gitea/blog
44
20
Fork 31
Code Issues 10 Pull Requests 1 Actions Activity

Add feature-preview: Mapping-oidc-groups-to-teams #239

Merged
lunny merged 8 commits from techknowlogick-patch-1 into main 2023-03-20 13:06:53 +00:00
Conversation 10 Commits 8 Files Changed 14 +80 -1
techknowlogick commented 2023-03-09 22:02:35 +00:00
Owner
Copy Link
No description provided.
techknowlogick added 5 commits 2023-03-09 22:02:35 +00:00
Wrap up instructions
All checks were successful
continuous-integration/drone/pr Build is passing
Details
48f7d60c3d
website_pr_previewer_bot commented 2023-03-09 22:04:35 +00:00
First-time contributor
Copy Link

Website preview: http://preview-gitea-org-blog-blog-239.s3-website.eu-central-1.amazonaws.com/2023/03/feature-preview-mapping-oidc-groups-to-teams/

Website preview: http://preview-gitea-org-blog-blog-239.s3-website.eu-central-1.amazonaws.com/2023/03/feature-preview-mapping-oidc-groups-to-teams/
👍 2
jolheiser commented 2023-03-09 22:23:15 +00:00
Owner
Copy Link

I've created gitea/theme#125 so we can credit this author to their GH profile.

I've created https://gitea.com/gitea/theme/pulls/125 so we can credit this author to their GH profile.
delvh reviewed 2023-03-09 22:34:07 +00:00
content/post/feature-preview-mapping-oidc-groups-to-teams.md Outdated
@ -0,0 +69,4 @@
Update the Authentication Source and test it with OpenID login option. Your user should be added to the organization and team specified.
![Gitea screenshot copying in the OIDC Auto discovery URL and adding in the mapping](/demos/oidcmapping/12.png)
delvh commented 2023-03-09 22:34:07 +00:00
Owner
Copy Link

Should we perhaps convert all these images to .webp instead?

Should we perhaps convert all these images to `.webp` instead?
delvh reviewed 2023-03-09 23:37:51 +00:00
delvh left a comment
Owner
Copy Link

CAPS-LOCK should be converted to **bold**, and "text" should be converted into normal highlighting (`text`)

CAPS-LOCK should be converted to `**bold**`, and `"text"` should be converted into normal highlighting (`` `text` ``)
content/post/feature-preview-mapping-oidc-groups-to-teams.md Outdated
@ -0,0 +5,4 @@
draft: false
---
In the upcoming 1.19 release of Gitea a new feature is being adding that allows mapping of OIDC groups to Org Teams. One popular case for Gitea is using Azure Active Directory for authentication in Gitea, and now with OIDC group mapping you can map Active Directory user's groups to Gitea organization's teams. This allows for more centralized management of user's access to repositories and organizations.
delvh commented 2023-03-09 22:44:00 +00:00
Owner
Copy Link
The upcoming release of Gitea 1.19 adds the ability to map OIDC groups to organization teams. \
Gitea is often used in combination with the Azure Active Directory for authentication. \
Now, with OIDC group mapping you can map a user's Active Directory groups to Gitea organization teams. \
This allows for a more centralized user access management for repositories and organizations.
```md The upcoming release of Gitea 1.19 adds the ability to map OIDC groups to organization teams. \ Gitea is often used in combination with the Azure Active Directory for authentication. \ Now, with OIDC group mapping you can map a user's Active Directory groups to Gitea organization teams. \ This allows for a more centralized user access management for repositories and organizations.
techknowlogick marked this conversation as resolved
content/post/feature-preview-mapping-oidc-groups-to-teams.md Outdated
@ -0,0 +11,4 @@
<!-- instructions sourced originally from: https://github.com/go-gitea/gitea/pull/21441#issuecomment-1429706883 -->
To get this feature working, in breif you'll need creating an Azure Active Directory app, configuring Gitea to use that app, and then map Azure Active Directory groups to Gitea teams. This post will walk you through the steps to get this working.
delvh commented 2023-03-09 23:05:10 +00:00
Owner
Copy Link
To use this feature, you'll need to create an Azure Active Directory app, configure Gitea to use that app, and then map Azure Active Directory groups to Gitea teams. This post will walk you through the steps to get this working.
```md To use this feature, you'll need to create an Azure Active Directory app, configure Gitea to use that app, and then map Azure Active Directory groups to Gitea teams. This post will walk you through the steps to get this working.
techknowlogick marked this conversation as resolved
content/post/feature-preview-mapping-oidc-groups-to-teams.md Outdated
@ -0,0 +15,4 @@
Below I'll explain all the required steps to achieve the mapping of Azure user groups to different teams in Gitea, without having on-premise AD.
AZURE CONFIGURATION:
delvh commented 2023-03-09 23:08:56 +00:00
Owner
Copy Link

## Azure configuration

`## Azure configuration`
techknowlogick marked this conversation as resolved
content/post/feature-preview-mapping-oidc-groups-to-teams.md Outdated
@ -0,0 +17,4 @@
AZURE CONFIGURATION:
Create an application in App Registrations. The Redirect URI is not needed to be configured at this point.
delvh commented 2023-03-09 23:17:17 +00:00
Owner
Copy Link

You don't need the `Redirect URI` at this point.

