signmykeyio/signmykey

Feature Request: Add username as Principal

russcook opened this issue · 7 comments

russcook commented

I really like this application and I want to use it, however I really need to have the username added as a principal.
I also would like the ability to have multiple values in the oidcUserGroupsEntry and have each of their values added to the principal list.

  • Thanks
pablo-ruth commented

Hello @russcook
I forgot to republish the docs with the latest updates, I just fixed it. So now you have with v0.6.0 the ability to chain providers (https://signmykey.io/backends/principals/#multiple-principals-providers) and add username as a principal (https://signmykey.io/backends/principals/#user).

  • 👍1
russcook commented

Excellent! Thank you!
I would also suggest adding the ability to use multiple values in oidcUserGroupsEntry since I cannot add two providers of the same type.

pablo-ruth commented

Ok I created this PR #98 to allow this. Can you test it: https://github.com/signmykeyio/signmykey/suites/2798745249/artifacts/62198073 ?

And I'm interested to know what's your use case for multiple oidcUserGroupsEntry values ?

russcook commented

my user accounts are mostly on LDAP using sssd so their username/princial is their userPrincipalName, however I also have ephemeral hosts where their username/principal needs to their sAMAccountName. I'd also like to be able to allow them to login to an application service account. Since Keycloak will not allow adding multiple user attributes to a single mapping, I need multiple mappings to get both the service account and their sAMAccount name as principals.
I solved this by using static principals, however it needs to be updated manually as new people are added/deleted.

Thanks for the update!

pablo-ruth commented

Ok thanks for the details, so this PR is working for you ?

russcook commented

I just did my testing and deployed the new version. It works great. many thanks!