Map IdP groups to roles in your app

1
// Your app's role for each of a customer's IdP groups. Each customer names
2
// its groups differently, so keep this map per organization.
3
const GROUP_ROLES = {
4
  '<organization-id>': { 'App Admins': 'admin', 'App Editors': 'editor' },
5
};
6
const ROLES_BY_RANK = ['admin', 'editor', 'viewer'];
7

8
function roleFor(claims) {
9
  const groupRoles = GROUP_ROLES[claims.oid] ?? {};
10
  const groups = Array.isArray(claims.groups) ? claims.groups : [];
11
  const roles = groups.map((group) => groupRoles[group]);
12
  // A custom attribute that names the role directly, if you use one
13
  if (ROLES_BY_RANK.includes(claims.app_role)) roles.push(claims.app_role);
14
  // The highest role wins; a user in no mapped group gets the lowest
15
  return ROLES_BY_RANK.find((role) => roles.includes(role)) ?? 'viewer';
16
}
17

18
// In your callback, after: claims = await scalekit.validateToken(result.idToken);
19
// user.role = roleFor(claims);

1
# Your app's role for each of a customer's IdP groups. Each customer names
2
# its groups differently, so keep this map per organization.
3
GROUP_ROLES = {
4
    "<organization-id>": {"App Admins": "admin", "App Editors": "editor"},
5
}
6
ROLES_BY_RANK = ["admin", "editor", "viewer"]
7

8

9
def role_for(claims):
10
    group_roles = GROUP_ROLES.get(claims.get("oid"), {})
11
    groups = claims.get("groups")
12
    roles = [group_roles.get(group) for group in groups] if isinstance(groups, list) else []
13
    # A custom attribute that names the role directly, if you use one
14
    if claims.get("app_role") in ROLES_BY_RANK:
15
        roles.append(claims["app_role"])
16
    # The highest role wins; a user in no mapped group gets the lowest
17
    return next((role for role in ROLES_BY_RANK if role in roles), "viewer")
18

19

20
# In your callback:
21
# claims = scalekit_client.validate_token(result["id_token"])
22
# user.role = role_for(claims)

1
package main
2

3
import "slices"
4

5
// Your app's role for each of a customer's IdP groups. Each customer names
6
// its groups differently, so keep this map per organization.
7
var groupRoles = map[string]map[string]string{
8
  "<organization-id>": {"App Admins": "admin", "App Editors": "editor"},
9
}
10

11
var rolesByRank = []string{"admin", "editor", "viewer"}
12

13
func roleFor(claims map[string]interface{}) string {
14
  orgID, _ := claims["oid"].(string)
15
  var roles []string
16
  groups, _ := claims["groups"].([]interface{})
17
  for _, g := range groups {
18
    if group, ok := g.(string); ok {
19
      roles = append(roles, groupRoles[orgID][group])
20
    }
21
  }
22
  // A custom attribute that names the role directly, if you use one
23
  if appRole, ok := claims["app_role"].(string); ok && slices.Contains(rolesByRank, appRole) {
24
    roles = append(roles, appRole)
25
  }
26
  // The highest role wins; a user in no mapped group gets the lowest
27
  for _, role := range rolesByRank {
28
    if slices.Contains(roles, role) {
29
      return role
30
    }
31
  }
32
  return "viewer"
33
}
34

35
// In your callback, after:
36
// claims, err := scalekitClient.ValidateToken(r.Context(), result.IdToken)
37
// user.Role = roleFor(claims)

1
import java.util.ArrayList;
2
import java.util.List;
3
import java.util.Map;
4

5
public class Roles {
6
    // Your app's role for each of a customer's IdP groups. Each customer names
7
    // its groups differently, so keep this map per organization.
8
    static final Map<String, Map<String, String>> GROUP_ROLES = Map.of(
9
        "<organization-id>", Map.of("App Admins", "admin", "App Editors", "editor"));
10
    static final List<String> ROLES_BY_RANK = List.of("admin", "editor", "viewer");
11

12
    static String roleFor(Map<String, Object> claims) {
13
        Map<String, String> groupRoles = GROUP_ROLES.getOrDefault((String) claims.get("oid"), Map.of());
14
        List<String> roles = new ArrayList<>();
15
        if (claims.get("groups") instanceof List<?> groups) {
16
            for (Object group : groups) {
17
                roles.add(groupRoles.get(String.valueOf(group)));
18
            }
19
        }
20
        // A custom attribute that names the role directly, if you use one
21
        if (claims.get("app_role") instanceof String appRole && ROLES_BY_RANK.contains(appRole)) {
22
            roles.add(appRole);
23
        }
24
        // The highest role wins; a user in no mapped group gets the lowest
25
        return ROLES_BY_RANK.stream().filter(roles::contains).findFirst().orElse("viewer");
26
    }
27
}
28

29
// In your callback, after:
30
// claims = scalekitClient.authentication().validateAccessTokenAndGetClaims(result.getIdToken());
31
// user.setRole(Roles.roleFor(claims));