Skynet/ldap_backend

Watch

Fork 0

New users dont get teh ``skynet-users`` group #55

New issue

Open

opened 2026-09-13 11:28:26 +00:00 by silver · 0 comments

silver commented

2026-09-13 11:28:26 +00:00

Owner

Overview

Currently we have an issue where folks who create a skynet account dont get access to our services until after the update_groups script has been run.

We know from get_wolves_mail that the folks who get to that stage either are or have been members of computer society.

for record in get_wolves_mail(db, &user_db.mail).await {

In authentik_create_account is where the account is actually created on authentik

authentik_create_account(config, &user, &record, &pass).await;

groups are set in authentik_create_account (Struct definition here: https://docs.rs/authentik-client/2026.5.3/authentik_client/models/user_request/struct.UserRequest.html )

groups: Some(vec![]),

From the update_groups script we are able to see where to find the group id &config.authentik.groups.user

update_group(config, &config.authentik.groups.user, users).await?;

To do

Adding user role to folks

Add &config.authentik.groups.user to

groups: Some(vec![]),

Limit signups to current/active members only

Currently the command to check teh wolves email only checks if that email is used for any past/current members;

   pub async fn get_wolves_mail(db: &Pool<Sqlite>, mail: &str) -> Vec<AccountWolves> {
     sqlx::query_as::<_, AccountWolves>(
       r#"
         SELECT *
         FROM accounts_wolves
         WHERE email = ?
         "#,
     )
     .bind(mail)
     .fetch_all(db)
     .await
     .unwrap_or(vec![])
   }

One way to tackle this would eb to use something like update_groups where it checks teh expiry field is greater than now.

   for record in get_wolves(db).await {
     // only import users if it is actually active.
     if record.expiry < get_now_iso(true) {
       continue;
     }

This would be easy to integrate after teh current check for if the person has a *@skynet.ie email listed on wolves.

       // skynet emails not permitted
       if record.email.trim().ends_with("@skynet.ie") {
         continue;
       }

This might also need to be added up in the initial request where the user starts teh process

       // skynet emails not permitted
       if record.email.trim().ends_with("@skynet.ie") {
         continue;
       }
       // if using csv check if the account is within date

Provide feedback to the user

One slight issue now is that if a user does have any errors which prevent account creation in here then they arent informed:

     for record in get_wolves_mail(db, &user_db.mail).await {
       // skynet emails not permitted
       if record.email.trim().ends_with("@skynet.ie") {
         continue;
       }
       authentik_create_account(config, &user, &record, &pass).await;
     }

It might be worth having a flag before that for loop which checks if teh account was created, and if not it returns an error instead of teh Ok(json!({"result": "success"}).into())

# Overview Currently we have an issue where folks who create a skynet account dont get access to our services until after the ``update_groups`` script has been run. We know from ``get_wolves_mail`` that the folks who get to that stage either are or have been members of computer society. https://forgejo.skynet.ie/Skynet/ldap_backend/src/commit/a2152e1462f79a57947837d9b452951ef75057df/src/methods/account_new.rs#L131 In ``authentik_create_account`` is where the account is actually created on ``authentik`` https://forgejo.skynet.ie/Skynet/ldap_backend/src/commit/a2152e1462f79a57947837d9b452951ef75057df/src/methods/account_new.rs#L137 ``groups`` are set in ``authentik_create_account`` (Struct definition here: https://docs.rs/authentik-client/2026.5.3/authentik_client/models/user_request/struct.UserRequest.html ) https://forgejo.skynet.ie/Skynet/ldap_backend/src/commit/a2152e1462f79a57947837d9b452951ef75057df/src/methods/account_new.rs#L197 From the ``update_groups`` script we are able to see where to find the group id ``&config.authentik.groups.user`` https://forgejo.skynet.ie/Skynet/ldap_backend/src/commit/a2152e1462f79a57947837d9b452951ef75057df/src/bin/update_groups.rs#L68 # To do ## Adding user role to folks Add ``&config.authentik.groups.user`` to https://forgejo.skynet.ie/Skynet/ldap_backend/src/commit/a2152e1462f79a57947837d9b452951ef75057df/src/methods/account_new.rs#L197 ## Limit signups to current/active members only Currently the command to check teh wolves email only checks if that email is used for any past/current members; https://forgejo.skynet.ie/Skynet/ldap_backend/src/commit/a2152e1462f79a57947837d9b452951ef75057df/src/methods/account_new.rs#L44-L56 One way to tackle this would eb to use something like ``update_groups`` where it checks teh ``expiry`` field is greater than now. https://forgejo.skynet.ie/Skynet/ldap_backend/src/commit/a2152e1462f79a57947837d9b452951ef75057df/src/bin/update_groups.rs#L98-L102 This would be easy to integrate after teh current check for if the person has a ``*@skynet.ie`` email listed on wolves. https://forgejo.skynet.ie/Skynet/ldap_backend/src/commit/a2152e1462f79a57947837d9b452951ef75057df/src/methods/account_new.rs#L132-L136 This might also need to be added up in the initial request where the user starts teh process https://forgejo.skynet.ie/Skynet/ldap_backend/src/commit/a2152e1462f79a57947837d9b452951ef75057df/src/methods/account_new.rs#L26-L32 ## Provide feedback to the user One slight issue now is that if a user does have any errors which prevent account creation in here then they arent informed: https://forgejo.skynet.ie/Skynet/ldap_backend/src/commit/a2152e1462f79a57947837d9b452951ef75057df/src/methods/account_new.rs#L131-L138 It might be worth having a flag before that for loop which checks if teh account was created, and if not it returns an error instead of teh ``Ok(json!({"result": "success"}).into())``

bivol was assigned by silver

2026-09-13 11:31:31 +00:00

No labels

Trainee - Good First Issue

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Skynet/ldap_backend#55

No description provided.

Rows
Columns

New users dont get teh `skynet-users` group #55