Groups management

admin.php

@@ -79,6 +79,8 @@
 		'client_secret' => $_POST['client_secret'], 
 		'scope' => $_POST['scope'], 
 		'preferred_username' => $_POST['preferred_username'], 
+		'manage_groups' => $_POST['manage_groups'], 
+		'groups_claim' => $_POST['groups_claim'], 
 		'proxy' => $_POST['proxy'], 
 		'verify_host' => isset($_POST['verify_host']), 
 		'verify_peer' => isset($_POST['verify_peer']), 

oidc.php

@@ -139,6 +139,62 @@ function oidc_retrieve(OpenIDConnectClient $oidc, $force_registration = false) {
 		}
 	}
 
+	// Groups registration //
+
+	// If the group management setting is enabled, add the user to the configured groups
+	if ($config['manage_groups']) {
+
+		$groups_claim = "groups";
+		if (!empty($config['groups_claim'])) {
+			$groups_claim = $config['groups_claim'];
+		}
+
+		// Remove existing groups
+		$query = '
+			DELETE FROM ' . USER_GROUP_TABLE . '
+			WHERE `user_id` = ' . $row['id'] . ';';
+		pwg_query($query);
+
+		// Get the groups array provided by the oidc provider
+		$groups = $oidc->requestUserInfo($groups_claim);
+
+		foreach ($groups as $group_name)
+		{
+			// Check if expected group exists
+			$query = '
+				SELECT id FROM `'.GROUPS_TABLE.'`
+				WHERE name = \'' . pwg_db_real_escape_string($group_name) . '\'';
+
+			$group_row = pwg_db_fetch_assoc(pwg_query($query));
+
+			// The group does not exist, we need to create it
+			if (empty($group_row['id'])) {
+
+				// creating the group, see line 82 gallery/include/ws_functions/pwg.groups.php
+				single_insert(
+					GROUPS_TABLE,
+					array(
+						'name' => pwg_db_real_escape_string($group_name),
+						'is_default' => boolean_to_string(false),
+					)
+				);
+				$inserted_id = pwg_db_insert_id();
+
+				$group_id = $inserted_id;
+			} else {
+				// The group exists, we just need its id
+				$group_id = $group_row['id'];
+			}
+
+			// Add the user to the group
+			single_insert(USER_GROUP_TABLE, [
+				'user_id' => $row['id'],
+				'group_id' => $group_id,
+			]);
+		}
+
+	}
+
 	return $row['id'];
 }
 

template/config.tpl

@@ -138,6 +138,17 @@
 			<br />
 			<i>{'This claim is used for local identification and must return a unique value for each user. Falls back to \'sub\'.'|translate}</i>
 		</li>
+		<li>
+			<input type="checkbox" name="manage_groups" id="manage_groups" {if $manage_groups}checked="checked"{/if}>
+			<label for="manage_groups">{'Enable groups management'|translate}</label>
+		</li>
+		<li>
+			<label for="groups_claim">{'Groups claim'|translate}</label>
+			<br />
+			<input type="text" size=50 name="groups_claim" id="groups_claim" value="{$groups_claim}">
+			<br />
+			<i>{'When groups management is enabled, groups are added to users upon connection. Groups claim is used to create and assign groups to users. This claim should be an array of [group_name]. The claim falls back to \'groups\'.'|translate}</i>
+		</li>
 		<li>
 			<label for="proxy">{'HTTP Proxy'|translate}</label>
 			<br />