Assign permissions based on OAuth2 Role

[TheBirdsNest]

I need to give permissions to users based on their Active Directory group assignment(s).
In my Entra ID App Registration, I have my roles and permissions assigned.. How do I assign them to groups in Django?

Alternatively, I know can easily do this with 'django-auth_adfs' package, but I need to install its URL's into core/urls.py.
Any recommendations on how to do that without having to modify and then manually keep track/patch that file?

Django_auth_adfs config:

EXTRA_INSTALLED_APPS = ['django_auth_adfs']

__CLIENT_ID = os.environ.get("OAUTH_APPLICATION_KEY")
AUTH_ADFS = {
    "AUDIENCE": __CLIENT_ID,
    "CLIENT_ID": __CLIENT_ID,
    "CLIENT_SECRET": os.environ.get("OAUTH_APPLICATION_KEY"),
    "CLAIM_MAPPING": {
        "first_name": "given_name",
        "last_name": "family_name",
        "email": "upn",
        "cs_alias": "preferred_username"
    },
    "GROUPS_CLAIM": "groups",
    "GROUP_TO_FLAG_MAPPING": {
        "is_staff": ["xxx", "xxx"],
        "is_superuser": ["xxx", "xxx"],
    },
    "USERNAME_CLAIM": "upn",
    "TENANT_ID": os.environ.get("OAUTH_TENANT_ID"),
    "RELYING_PARTY_ID": __CLIENT_ID,
}

LOGIN_URL = "django_auth_adfs:login"
LOGIN_REDIRECT_URL = "/"

AUTHENTICATION_BACKENDS = (
    'django_auth_adfs.backend.AdfsAuthCodeBackend',
    # 'social_core.backends.azuread_tenant.AzureADTenantOAuth2',
    'nautobot.core.authentication.ObjectPermissionBackend',
)```

[whitej6]

@TheBirdsNest please take a look at the AzureAD group sync example here. Using a custom pipeline is required to sync groups from the external IDP into Nautobot. After the groups are available in Nautobot you can then assign the groups to a permission.

[TheBirdsNest]

Thanks! My initial issue with this was that django_auth_adfs just works out of the box, but if we need to use social-auth, no problem :)

[TheBirdsNest]

@whitej6 - is there no way to get the display name of the group instead of its ID?
I cant seem to find any documentation on what is available through the social-auth docs or anywhere else..

[whitej6]

That's due to its dependent on the scope/claims configuration in the IDP. You should be able to have the team that manages your IDP provide access to a claim (via a scope) that gives you a display repr of the groups instead of ID. Once that is configured on the IDP side you may have to adjust the nautobot configuration to add the new scope that provides access to the claims you're looking for