#How to Deliver Custom Claim Content

1 messages · Page 1 of 1 (latest)

cinder shard
#

Hey folks, I’m using an oauth provider to manage users for my audiobookshelf (ABS) instance. ABS has support for defining a custom claim to allow some permissioning control that I'd like to take advantage of. It explains the claim's expected content this way:

"""
Advanced Permissions Claim

[claim name input field here]

Name of the OpenID claim that contains advanced permissions for user actions within the application which will apply to non-admin roles (if configured). If the claim is missing from the response, access to ABS will be denied. If a single option is missing, it will be treated as false. Ensure the identity provider's claim matches the expected structure:
{
"canDownload": false,
"canUpload": false,
"canDelete": false,
"canUpdate": false,
"canAccessExplicitContent": false,
"canAccessAllLibraries": false,
"canAccessAllTags": false,
"canCreateEReader": false,
"tagsAreDenylist": false,
"allowedLibraries": [
"5406ba8a-16e1-451d-96d7-4931b0a0d966",
"918fd848-7c1d-4a02-818a-847435a879ca"
],
"allowedTags": [
"ExampleTag",
"AnotherTag",
"ThirdTag"
]
}
"""

I'm unsure of the best way to define this payload in Authentik and make sure it's present when a user logs in. Any hints/help would be appreciated.

torpid mason
#

depends on how you want to do it, assuming per group....
edit the group, and add an attribute, like:

abs_permissions: {
    "canDownload": false,
  }

And then in customization -> property mappings, add a new "scope mapping" and set the "scope name" to "profile".

set the expression to something like:

if ak_is_group_member(request.user, name="authentik Admins"):
  abs_role = "admin"
elif ak_is_group_member(request.user, name="Audiobookshelf Users"):
  abs_role = "user"
else: 
  abs_role = "guest"

return {
    "name": request.user.name,
    "given_name": request.user.name,
    "preferred_username": request.user.username,
    "nickname": request.user.username,
    "groups": [group.name for group in request.user.ak_groups.all()],
    "abs_role": [abs_role],
    "abs_permissions": request.user.group_attributes().get("abs_permissions", None),
}

In the OIDC config in audiobookshelf, set the group claim to "abs_role", and advanced permission claim to "abs_permissions".

At least, I believe that's how you'd do it.

cinder shard
#

This is really helpful, I'll pull at these threads and see how far I get. Thanks @torpid mason

torpid mason
#

welcome! And testing it out, it does appear to work correctly, for me. however, the user settings in abs don't seem to be properly reflect that. Which is ... odd.

#

also, you'd want to double check in the previewer for the provider to make sure it's generating the correct group of settings

cinder shard
#

Ok I've set up the scope mapping, I think I also need to go in to the provider and add the scope to the selected scopes list under Advanced Protocol Settings to enable it. testing...

#

OH IT TOTALLY SHOWED UP! HECK YEAH

torpid mason
#

yeah, and you can remove the built in "profile" scope

cinder shard
#

gotcha. openid and email are all that's required? testing again

#

oh yeah I see name, given name, preferred name and email details still all come through. coooool.

#

I think you're right about abs ignoring this. I'll see if its a known bug

torpid mason
#

the real fun is that it isn't ignoring it, just the display part seems to be.

#

it also doesn't update permissions on login, only on account creation

#

and may need to restart abs

cinder shard
#

oooo good finds. gooooood finds

#

Oh wow looks like you're right. That's a bit of a bummer, since it really reduces the utility of managing permissions in authentik.

So I suppose the pattern I'll take on is giving no-permissions by default and manually managing them in abs.

I'm planning on hosting this for a couple users to create their own personal shows and I want them to be separated from each other, and don't want to accidentally expose everyone's personal work to newcomers by default ya know?

Anyway, thanks again for the help @torpid mason. I learned a lot just now!

torpid mason
#

welcome!