OIDC Group/Role-Based Access Control and Membership Sync

[sasirven]

Is your feature request related to a problem? Please describe.

Currently, Timesketch's OIDC authentication only supports user-level access control via the GOOGLE_OIDC_ALLOWED_USERS configuration. This means:

• User permissions must be manually managed within Timesketch, decoupled from the organization's identity provider
• Groups and roles defined in the identity provider are ignored
• Teams cannot be automatically added to Timesketch groups based on their OIDC claims
• Admin privileges cannot be granted based on group membership in the identity provider
• Organizations must manually sync group membership when users change teams/roles, leading to stale permissions and security gaps

Describe the solution you'd like

Add support for extracting groups/roles from OIDC token claims and using them to:

1. Enforce group-based access control: Allow administrators to restrict login to users who are members of specific groups/roles in the identity provider via GOOGLE_OIDC_ALLOWED_GROUPS

2. Automatically sync group membership: When GOOGLE_OIDC_GROUPS_SYNC_ENABLED is enabled, automatically create Timesketch groups and add users as members based on their OIDC token claims

3. Grant admin privileges by group: Users who are members of the configured GOOGLE_OIDC_ADMIN_GROUP are automatically created with admin privileges

4. Clean up stale permissions: When GOOGLE_OIDC_GROUPS_REMOVE_STALE is enabled, automatically remove users from Timesketch groups they're no longer members of in the identity provider, and revoke admin privileges when they leave the admin group

5. Flexible group claim parsing: Support various OIDC provider formats via configurable claim name (GOOGLE_OIDC_GROUPS_CLAIM), separator (GOOGLE_OIDC_GROUPS_SEPARATOR), and regex extraction (GOOGLE_OIDC_GROUPS_REGEX)

Describe alternatives you've considered

• Restrict access with GOOGLE_OIDC_ALLOWED_USERS only: Using the existing GOOGLE_OIDC_ALLOWED_USERS configuration to maintain an allow-list requires manual maintenance of user email addresses in the config file. Additionally, group membership in Timesketch must still be manually managed through the tsctl.

• Use SSO-based group management: While SSO mode (SSO_GROUP_ENV_VARIABLE) also provides automatic group sync, it requires complex web server configuration to extract and pass group information as environment variables.

Additional context