| 780 | } |
| 781 | |
| 782 | func mapGroupsToRoleFromConfig(groups []string, cfg *config.Config) string { |
| 783 | if len(groups) == 0 { |
| 784 | return cfg.OidcDefaultRole |
| 785 | } |
| 786 | lower := make([]string, len(groups)) |
| 787 | for i, g := range groups { |
| 788 | lower[i] = strings.ToLower(g) |
| 789 | } |
| 790 | superadminGroup := strings.ToLower(cfg.OidcSuperadminGroup) |
| 791 | adminGroup := strings.ToLower(cfg.OidcAdminGroup) |
| 792 | hostManagerGroup := strings.ToLower(cfg.OidcHostManagerGroup) |
| 793 | readonlyGroup := strings.ToLower(cfg.OidcReadonlyGroup) |
| 794 | userGroup := strings.ToLower(cfg.OidcUserGroup) |
| 795 | // Superadmin: in superadmin group alone |
| 796 | if superadminGroup != "" { |
| 797 | for _, g := range lower { |
| 798 | if g == superadminGroup { |
| 799 | return "superadmin" |
| 800 | } |
| 801 | } |
| 802 | } |
| 803 | if adminGroup != "" { |
| 804 | for _, g := range lower { |
| 805 | if g == adminGroup { |
| 806 | return "admin" |
| 807 | } |
| 808 | } |
| 809 | } |
| 810 | if hostManagerGroup != "" { |
| 811 | for _, g := range lower { |
| 812 | if g == hostManagerGroup { |
| 813 | return "host_manager" |
| 814 | } |
| 815 | } |
| 816 | } |
| 817 | if readonlyGroup != "" { |
| 818 | for _, g := range lower { |
| 819 | if g == readonlyGroup { |
| 820 | return "readonly" |
| 821 | } |
| 822 | } |
| 823 | } |
| 824 | if userGroup != "" { |
| 825 | for _, g := range lower { |
| 826 | if g == userGroup { |
| 827 | return "user" |
| 828 | } |
| 829 | } |
| 830 | } |
| 831 | return cfg.OidcDefaultRole |
| 832 | } |
| 833 | |
| 834 | var usernameSanitize = regexp.MustCompile(`[^a-zA-Z0-9._-]`) |
| 835 | |