authentik
authentik copied to clipboard
Provide custom user mapping logic via expression
Is your feature request related to a problem? Please describe. When I am trying to add a trusted OIDC provider, I find it difficult with some sources to map to users properly.
Describe the solution you'd like
I would like for the ability to provide the usermapping via an Expression, this would allow for me in this instance. Use the subject line in the incoming JWT subject of project_path:mygroup/myproject:ref_type:branch:ref:main
and map project_path:mygroup/myproject*
to serviceUser_project_001
If I have not provided that mapping, to just flat out deny auth to that endpoint.
Describe alternatives you've considered Any sort of custom user mapping would be nice, to do something like string matching
So that option is only used for identifying a user uniquely when they authenticate later. We are currently working on property mappings for sources, which will allow you to customize the username, email and other attributes that you might need to change from that.