainers usually reply within 2 days
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
praetorian-inc/augustus#334 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
TestTOMLBigFileParsesInLinearTime: a 1s wall-clock bound on a 3 MB parse fails under load (1.27s)Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100