``You don't need the `Redirect URI` at this point.``
techknowlogick marked this conversation as resolved
content/post/feature-preview-mapping-oidc-groups-to-teams.md Outdated
@ -0,0 +49,4 @@
![Azure screenshot showing adding/removing groups to use for mapping](/demos/oidcmapping/8.png)
GITEA CONFIGURATION:
delvh commented 2023-03-09 23:30:37 +00:00
Owner
Copy Link

## Gitea configuration

`## Gitea configuration`
techknowlogick marked this conversation as resolved
content/post/feature-preview-mapping-oidc-groups-to-teams.md Outdated
@ -0,0 +51,4 @@
GITEA CONFIGURATION:
In the site configuration, under Authentication Sources section, create a new OAuth2 one.
delvh commented 2023-03-09 23:31:20 +00:00
Owner
Copy Link

…create a new OAuth2 authentication source

`…create a new OAuth2 authentication source`
techknowlogick marked this conversation as resolved
content/post/feature-preview-mapping-oidc-groups-to-teams.md
@ -0,0 +58,4 @@
![Gitea screenshot of adding a new Auth Source](/demos/oidcmapping/9.png)
For the "OpenID Connect Auto Discovery URL" option, go to Azure and in the registered app Overview, click on "Endpoints" and copy the OpenID Connect metadata document.
![TODO: add desc](/demos/oidcmapping/10.png)
delvh commented 2023-03-09 23:33:23 +00:00
Owner
Copy Link

![Azure screenshot showing the metadata document of the endpoints]

`![Azure screenshot showing the metadata document of the endpoints]`
techknowlogick marked this conversation as resolved
content/post/feature-preview-mapping-oidc-groups-to-teams.md Outdated
@ -0,0 +60,4 @@
For the "OpenID Connect Auto Discovery URL" option, go to Azure and in the registered app Overview, click on "Endpoints" and copy the OpenID Connect metadata document.
![TODO: add desc](/demos/oidcmapping/10.png)
In "Addition Scopes" you can add "openid email profile".
delvh commented 2023-03-09 23:34:17 +00:00
Owner
Copy Link

Additional Scopes

`Addition`**al** `Scopes`
techknowlogick marked this conversation as resolved
content/post/feature-preview-mapping-oidc-groups-to-teams.md Outdated
@ -0,0 +67,4 @@
And finally, in "Map claimed groups to Organization teams.", write the Object ID of the group that you want to map from Azure (in our case, the Object ID of the Azure group "ce-operations"), the name of the organization where you want users to be added automatically (in our case "creamteam"), and the team of the organization (in our case "Developers"). NOTE: organization and team HAVE TO BE ALREADY CREATED.
![Azure screenshot copying OIDC Auto discovery URL](/demos/oidcmapping/11.png)
Update the Authentication Source and test it with OpenID login option. Your user should be added to the organization and team specified.
delvh commented 2023-03-09 23:36:45 +00:00
Owner
Copy Link

Your user should be a member of the organization and team.

`Your user should be a member of the organization and team.`
techknowlogick marked this conversation as resolved
techknowlogick added 1 commit 2023-03-10 02:55:39 +00:00
update per delvh feedback
All checks were successful
continuous-integration/drone/pr Build is passing
Details
3a1bf74bd7
techknowlogick commented 2023-03-10 03:11:24 +00:00
Author
Owner
Copy Link

Thanks for feedback @delvh, I've updated :)

Thanks for feedback @delvh, I've updated :)
KN4CK3R reviewed 2023-03-10 13:43:39 +00:00
content/post/feature-preview-mapping-oidc-groups-to-teams.md
@ -0,0 +74,4 @@
![Gitea screenshot copying in the OIDC Auto discovery URL and adding in the mapping](/demos/oidcmapping/12.png)
Finally, a big thank you to [KN4CK3R](https://gitea.com/KN4CK3R) for their work on the PR that made this possible.
KN4CK3R commented 2023-03-10 13:43:39 +00:00
Member
Copy Link

"for his work"?

"for his work"?
😆 2
KN4CK3R commented 2023-03-10 13:45:49 +00:00
Member
Copy Link

This tutorial should be part of the Gitea docs.

In https://github.com/go-gitea/gitea/pull/21441#issuecomment-1419438000 I show the steps for configuring Keycloak. That should be added to the docs too.

