[QUESTION] Can admin rights only be assigned to certain OIDC users?

[herbeauslese]

Question

Dear team & community,

First of all, thank you for this great tool! We are very happy with it and use it extensively. We use the OIDC connection to enable users to log in via LDAP data. Unfortunately, this way all users get the admin rights, or you can not limit them to a small room/only a specific user. Or is that still possible?

At the moment this is simply very inconvenient and makes it impossible for us to roll it out on a larger scale. I would be pleased if you could suggest a solution.

Many thanks in advance

-D

Category

Authentication

Please tick the boxes

• You are using a supported version of Dashy (check the first two digits of the version number)
• You've checked that this question hasn't already been raised
• You've checked the docs and troubleshooting guide
• You agree to the code of conduct

[Dleewee]

I do hope that this gets implemented, as I believe most installations will want edit access limited to one user or group.

The way I have worked around it is to disable admin/edit access for all users (including myself), and then only make changes by editing the "my-config.yml" directly on the host machine. I would love to be able to implement a limited admin role and go back to using the web UI for editing though!

[Alexis-BX]

Hi!
I had the say issue, here is my fix:

In src/utils/Auth.js fix the isUserAdmin function as follows:

export const isUserAdmin = () => {
  if (isOidcEnabled()) {
    const adminGroupRoleName = 'admin';
    const raw = localStorage[localStorageKeys.KEYCLOAK_INFO];
    const info = raw ? JSON.parse(raw) : {};
    const groups = (info.groups || []).map(g => g.toLowerCase());
    const roles = (info.roles || []).map(r => r.toLowerCase());
    return groups.includes(adminGroupRoleName) || roles.includes(adminGroupRoleName);
  }

  const users = getUsers();
  if (users.length === 0) return true; // Authentication not setup
  if (!isLoggedIn()) return false; // Auth setup, but not signed in as a valid user
  const currentUser = localStorage[localStorageKeys.USERNAME];
  let isAdmin = false;
  users.forEach((user) => {
    if (user.user.toLowerCase() === currentUser.toLowerCase()) {
      if (user.type === 'admin') isAdmin = true;
    }
  });
  return isAdmin;
};

Of course fix adminGroupRoleName with whatever group/role you have either here or with a mapping in your auth service.

Rebuild and you're good to go!

I used this to display Logged in as {{ userName}} {{ userAdmin ? '(Admin)' : '' }} on the interface. If you want the code for this ping me and I'll drop it below as username also requires a fix du to bellow bug.

From my experimentation, the isLoggedIn() function seems broken when using Oidc auth (always returns false) so make sure to put the isOidcEnabled bloc first.

---

PS: I'm not opening a PR as this is not the correct way to do this.

Ideally you should add an argument like appConfig.auth.oidc.adminGroup & appConfig.auth.oidc.adminRole and use them in OidcAuth.js to set the user type correctly there. But this would also require fixing the isLoggedIn() bug reported above and I didn't look into it.

[Alexis-BX]

Ending up cleaning my code and implementing a proper fix, which addresses the main issue: OIDC users where ignored by the getUser function, which lead to them being ignored by the isLoggedIn which lead to them failing the admin test.

See PR #1894 with a adminGroup and adminRole option you can simply add to your conf.yml :)

[herbeauslese]

That's so cool, thank you so much!
It would also be great if you could assign the right one by user(name).
Is that a realistic/feasible extension of your function?

[Alexis-BX]

Hi @herbeauslese

The point of OIDC is to consolidate all your user management, including admins, in one spot. To this end, what I would recommend, and how it should be done, is to create a dashy-admin group or role in your authentification provider. In that group/role you can have as many or as few users as you want. This group/role is what you then give to Dashy with the above arguments.

That being said, if you really want to set a userAdmin argument, copy what was done for adminGroup in src/utils/ConfigSchema.json and src/utils/OidcAuth.js