question: can the access-groups for apps be used for authorization with the various IDPs providing authentication

[damianslee]

Hi,
couldn't work if this is supported from the documentation

if i am using SAML or Oauth2 for sign on to shiny proxy, can i use the users UPN/email in application.yml access-groups, access-users, users config (without password) to manage authorization of apps?

thanks

[damianslee]

i did some testing. using oauth, its possible to use the config fields "admin-users" and "access-users" in the apps to restrict access.

the users: groups don't work, which i kind of expect.

nice to have if we could get and configure oauth users display name as well as user identifying attribute like "sub". EntraID oauth doco says preferred_username shouldn't be used. "sub" is a string of hex characters so it affects the name displayed in the UI.
eg
proxy.oauth2.username-attribute
proxy.oauth2.displayname-attribute