starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Enhancement]: Allow specification of OIDC user role and permissions with attribute mappings #1668

New Issue
Closed
opened 2026-04-24 23:54:02 +02:00 by adam · 4 comments
adam commented 2026-04-24 23:54:02 +02:00
Owner
Copy Link
Copy Source

Originally created by @ghost on GitHub (Jan 18, 2024).

Originally assigned to: @Sapd on GitHub.

Describe the feature/enhancement

I have managed to configure OIDC authentication for ABS, which is working brilliantly, but if I want to make someone an admin or give them additional permissions, this still has to be done via ABS' admin page.

It would be much better if we could manage roles and permissions via the OIDC provider, so can you add support for claims and attribute mappings to add this functionality please?

Originally created by @ghost on GitHub (Jan 18, 2024). Originally assigned to: @Sapd on GitHub. ### Describe the feature/enhancement I have managed to configure OIDC authentication for ABS, which is working brilliantly, but if I want to make someone an admin or give them additional permissions, this still has to be done via ABS' admin page. It would be much better if we could manage roles and permissions via the OIDC provider, so can you add support for claims and attribute mappings to add this functionality please?
adam added the enhancement label 2026-04-24 23:54:02 +02:00
adam closed this issue 2026-04-24 23:54:02 +02:00
adam commented 2026-04-24 23:54:03 +02:00
Author
Owner
Copy Link
Copy Source

@Sapd commented on GitHub (Jan 25, 2024):

I think I would implement it like this:

{
  "sub": "1234567890",
  "name": "John Doe",
  "email": "john.doe@example.com",
  "groups": ["user"], // Can include user, admin or guest, highest will be taken. Names configurable and scopename configurable
  "abspermissions": { // name of the scope configurable
    "canDownload": true,
    "canUpload": false,
    "canDelete": false,
    "canAccessExplicitContent": true,
    "canAccessAllLibraries": false,
    "allowedLibraries": ["Library1", "Library2"],
    "canAccessAllTags": false,
    "allowedTags": ["Tag1", "Tag2"]
  }
}

While making the name of the claim groups, abspermissions configurable.
Also name of the groups itself would be configurable, so name of user, admin, guest.
But I would however not make the name of the permissions inside abspermissions configurable given the complexity, one should be able to just add that json into the claims of the Idp.

So in the end basically we would have 5 new options in the Admin-Page to configure. All being optional.

What do you think?

@Sapd commented on GitHub (Jan 25, 2024): I think I would implement it like this: ```js { "sub": "1234567890", "name": "John Doe", "email": "john.doe@example.com", "groups": ["user"], // Can include user, admin or guest, highest will be taken. Names configurable and scopename configurable "abspermissions": { // name of the scope configurable "canDownload": true, "canUpload": false, "canDelete": false, "canAccessExplicitContent": true, "canAccessAllLibraries": false, "allowedLibraries": ["Library1", "Library2"], "canAccessAllTags": false, "allowedTags": ["Tag1", "Tag2"] } } ``` While making the name of the claim `groups`, `abspermissions` configurable. Also name of the groups itself would be configurable, so name of `user`, `admin`, `guest`. But I would however not make the name of the permissions inside abspermissions configurable given the complexity, one should be able to just add that json into the claims of the Idp. So in the end basically we would have 5 new options in the Admin-Page to configure. All being optional. What do you think?
adam commented 2026-04-24 23:54:04 +02:00
Author
Owner
Copy Link
Copy Source

@ghost commented on GitHub (Jan 31, 2024):

@Sapd This sounds like a great approach.

I don't think it's necessary to make the names of the "user", "admin" and "guest" groups customisable, since we can just map our own group names to these at the IdP. Simpler to keep these aligned with what are used at present.

I do like the suggestion of making the two scope names configurable, however.

Very happy to help with testing once a PR has been submitted.

Thanks!

@ghost commented on GitHub (Jan 31, 2024): @Sapd This sounds like a great approach. I don't think it's necessary to make the names of the "user", "admin" and "guest" groups customisable, since we can just map our own group names to these at the IdP. Simpler to keep these aligned with what are used at present. I do like the suggestion of making the two scope names configurable, however. Very happy to help with testing once a PR has been submitted. Thanks!
adam commented 2026-04-24 23:54:05 +02:00
Author
Owner
Copy Link
Copy Source

@Sapd commented on GitHub (Mar 19, 2024):

Implemented in PR https://github.com/advplyr/audiobookshelf/pull/2769

@Sapd commented on GitHub (Mar 19, 2024): Implemented in PR https://github.com/advplyr/audiobookshelf/pull/2769
adam commented 2026-04-24 23:54:06 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Apr 22, 2024):

Added in v2.9.0

@advplyr commented on GitHub (Apr 22, 2024): Added in [v2.9.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.9.0)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#1668
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?