Nextcloud useable GroupMappings

[pearl gale]

Hi guys, I just want to know if someone was able to get a working groupmapping with OIDC done?
I always get the loooooooong random IDs inside of nextcloud instead a searchable cleartext groupname. Is this avoidable?
I also have 4 groups that I want to use in my nextcloud at starting point and made a Scope Mapping for this, it looks something like this here:

groups = []

if ak_is_group_member(request.user, name="NC-Home"):
    groups.append("Home")
if ak_is_group_member(request.user, name="NC-Family"):
    groups.append("Family")
if ak_is_group_member(request.user, name="NC-Blablabla"):
    groups.append("Blablabla")
if ak_is_group_member(request.user, name="NC-Admins"):
    groups.append("admin")

return {
    "name": request.user.name,
    "given_name": request.user.name,
    "preferred_username": request.user.username,
    "nickname": request.user.username,
    "groups": groups,
}

As you can see I made some groups with "NC-" in front of its name for better organizing my stuff in authentik. Maybe someone can help me with my code to make it even more simpler 😉
Btw: The use that is inside the NC-Admins group isn't set to the admin group inside of Nextcloud, so no rights to change something in the admin part of nextcloud right now.

[pearl gale]

No one got an idea?

[astral sonnet]

How do you have nextcloud setup in your Nextcloud OpenID?

To stop having the randomly generated groups and userids, I unchecked the setting for Use Unique User ID = False / Unchecked

Make sure you check the Use Group Provisioning then fill in groups under the Groups Mapping Section above the check boxes.

Then I used the default group mapping scope that was provided by Authentik here: https://docs.goauthentik.io/integrations/services/nextcloud/#openid-connect-auth

With this setup, It was able to copy over any Groups from Authentik and the proper usernames..

Hope this helps

As for your code, I'm not sure about it, I don't know how to tell if it would work or not or where to put it. I don't know how to code or write these scope mappings, I usually ask or find them on Authentik's website. Someone else more knowledgeable on code will have to answer that.

[pearl gale]

the Use Unique User ID was the issue!
may I ask an other question belonging to the group mapping?

my NC- groups are all nested under a parent group called "Nextcloud", is it possible with the custom usermapping to just use the groups under this parent Nextcloud group, then I can get rid of my mutiple if/then lines 😄

[astral sonnet]

Not sure about that. Im sure its possible but someone else with a little more knowledge of python code will have to jump in to help as I dont know python. I find it online, ask or use the default documentation from authentik. Sorry.

[pearl gale]

no prob at all, you already helped a lot 🙂 maybe chatgpt knows something about python hehe 😉

[astral sonnet]

Now that I think about this a little longer, don't quote me on this as I have not tested, but I think this would be possible if you just put the groups you want under your Nextcloud Group In Authentik. As long as the users are apart of this group, these groups should show up in Nextcloud. I do know that any other groups the users are apart of also get copied over to Nextcloud, at least from my experience and testing. I don't know if this is the solution you are looking for, this is just me thinking about how Authentik works and what I have noticed when using it with Nextcloud.

Hope this helps and hope this is what you are trying to achieve. I use group policies to control the access to apps. Not sure if this is what you are doing too..

[pearl gale]

I did it a bit different now, and yes ChatGPT knows a bit about python scripting 😉
All my Nextcloud groups got Nextcloud- in front of the groupname I want inside of Nextcloud and then I have this script:

groups = user.ak_groups.all()

nextcloud_groups = [group for group in groups if group.name.startswith('Nextcloud-')]
trimmed_names = [group.name[len('Nextcloud-'):] if group.name != 'Nextcloud-Admins' else 'admin' for group in nextcloud_groups]

return {
    # Because authentik only saves the user's full name, and has no concept of first and last names,
    # the full name is used as given name.
    # You can override this behaviour in custom mappings, i.e. `request.user.name.split(" ")`
    "name": request.user.name,
    "email": request.user.email,
    "given_name": request.user.name,
    "preferred_username": request.user.username,
    "nickname": request.user.username,
    # groups is not part of the official userinfo schema, but is a quasi-standard
    "groups": trimmed_names,
}

hope someone else finds this usefull 🙂

[runic cradle]

I think I have the same problem. To be sure: you disabled Unique User ID in nextcloud and the already created accounts still work?