Security group restrictions for OIDC clients #117

New issue

Closed

opened 2025-09-09 07:06:50 -05:00 by zero-ninetynine · 2 comments

zero-ninetynine commented

2025-09-09 07:06:50 -05:00

(Migrated from github.com)

Regarding security groups and OIDC, the documentation says "Security Groups are used by OIDC when the OIDC Client requests the 'groups' scope.". However, plenty of apps supporting OIDC make no use of this (for instance, immich), and as such every user has access to these apps.

Describe the solution you'd like:

A way to bind security groups to OIDC clients in a similar way to how it's already handled in proxyauth domains.

Describe alternatives you've considered:

I'm not sure; any way to restrict access for a subset of users to specific OIDC clients in voidauth.

Additional context:

I've been switching over from Authentik, and I'm really liking voidauth and would like to switch over completely. This is really the only feature that I've been missing.

### Is your feature request related to a problem? Please describe: Regarding security groups and OIDC, the documentation says "Security Groups are used by OIDC when the OIDC Client requests the 'groups' scope.". However, plenty of apps supporting OIDC make no use of this (for instance, immich), and as such every user has access to these apps. ### Describe the solution you'd like: A way to bind security groups to OIDC clients in a similar way to how it's already handled in proxyauth domains. ### Describe alternatives you've considered: I'm not sure; any way to restrict access for a subset of users to specific OIDC clients in voidauth. ### Additional context: I've been switching over from Authentik, and I'm really liking voidauth and would like to switch over completely. This is really the only feature that I've been missing.

👍 1

notquitenothing commented

2025-09-09 18:52:56 -05:00

(Migrated from github.com)

Thank you for opening an issue! 🙂
I will look into adding security groups to OIDC Clients, but there will be significant limitations. VoidAuth would only be able to prevent authorizations to those services when you try to login, not revoke those apps sessions immediately if the user loses access.

Thank you for opening an issue! 🙂 I will look into adding security groups to OIDC Clients, but there will be significant limitations. VoidAuth would only be able to prevent authorizations to those services when you try to login, not revoke those apps sessions immediately if the user loses access.

👍 1

zero-ninetynine commented

2025-09-10 05:10:28 -05:00

(Migrated from github.com)

Sure, that'd work just fine, for my purposes at least. Thanks!

👍 1