Access through Authentik groups #27

New issue

Closed

opened 2026-10-28 15:12:48 +00:00 by Gilles · 0 comments

Gilles commented

2026-10-28 15:12:48 +00:00

Owner

Part of the monitoring plan (phase 1.2): give access to Argus organizations and projects through Authentik groups, not only Forgejo permissions.

Scope

On every OIDC login, store the groups claim of the user locally (new model, refreshed at each login). Removing someone from a group takes effect at their next login; this delay is documented.
New GroupGrant model: an Authentik group name, a level (read/write/admin), and either an organization or a project. An organization grant applies to all its projects.
Effective level = max(Forgejo level, group grants), for Forgejo and native organizations alike. Users with no Forgejo identity can now get access through groups only.
ARGUS_ADMIN_GROUP setting (default argus-admins): members (and superusers) can create native organizations and external projects, and are admin of every native organization.
API: list/create/delete group grants on an organization and on a project (admin level required); /me exposes the user's groups and whether they are an Argus admin.
Event recipients and deliveries use the same resolution (a user readable through a group can follow a rule and receive notifications).

Infra

The Authentik blueprint (vps-garion/authentik/blueprints/argus-oidc.yaml) must send the groups claim; the argus-admins and argus-infra groups are created there.

Part of the monitoring plan (phase 1.2): give access to Argus organizations and projects through Authentik groups, not only Forgejo permissions. ## Scope - On every OIDC login, store the `groups` claim of the user locally (new model, refreshed at each login). Removing someone from a group takes effect at their next login; this delay is documented. - New `GroupGrant` model: an Authentik group name, a level (`read`/`write`/`admin`), and either an organization or a project. An organization grant applies to all its projects. - Effective level = max(Forgejo level, group grants), for Forgejo and native organizations alike. Users with no Forgejo identity can now get access through groups only. - `ARGUS_ADMIN_GROUP` setting (default `argus-admins`): members (and superusers) can create native organizations and external projects, and are admin of every native organization. - API: list/create/delete group grants on an organization and on a project (admin level required); `/me` exposes the user's groups and whether they are an Argus admin. - Event recipients and deliveries use the same resolution (a user readable through a group can follow a rule and receive notifications). ## Infra The Authentik blueprint (`vps-garion/authentik/blueprints/argus-oidc.yaml`) must send the `groups` claim; the `argus-admins` and `argus-infra` groups are created there.

Gilles added the

feature

label

2026-10-28 15:12:48 +00:00

Gilles referenced this issue from argus/frontend

2026-10-28 15:12:49 +00:00

Manage access through Authentik groups #16

Gilles referenced this issue

2026-10-28 15:18:21 +00:00

Native organizations and external projects #30

Gilles referenced this issue from a pull request that will close it,

2026-10-28 15:22:01 +00:00