This tutorial should be part of the Gitea docs. In https://github.com/go-gitea/gitea/pull/21441#issuecomment-1419438000 I show the steps for configuring Keycloak. That should be added to the docs too.
jolheiser reviewed 2023-03-10 13:49:53 +00:00
content/post/feature-preview-mapping-oidc-groups-to-teams.md
@ -0,0 +1,79 @@
---
date: "2023-03-09T01:00:00+01:00"
author: "13tm3nt3r"
jolheiser commented 2023-03-10 13:49:53 +00:00
Owner
Copy Link
author: "https://github.com/13tm3nt3r"

Should work now that the theme pull above was merged.

``` author: "https://github.com/13tm3nt3r" ``` Should work now that the theme pull above was merged.
lunny commented 2023-03-10 14:46:39 +00:00
Owner
Copy Link

This tutorial should be part of the Gitea docs.

In https://github.com/go-gitea/gitea/pull/21441#issuecomment-1419438000 I show the steps for configuring Keycloak. That should be added to the docs too.

I prefer to move usage documentation out of Gitea's current documentation.

> This tutorial should be part of the Gitea docs. > > In https://github.com/go-gitea/gitea/pull/21441#issuecomment-1419438000 I show the steps for configuring Keycloak. That should be added to the docs too. I prefer to move usage documentation out of Gitea's current documentation.
jolheiser commented 2023-03-10 14:48:20 +00:00
Owner
Copy Link

Alternatively, could we just link the blog post from our docs?

Alternatively, could we just link the blog post from our docs?
👍 2 👎 1
KN4CK3R commented 2023-03-10 16:00:41 +00:00
Member
Copy Link

I prefer to move usage documentation out of Gitea's current documentation.

Why? What should the documentation contain then?

> I prefer to move usage documentation out of Gitea's current documentation. Why? What should the documentation contain then?
👍 1
delvh approved these changes 2023-03-16 22:46:55 +00:00
delvh left a comment
Owner
Copy Link

Hmm, apart from the open comments LGTM.

Hmm, apart from the open comments LGTM.
lunny approved these changes 2023-03-17 03:59:57 +00:00
content/post/feature-preview-mapping-oidc-groups-to-teams.md
@ -0,0 +74,4 @@
![Gitea screenshot copying in the OIDC Auto discovery URL and adding in the mapping](/demos/oidcmapping/12.png)
Finally, a big thank you to [KN4CK3R](https://gitea.com/KN4CK3R) for their work on the PR that made this possible.
lunny commented 2023-03-10 14:44:51 +00:00
Owner
Copy Link

You are one but like ten. :)

You are one but like ten. :)
lunny marked this conversation as resolved
lunny added 1 commit 2023-03-17 04:00:06 +00:00
Merge branch 'main' into techknowlogick-patch-1
Some checks failed
continuous-integration/drone/pr Build is failing
Details
65c85ec9b4
lunny added 1 commit 2023-03-20 12:49:25 +00:00
upgrade hugo to 0.111.3
All checks were successful
continuous-integration/drone/pr Build is passing
Details
b637ecda2f
lunny merged commit 9b44f2772e into main 2023-03-20 13:06:53 +00:00
delvh commented 2023-03-20 13:20:56 +00:00
Owner
Copy Link

Erm… Did we just merge the blog entry without the two requested changes?

Erm… Did we just merge the blog entry without the two requested changes?
KN4CK3R commented 2023-03-20 13:22:54 +00:00
Member
Copy Link

I'm still untyped 😏

I'm still untyped :smirk:
lunny commented 2023-03-20 15:23:51 +00:00
Owner
Copy Link

I'm still untyped 😏

Sorry missed them.

> I'm still untyped :smirk: Sorry missed them.
Sign in to join this conversation.
Reviewers
No reviewers
delvh
lunny
Labels
Clear labels   
in progress

   
kind/bug

   
kind/deployment

   
kind/docs

   
kind/enhancement

   
kind/feature

   
kind/lint

   
kind/proposal

   
kind/question

   
kind/security

   
kind/testing

   
kind/translation

   
kind/ui

   
lgtm/done

   
lgtm/need 1

   
lgtm/need 2

   
priority/critical

   
priority/low

   
priority/maybe

   
priority/medium

   
reviewed/duplicate

   
reviewed/invalid

   
reviewed/wontfix

   
status/blocked

   
status/needs-feedback

   
status/wip
No Label
in progress
kind/bug
kind/deployment
kind/docs
kind/enhancement
kind/feature
kind/lint
kind/proposal
kind/question
kind/security
kind/testing
kind/translation
kind/ui
lgtm/done
lgtm/need 1
lgtm/need 2
priority/critical
priority/low
priority/maybe
priority/medium
reviewed/duplicate
reviewed/invalid
reviewed/wontfix
status/blocked
status/needs-feedback
status/wip
Milestone
Clear milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
6 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: gitea/blog#239
No description provided.
Delete Branch "techknowlogick-patch-1"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?