Currently my indico didn’t get groups from ldap, I only have very few groups in indico.
I would like to know how indico will react if I configure my current indico with ldap group.
If a group is created in the ldap, I’m guessing it will be «copied» inside indico, but what append next, can some one add a indico’s user inside a group from the ldap (like a user who’s not inside our ldap), or the ldap_group in indico are sync regularly with the LDAP ?
How a ldap_group in indico deal with someone authenticated with oauth2 ?
There are no copies of groups whatsoever. All that indico stores for groups is the name and provider (IDENTITY_PROVIDERS dict key) when adding it to an ACL.
And there must be an IDENTITY_PROVIDER configured that can check the group membership of users, regardless of how they log in. When using oauth for login you need to get a proper identifier for the user which you can then lookup in LDAP. We did that for a long time at CERN: oauth-based login, and then getting the user data from ldap.
Just one last question (not really related to the topics, but a consequence ) Currently I don’t have a IDENTITY_PROVIDER other than my oauth2, so I can add one but is they are anyway to hidden it on the login page ?
You could disable the oauth identity provider (and configure the endpoint that returns user data as the auth provider’s userinfo endpoint instead), and then let the ldap one get the details for the user that indico uses. This of course assumes that any user who can do oauth also exists in ldap.
Otherwise I think you can add a second one that’s “internal only” for groups. But I haven’t tested that, not sure if we have some check that any provider needs to have an auth provider linked or not…