Syncing Azure User Groups

Original message was deleted

FFO•6/14/23, 9:38 PM

I think one of our customer is doing some close to this.

@fabienne @livio might know more about this

FFO•6/15/23, 9:33 PM

Let me reach out, and see what I get.

fabienne•9/27/23, 9:36 AM

hei @Herb Where do you need the help? on the side of azure to get those groups, or on how to store them to the user?

fabienne•9/28/23, 8:46 AM

I am not sure how azure AD works, but I would implement it like this:

fabienne•9/28/23, 8:46 AM

Adding an action that calls an endpoint on the azure ad to request the groups of the user

fabienne•9/28/23, 8:47 AM

here is an example on how to do an api call: https://github.com/zitadel/actions/blob/main/examples/make_api_call.js

GitHub

actions/examples/make_api_call.js at main · zitadel/actions

ZITADEL Actions - Easy extensibility with custom code. Think GitHub Actions in an Identity System. - zitadel/actions

fabienne•9/28/23, 8:47 AM

As a next step you take the groups you get there and add it to a claim, you can find an example here: https://github.com/zitadel/actions/blob/main/examples/add_claim.js

GitHub

actions/examples/add_claim.js at main · zitadel/actions

ZITADEL Actions - Easy extensibility with custom code. Think GitHub Actions in an Identity System. - zitadel/actions

FFO•10/2/23, 9:14 AM

Yes that is the same thing

FFO•10/2/23, 9:14 AM

Looks like groups claims are used in the wild more then we are used too

FFO•10/4/23, 1:47 PM

Hm right, I am just thinking where to store the group information from the azureAD.

Could be user metadata since we do not really have a concept of group ATM.

FFO•10/9/23, 6:32 AM

This makes sense.

@fabienne I think we should expose the "full" idp response inside the actions so that our users can work with it or how do you see this?