Advance OIDC to enable groups mapping

[manuel-sommer]

• Implement OIDC groups to be parsed.
• Added Unittests for update_oidc_groups and update_azure_groups

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request modifies several sensitive backend files (dojo/group/utils.py, dojo/pipeline.py, dojo/models.py, and a DB migration) triggering configured codepath edit alerts, and introduces two functional/security issues: a missing group ownership assignment in group_post_save_handler that can leave newly created groups orphaned during social auth flows, and a potential ReDoS risk from using an administrator-configured regex (OIDC_GROUPS_FILTER) to filter OIDC group names.

🔴 Configured Codepaths Edit in dojo/group/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/group/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/group/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/pipeline.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/pipeline.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/db_migrations/0247_alter_dojo_group_social_provider.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/pipeline.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/pipeline.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/pipeline.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/pipeline.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

Missing Group Ownership Assignment in dojo/group/utils.py

Vulnerability

Missing Group Ownership Assignment

Description

The group_post_save_handler is a post_save signal receiver for Django's Group model. It attempts to assign the currently logged-in user as the owner of a newly created group. However, during the initial social authentication flow (specifically, when a new user logs in via OIDC or AzureAD), the Dojo_User profile object might not yet exist, even though a standard auth.User object has been created. The get_current_user() function returns the auth.User object. The handler then attempts to retrieve the Dojo_User profile associated with this auth.User. If the Dojo_User does not exist at this point, the handler logs an error and returns early, skipping the critical step of assigning the user as a member and owner of the newly created Dojo_Group. This results in an 'orphaned' group that has no assigned owner or members, making it unmanageable through the application's UI or API.

django-DefectDojo/dojo/group/utils.py

Lines 46 to 47 in b069232

	logger.error(f"Group post-save: No Dojo_User found for user with pk '{user.pk}'.")
	return

Regular Expression Denial of Service (ReDoS) in dojo/pipeline.py

Vulnerability

Regular Expression Denial of Service (ReDoS)

Description

The update_oidc_groups function uses a regular expression defined in settings.OIDC_GROUPS_FILTER to filter group names received from an OIDC provider. While the regex is configured by a privileged administrator, a malicious or misconfigured OIDC provider could send a crafted group name that, when evaluated against a poorly constructed regex (e.g., one susceptible to catastrophic backtracking), could lead to excessive CPU consumption. This could cause a denial of service for the user attempting to log in, and potentially impact the server's performance if the regex operation is resource-intensive enough.

django-DefectDojo/dojo/pipeline.py

Lines 122 to 125 in b069232

	if group_filter and not re.search(group_filter, group_name):
	logger.debug(f"Skipping group '{group_name}' due to OIDC_GROUPS_FILTER: {group_filter}")
	continue
	filtered_group_names.append(group_name)

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.

[manuel-sommer]

@valentijnscholten could you please take a look here?

[manuel-sommer]

Shall I target this also against dev @valentijnscholten ?