Skip to content

Add setting user property via the roles claim #111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
d-led wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Add setting user property via the roles claim #111

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8ec697b
feat: set user property via roles claim
d-led Dec 15, 2023
2f85a17
allow role in the settings schema
d-led Jan 25, 2024
51d7b98
better role check
d-led Jan 25, 2024
c653c5c
upgrading direct and dev dependencies to eliminate CVEs
d-led Jan 25, 2024
1a31cd3
Revert "upgrading direct and dev dependencies to eliminate CVEs"
d-led Feb 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,13 +183,16 @@ provides suitable claims:
"ep_openid_connect": {
"scope": ["openid", "etherpad"],
"user_properties": {
"is_admin": {"claim": "etherpad_is_admin"},
"is_admin": {"role": "etherpad_is_admin"},
"readOnly": {"claim": "etherpad_readOnly"},
"canCreate": {"claim": "etherpad_canCreate"}
}
},
```

The `role` config sets the property to `true` if the role is found in the `roles`
claim array.

To avoid breaking assumptions made by Etherpad, the `username` property cannot
be altered via the `user_properties` setting.

Expand Down
3 changes: 3 additions & 0 deletions index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ const validSettings = new Ajv().compile({
user_properties: {values: {
optionalProperties: {
claim: {type: 'string'},
role: {type: 'string'},
default: {type: 'string'},
},
nullable: true,
Expand Down Expand Up @@ -215,6 +216,8 @@ exports.authenticate = (hookName, {req, res, users}) => {
delete req.session.user[propName];
} else if (descriptor.claim != null && descriptor.claim in userinfo) {
req.session.user[propName] = userinfo[descriptor.claim];
} else if (descriptor.role != null && userinfo.roles.indexOf(descriptor.role) !== -1) {
req.session.user[propName] = 'true';
} else if ('default' in descriptor && !(propName in req.session.user)) {
req.session.user[propName] = descriptor.default;
}
Expand Down