Feature: give groups through SAML auth about casdoor

[casbin-bot]

@tangyang9464 @JalinWang @imp2002

[hsluoyz]

@lajoll1 can you provide more details? Like what SAML field should be provided? In what format? It's better to not require us to setup a Nextcloud instance by ourselves

[lajoll1]

Ok, i'll try giving some more details.
So, on the nextcloud side, you've got these parameters.

If on casdoor's side, I add a custom fixed string attribute (let's say named "Group", with value Group1)

and set in nextcloud's field the attribute Group in the appropriate field, as in the following screenshot:

All the users who login will get the attribute Group1 and therefore the appropriate permissions. Example below for Alice. I would like to transmit all the groups to which the user belongs to in casdoor in nextcloud through SAML attribute. For instance if under casdoor i've got two users, Alice. Alice belongs to groups group1 and group2. When Alice signs in, nextcloud, in addition to mail/email..., should receive groups group1 and group2. Regarding the data format, could not find accurate data on the doc of the SSO module for nextcloud. But from what I read so far, I feel like the following format is expected

<Attribute Name="Group">
        <AttributeValue>Group1</AttributeValue>
        <AttributeValue>Group2</AttributeValue>
    </Attribute>

Does that answer your question ?

[hsluoyz]

@lajoll1 what about using the similar format like Roles? Can you check if the format is OK? If OK, we will add Groups similarly.

casdoor/object/saml_idp.go

Lines 113 to 123 in c532a5d

	roles := attributes.CreateElement("saml:Attribute")
	roles.CreateAttr("Name", "Roles")
	roles.CreateAttr("NameFormat", "urn:oasis:names:tc:SAML:2.0:attrname-format:basic")
	err := ExtendUserWithRolesAndPermissions(user)
	if err != nil {
	return nil, err
	}
	for _, role := range user.Roles {
	roles.CreateElement("saml:AttributeValue").CreateAttr("xsi:type", "xs:string").Element().SetText(role.Name)
	}

[lajoll1]

Indeed! Feel like it might work.
Created a fake role.
I can't see the "Roles" attribute in the SAML metadata in the created application.
How can I test it ?
Thanks for your help

[hsluoyz]

@lajoll1 debug it, make sure getPermissionsAndRolesByUser() returns non-empty roles

[lajoll1]

Sorry my question might look stupid but i'm not a dev and never worked with Go.
How am I supposed to call the function in that case ?

[hsluoyz]

Already has this feature