unkinben
1dab2ecc6f
Introduce a user -> role -> [permissions] model for app access and roles, managed declaratively. - Permission groups (akP-<app>-<access>) under config/permissions/: atomic units, each names the application it grants access to. - Role groups (akR-<role>) under config/roles/: what users are assigned to; each nests permission groups via parents (akR-global-admin -> all *-admin, akR-standard-user -> all *-user). Split into a separate authentik_group resource so roles can reference permission ids without self-reference. - Policy bindings gate each application to its permission groups (and, via child->parent membership propagation, the roles that nest them). - Hierarchical `groups` scope mapping: walks user groups up through .parents so the OIDC claim includes inherited permission groups (works around goauthentik/authentik#15579). Inert until a provider requests the `groups` scope, so no behaviour change to existing apps until they opt in. Validated with `tofu validate`.
5 lines
190 B
YAML
5 lines
190 B
YAML
# Permission: admin access to grafana. Bound to the grafana application for
|
|
# access, and mapped to the grafana admin role via the groups claim.
|
|
name: akP-grafana-admin
|
|
application: grafana
|