Adding support for groups in Azure Active Directory about oauth2-proxy

[omerlh]

I want something similar - having a similar ability to -google-group: specifying a group that the user must be a member of in order to be able to log in.

[vkadiwala]

This is the really needed feature. When it will get merged?

[rnsc]

Hello @JoelSpeed ,

Is this still on the radar?
Looking at the original PR, I don't see any breaking change on the Google provider (the requester kept the Google groups flags but mentioned them as deprecated).
Or is there something else preventing this fork to integrate this change?

[dekimsey]

While trying to develop support for azure's app roles, I did notice it was very easy to trip the cookie size limit on the browser when Groups started being populated. I know AWS auto-splits the cookie, and that may be required (max 11k) to reasonably support this.

Background: I wanted access to Azure Application Roles, which forced having to create an Azure v2.0 provider, the current implementation is against the v1 api. I did base the changes off of the PR regarding Groups. So if we have a good direction on this, I'd like to see Roles get included (separate pr likely).

The WIP implementation is here.

[JoelSpeed]

While trying to develop support for azure's app roles, I did notice it was very easy to trip the cookie size limit on the browser when Groups started being populated. I know AWS auto-splits the cookie, and that may be required (max 11k) to reasonably support this.

Just as an FYI, we have session cookie splitting built into the proxy so if you do start overflowing the 4k limit, we can handle that already 😄
https://github.com/pusher/oauth2_proxy/blob/908ac24257840b197163c6e0bec8954b56ca3656/oauthproxy.go#L325-L327

Also, we are making an effort to introduce sever-side sessions which will mitigate this problem (see #147 & #148)

[morganchristiansson]

It can already be done via the Accesss-Token header which contains JWT token JSON

However this requires custom support to read this header in the application which only works in some scenarios.

In my setup X-Auth-Request-Access-Token contains JWT token with group information.

[github-actions]

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

[dkutetsky]

Any updates on this?
We really need this feature.
Thanks!

[jeremych1000]

Hello - I'm guessing this is still being discussed behind-the-scenes? Will it be considered?

[sylr]

I would really like this too!

[bhvr-fmarceau]

I'd really like that as well!

+1 for the feature request!

[JoelSpeed]

Hi all, I've had a pass over the original PR to bitly and think this is definitely something we should be supporting. I'm a bit concerned about the breaking changes it introduces though, we still need to work out how to handle those since taking over the project!

Does anyone have time to try and get a PR opened here based on the changes from the original PR? Perhaps @pasoroki?

[JoelSpeed]

There are some outstanding comments on the PR, if the PR author can fix these then I'll re-review and hopefully it will be ready for merge

[michael-freidgeim-webjet]

Can the issue be reopen?

[MNF]

@dekimsey have you succeed with your implementation? The link to your WIP is broken.