Directory integration: OIDC sign-in (Entra first), SCIM provisioning, group sync and directory-certified signing keys issue #358 open andymccall opened this 3 days ago · 0 comments

Directory integration (Microsoft Entra ID first; Okta, Google Workspace, Keycloak and any OIDC provider by the same route).

Builds on issue #106, which already signs people in with GitLab, GitHub and Google through OAuth, set up site-wide by an administrator. What it lacks: a generic OIDC provider (Entra's tenant issuer among them), a provider per organisation, enforcement, provisioning and groups.

• Single sign-on: the hub as an OIDC client of an organisation's directory (a generic OIDC provider beside issue #106's three, with discovery from the issuer). An organisation names its provider (issuer, client id, secret sealed under keys/secrets.key) and its email domains; members sign in through it; an organisation can require it. PKCE, state and nonce checked; ID tokens verified against the issuer's keys.
• SCIM 2.0 provisioning: users and groups pushed from the directory (create, update, deactivate); a deactivated user loses sessions, tokens and runner access at once.
• Group sync: directory groups mapped to the organisation's teams and their roles.
• The directory vouches for signing keys: a directory member's signing key is certified by the hub for their directory identity, so a change's signature shows the corporate identity (verifiable, in the transparency log), and a leaver's certificate ends when SCIM deactivates them; changes made before stay valid as made then.
• Settings and docs for setting Entra up (app registration, redirect URI, SCIM endpoint and token), and an audit trail of each sign-in and provisioning call.
• Tests against a fake OIDC provider and a SCIM client fixture.