Group mapping

[maxiride]

Feature Description

If the feature is available but undocumented please redirect me to the correct source as I didn't find it. If the feature ownership is to the father plugin oauth I didn't find this feature there either.

---

If an admin wants to manage groups through the Entra ID platform (ex Azure) it's possible to turn on the feature plugin»oauth»overwrite-groups (in the father oauth plugin), however seems to me that currently the oauthazure plugin lacks a group mapping feature to local DokuWiki groups.

Example conf/local.php:

$conf['plugin']['oauthazure']['map-group-claim'] = 'groups';
$conf['plugin']['oauthazure']['group-mapping'] = [
    '62427966-e155-4952-a1d1-5acfd0daaf0f' => 'admin',
    '6a51228f-da9a-442f-a6a6-2e4876dbdb2b' => 'editor',
    'f4a64fe4-0a7a-4309-a72f-8fd4b5981d43' => 'writer'
];

1. Is this feature in the scope of oauth or oauthazure?
2. Regardless of the feature ownership would you be interested in a PR to implement it?

[splitbrain]

We don't have access to a permanent Azure account and only work on this on client commision. It seems absurd to me having to map UUIDs to group names on the DokuWiki side - the IdP should provide group names. Last time I worked on this it worked fine when enabling the fetchgroups config.

[maxiride]

Last time I worked on this it worked fine when enabling the fetchgroups config.

My bad I didn't enable this option but only plugin»oauth»overwrite-groups while also enabling in Entra ID the option for additional claims which defaults to the group ID. So these two effects made the group ID show in DokuWiki.

What I did was totally unnecessary since reverting everything and enabling plugin»oauthazure»fetchgroups fetched the groups correctly.

However, I sadly discover now that a different Entra ID licence is needed to avoid returning all the groups a user is member of. The User management page is now flooded with just 10 users. Along with the group verbose names, I also get all the IDs, so with just 10 groups, the user management UI exploded. Not a DokuWiki nor the oauth plugin fault of course.

Anyway I see that the group names are sanitized with underscore in place of spaces and all lower case (is it the IdP returning them like so or the plugin manipulated them?), but I'd still advocate for a group mapping through IDs on the DokuWiki side, I recognize it's an opinionated approach though.

• Group names are meant as descriptive and subjective to change, that would disrupt the user experience in the event of a change
• Group IDs are unique, persistent and immutable, they would provide a robust and resilient link to the IdP groups