通过认证管理群组成员

angus · 2021 年11 月 8 日 06:10

请注意，我已经更新了PR草稿，采用了新的方法（整合了@david在我上次尝试中提出的更改）。正如PR评论中所述，我希望在本周内完成它。

github.com/discourse/discourse

Group membership via google hd authentication

main ← angusmcleod:group_membership_via_authentication

opened 06:06AM - 08 Nov 21 UTC

angusmcleod

+926 -16

Update on #12446. @davidtaylorhq A draft for an update on the associated grou…p membership work. It's been rebased, brought in line with the latest changes and updated in the ways explained below. Let me know if you're onboard with the approach so far. I'll finish it off next weekend. ### Authentication and group retrieval I've removed the secondary auth stuff, added a google-hd-specific boolean setting, and moved the group retrieval into a new google oauth2 omniauth strategy. I've made a new folder and added a spec for the strategy (something new in the codebase) as I thought it deserved a spec (which is also included). If we add in secondary auth to this strategy that too will need a spec. Some of the existing discourse omniauth strategies, e.g. Discord, may benefit from being seperated out and tested too. ### Group Provision and UI As suggested, I've added a ``provides_groups?`` to the ``Auth::Authenticator``. Using this approach led to a new groups guardian method to use at the various group CRUD points. Speaking of which, I've added in support for group_associated_group creation in group creation (i.e. ``/g/custom/new``). Supporting it in both ``new`` and ``manage`` (update) also led to adding a new site attribute ``can_associate_groups``. I attempted to make this more group-route specific, however this leads to various clumsy workarounds to determine whether an admin can associate groups in ``/g/custom/new``. The site attribute approach proved the simplest and most performant (i.e. fewer ajax calls). ### Data model I've made one change to the data model so far, namely to use ``after_commit`` hooks rather than ``after_create``/``after_destroy`` as using those hooks leads to duplicate record creation in ``Admin::GroupsController`` ``create``. I've yet to deal with the edge case you pointed out, i.e. multiple UserAssociatedGroups which link to the same group.

mattdm · 2021 年11 月 8 日 14:57

这样我就不会白激动一场了——这上面写着“google”……它也能用于非google的oauth2 sso吗？

angus · 2021 年11 月 8 日 15:01

这是一个通用系统，但第一个支持的用例将是 Google Workspace 中的群组。一旦系统到位，添加对其他提供商的支持将不会太难。

angus · 2021 年11 月 22 日 06:06

请注意，此拉取请求已在周末从草稿移至已发布（即，它已准备好再次进行审查）。

github.com/discourse/discourse

Group membership via google hd authentication

main ← angusmcleod:group_membership_via_authentication

opened 06:06AM - 08 Nov 21 UTC

angusmcleod

+926 -16

Update on #12446. @davidtaylorhq A draft for an update on the associated grou…p membership work. It's been rebased, brought in line with the latest changes and updated in the ways explained below. Let me know if you're onboard with the approach so far. I'll finish it off next weekend. ### Authentication and group retrieval I've removed the secondary auth stuff, added a google-hd-specific boolean setting, and moved the group retrieval into a new google oauth2 omniauth strategy. I've made a new folder and added a spec for the strategy (something new in the codebase) as I thought it deserved a spec (which is also included). If we add in secondary auth to this strategy that too will need a spec. Some of the existing discourse omniauth strategies, e.g. Discord, may benefit from being seperated out and tested too. ### Group Provision and UI As suggested, I've added a ``provides_groups?`` to the ``Auth::Authenticator``. Using this approach led to a new groups guardian method to use at the various group CRUD points. Speaking of which, I've added in support for group_associated_group creation in group creation (i.e. ``/g/custom/new``). Supporting it in both ``new`` and ``manage`` (update) also led to adding a new site attribute ``can_associate_groups``. I attempted to make this more group-route specific, however this leads to various clumsy workarounds to determine whether an admin can associate groups in ``/g/custom/new``. The site attribute approach proved the simplest and most performant (i.e. fewer ajax calls). ### Data model I've made one change to the data model so far, namely to use ``after_commit`` hooks rather than ``after_create``/``after_destroy`` as using those hooks leads to duplicate record creation in ``Admin::GroupsController`` ``create``. I've yet to deal with the edge case you pointed out, i.e. multiple UserAssociatedGroups which link to the same group.

david · 2021 年12 月 9 日 12:32

我刚刚合并了这个 PR - 非常感谢 Angus 在这里付出的所有努力！很高兴看到它将如何被使用和扩展！

我现在将该网站设置标记为“实验性”，以便我们有一些时间进行测试并确保一切运行顺利。一旦我们确信并且在更多身份验证提供商中添加了支持，我一定会为该功能创建一个 #feature:announcements 主题。

angus · 2021 年12 月 9 日 13:44

太棒了！

谢谢你，David。没有你的支持，这一切都不会发生。很高兴能帮助添加额外的提供商。

mattdm · 2021 年12 月 9 日 14:18

太棒了！谢谢大家。我们计划在 Fedora 中广泛使用它，一旦它能与 oauth2 一起工作。

jimkleiber · 2022 年3 月 10 日 23:57

我也很期待此功能支持非 Google oauth2/openID 登录……有什么关于该选项何时可用的更新吗？

david · 2022 年3 月 11 日 11:49

我们没有具体的时间表，但如果您想提交补丁，我们非常欢迎 #pr-welcome。

agungor · 2022 年5 月 19 日 15:11

我也期待这个！对我们来说，用例是在身份验证时从 Keycloak 拉取组成员身份。

irregular · 2024 年8 月 11 日 22:25

我目前正在自托管 Discourse，并使用 Authentik 作为我的身份提供商进行身份验证。我想实现的是在登录时自动将 Authentik 中的用户组与 Discourse 中的特定组同步。

但是……我想确保通过 Discourse 本地注册流程注册的本地用户不会被分配到这些特定组，而是遵循正常的信任级别进展。

bsoares · 2025 年9 月 10 日 16:42

您好！

我们已将身份验证从 Atlassian Crowd（Discourse 不再支持）迁移到 OpenID Connect（通过 Keycloak），并希望在 discourse-openid-connect 插件中使用我们几年前贡献的 Crowd 组映射代码。

我们已经完成了代码更改，允许在 OpenID Connect 组和 Discourse 组之间进行配置映射，并已将其提交到 PR FEATURE: Openid connect group maps by benzoid · Pull Request #34763 · discourse/discourse · GitHub 。

希望这可以被考虑合并，并且我们愿意添加文档或测试（如果有人能为我指出测试指南——我不是一个母语为 Ruby 的程序员（还不是）！）。

Ben

话题		回复	浏览量
Memberpress: how to add users to groups upon Sign up WordPress	40	9362	2024 年6 月 8 日
Manage group membership in Discourse with WP Discourse SSO Administrators wordpress , groups , payments , how-to	77	17269	2023 年5 月 7 日
Allow moderators to add a member to a group? Feature	49	11037	2017 年12 月 28 日
Improved Group Members Management Feature rfc , spec	31	11152	2016 年1 月 7 日
Groups API - manually syncing group membership? Dev rest-api	8	1698	2022 年12 月 13 日

通过认证管理群组成员

相关话题