good first issue
倉庫指標
- 星標
- (3,613 顆星)
- PR 合併指標
- (PR 指標待抓取)
描述
Describe the problem to be solved
This was initially posted on the community forum, but I was instructed to make a feature request.
I’m setting up self-hosted grist for my company with multiple orgs.
Not all users that are able to log in via OIDC should have access to Grist. However, Grist creates a new user and a “Personal Team” at domain /o/docs-{UserID} for every unrecognized user.
Describe the solution you would like
Either of the following
- Users are exclusively created by GRIST_SUPPORT_EMAIL via SCIM APIs. Once user profile info is retrieved from OIDC, if user does not exist, then 403 Forbidden.
- Unrecognized User logs in via OIDC and a new user is created, but no personal orgs are created thus user does not belong to any org and is shown the Access Denied screen when landing on /o/docs. It'd also be important to prevent the user from creating new orgs, via UI and API. Users are added to orgs exclusively by GRIST_SUPPORT_EMAIL via API.