How to assign permissions to SSO users?

[yash-ahir]

Is there any way to import the groups supplied with SSO (I'm using openid_connect as the provider) or auto assign groups to SSO users? Right now when a new user signs in using SSO, the interface is completely blank as they don't have any permissions. I have groups invetree_staff and invetree_admin, I want to assign staff and admin permissions to users in those groups respectively.

[SchrodingersGat]

I do not believe this is currently possible. Refer to these docs:

• https://docs.inventree.org/en/latest/settings/SSO/
• https://docs.allauth.org/en/latest/socialaccount/providers/openid_connect.html

Extending this functionality would probably be a good target for a custom plugin - handling all possible edge cases here would be very complex.

[SchrodingersGat]

@p-fruck I'd happily support a PR to the core codebase if you want to submit one. It will require updates to the documentation also :)

[p-fruck]

Sounds great! Any idea where I should put the signals part thats in the init method of the plugin? Should I keep relying on allauth signals or do you prefer using a custom hook in the codebase?

[SchrodingersGat]

I would suggest you add events.py to src/backend/InvenTree/users/ - and look at how we structure events.py in the other code subdirectories.

[p-fruck]

I don't understand how I should use the events.py. It seems like this file only reexports methods to trigger/process custom events. What I am interested in are the two receivers at the end of the base/events/events.py and how to register them: https://github.com/inventree/InvenTree/blob/master/src/backend/InvenTree/plugin/base/event/events.py#L159-L186

From the django docs I would connect the receivers in the ready method of apps.py, but I dont see that happening for your plugin/events.py

Also, do you want the code to be placed in the users app or in the sso.py?

[SchrodingersGat]

I forgot about sso.py - that's a good location for the code.

So, in summary:

• Receivers are connected in ./src/backend/InvenTree/InvenTree/apps.py
• Callbacks are added in ./src/backend/InvenTree/InvenTree/sso.py