Research user and organisation metadata provisioning

[janhalen]

Could user provisioning via System for Cross-domain Identity Management be the way to go?

Using Authentik as IDP via OpenID connect to authenticate and authorize, there seems to be support for provisioning via a SCIM provider

I also found that Zulip has "beta" support for provisioning via SCIM https://zulip.readthedocs.io/en/stable/production/scim.html.

This seems like the most standardized way of bringing over users (and maybe groups or roles?)

Thoughts?

[janhalen]

A bit of further perspectives from the Authentik team: https://goauthentik.io/blog/2023-10-05-scims-many-deviations/

[mikkeschiren]

I talked with @colin-campbell about this, and he is not so keen on using SCIM, it has it own issues.

[janhalen]

Relates to an older issue from the identity-service issue-tracker #6

[janhalen]

I talked with @colin-campbell about this, and he is not so keen on using SCIM, it has it own issues.

I have also read critisism of SCIM, but mostly how the implementation is done, I dont have further data.

It also seems like the maintainer of the upstream Authentik project (and CTO of the Public Benefit Company, sponsoring the project) agrees with these sentiments, as expressed in this blog: https://goauthentik.io/blog/2023-10-05-SCIMs-many-deviations.

With focus on open standards, reusability and robust maintenance strategies, I am interrested in discussion what our options are for provisioning entities like Zulip channels and user mappings to those channels in a sustainable way.

[janhalen]

A non-standard provisioning metod possibility?

An application specific metod to managing Zulip seems to center around management commands

I found this entry point on chat.zulip.org by Tim Abbot describing how this technical concept could be explored as a provisioning solution.

Interresting metods for the provisioning could be:

• create a channel
• add users to channel

Important nomenclature remark: It seems that references to the concept of "streams" in the code are equivalent to "channels" in the UI and docs.

We do need to be aware of the maintainability tasks this could bring.

The primary user stories are centered around pretty "realtime-ish" updating of organizational de/reattachments and offboarding scenarios. E.g. see some (not-yet evaluated) user-stories here:

OS2sandbox/os2adgang-planning#76
OS2sandbox/os2adgang-planning#70

[janhalen]

A modern REST API standard method

Theres also an API possibility, especially https://zulip.com/api/subscribe seems to be a fitting endpoint to use

[mikkeschiren]

On the CLI-level (manage.py), I tested out creating the organisation on first startup, in the same way, provisioning could be done of channels (streams) and adding users to those streams.

[janhalen]

Currently Anna-Lis is doing everything manually... For the next more "reproducible step" we should try and scope a solution..

Running manage.py inside the container is not a very cloud-native approach though?

A change to the OIDC backend to map OIDC token natively in zulip might take weeks to develop and get a PR in?

Creating a sync container talking to the Authentik API and the Zulip API might be possible, but there is the issue of maintainability..

@mikkeschiren: We should really discuss this and scope it.

@ChatBotBerg: Compared to the manual time you are currently putting in.. how do you feel that this issue should be prioritized...

[ChatBotBerg]

@janhalen & @mikkeschiren this issue needs to be prioritized in some form as i am spending tripple time handling user roles.

User Story:

As an IT administrator responsible for user access in Zulip, i experience that all users are assigned the role member in zulip regardless ogf the userroles assigned in authentic.

I need for Zulip to automatically assign users to the correct groups based on their identity provider claims (e.g., OIDC groups from Authentik),

So that I don’t have to manually click through each user profile and assign them to groups every time someone joins, changes department, or leaves the organization.

MOST important: that users registred as external users - automatically appears as GUESTS in zulip and not as members.

Nice to have: that i can add a standard authentic role to users that provides them with the moderator role on Zulip.

[janhalen]

@mikkeschiren:

I that a task Digitalist could handle? How many hours are needed?

And if it should be "made right" as an upstream contribution to Zulip, should we bring in a specialist supplier or do you have internal Python / Django expertise?

Making the upstream change i guess would start from the official docs: https://zulip.readthedocs.io/en/latest/production/authentication-methods.html

[mikkeschiren]

@janhalen - yes we could look into this, I will get into the code for this tomorrow.

[mikkeschiren]

I will do an investigation today and on Friday, I will have an estimate on the work on Monday_tuseday next week.

[mikkeschiren]

I have done some progress, will keep you in the loop