From: Victor Hooi <victorhooi@yahoo.com>
To: Dietmar Maurer <dietmar@proxmox.com>
Cc: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Subject: Re: [pve-devel] Groups for OpenID Connect?
Date: Fri, 24 Dec 2021 17:45:39 +1100 [thread overview]
Message-ID: <CAMnnoU+b7WJ9nuBVN3bCDH=YKDB4=ai3VXKKGvyRn2Dz8gNO=w@mail.gmail.com> (raw)
In-Reply-To: <567234771.1641.1640326947572@webmail.proxmox.com>
Hi,
This endpoint here would be Google Workspace (i.e. Google's OIDC provider).
Currently, in the Proxmox LDAP sync - it translates Google Groups (in the
Google Workspace domain) into LDAP groups, which is what we want.
I'm not too familiar with the OIDC - I do know that Google Workspace has
it's own APIs to lookup group membership:
https://stackoverflow.com/questions/16601699/determine-whether-user-is-group-member
https://developers.google.com/admin-sdk/directory/v1/guides/manage-groups#get_all_member_groups
It sounds like that might have to be added into Proxmox, though?
Thanks,
Victor
On Fri, 24 Dec 2021 at 17:22, Dietmar Maurer <dietmar@proxmox.com> wrote:
> > However, is there any support for groups in OpenID Connect, or a similar
> concept?
>
> In OpenID, it is possible to request "scopes" from the server, which can
> then send additional data (claims).
>
> But I am unsure if and how people use those system to manage groups. So
> what kind of OpenID server do you use, and how does it store the group
> information?
>
>
next prev parent reply other threads:[~2021-12-24 6:46 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-24 6:22 Dietmar Maurer
2021-12-24 6:45 ` Victor Hooi [this message]
2021-12-24 7:20 ` Josef Per Johansson
-- strict thread matches above, loose matches on Subject: below --
2021-12-24 10:14 Dietmar Maurer
[not found] <CAMnnoUJURoL9+hPix-J4b76DRXWSh9SKnDhwoES1C5cQR9x5wg.ref@mail.gmail.com>
2021-12-24 5:37 ` Victor Hooi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAMnnoU+b7WJ9nuBVN3bCDH=YKDB4=ai3VXKKGvyRn2Dz8gNO=w@mail.gmail.com' \
--to=victorhooi@yahoo.com \
--cc=dietmar@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.