-
-
Notifications
You must be signed in to change notification settings - Fork 1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SCIM Group Filtering #6065
Comments
I would like authentik to be able to filter scim groups and users.
Similar mapping works for users |
Is there a way to skip the group mapping?
|
Looking here, it seems that it just query for all groups. I was thinking that it may be great to optionally pass some filtering options. Could it be possible to create a new filters property and then run something like:
I have tested the above solution hardcoding the filters in code, and works quite well. I know that the change is not trivial, and involves a lot of changes, but this would be a nice to have feature. |
+1 still need this function as api /providers/scim_groups/{id}/ does not work |
Current functionality: Is ignoring the group selection entirely but if this should be working will be multiple scim providers with different groups attached to main application. Same hack applies with custom provider mapping add each provider maping to application |
This is also problematic for me being able to pick the groups is common with scim implemetnations |
Is your feature request related to a problem? Please describe.
I am using Authentik to provision users and groups into a Netskope lab environment with required property mappings. While I can control which users are provisioned, it also sends over ALL groups associated to those users which flood the Netskope tenant with unnecessary groups unrelated to Netskope and other SCIM targets.
Describe the solution you'd like
I would like to see a section for the SCIM provider configuration called Group Filtering placed below User Filtering and above Attribute mapping. This would allow an administrator to specify specific groups that would be provisioned. It could be similiar to AzureAD SCIM or Okta's group rules.
Describe alternatives you've considered
Limiting the groups imported into Authentik via the AD sync, but that would limit the instance of Authentik to only handling Netskope SCIM, decreasing the value for Authentik.
Additional context
None to remark.
The text was updated successfully, but these errors were encountered: