✨ [#65] Add functionality to make users superuser based on groups

issue: #65

mozilla_django_oidc_db/admin.py

@@ -51,6 +51,7 @@ class OpenIDConnectConfigAdmin(DynamicArrayMixin, SingletonModelAdmin):
                     "sync_groups_glob_pattern",
                     "default_groups",
                     "make_users_staff",
+                    "superuser_group_names",
                 )
             },
         ),

mozilla_django_oidc_db/backends.py

@@ -145,11 +145,30 @@ def update_user(self, user, claims):
 
         user.save(update_fields=values.keys())
 
+        self.update_user_superuser_status(user, claims)
+
         self.update_user_groups(user, claims)
         self.update_user_default_groups(user)
 
         return user
 
+    def update_user_superuser_status(self, user, claims):
+        """
+        Assigns superuser status to the user if the user is a member of at least one
+        specific group. Superuser status is explicitly removed if the user is not or
+        no longer member of at least one of these groups.
+        """
+        groups_claim = self.config.groups_claim
+        superuser_group_names = self.config.superuser_group_names
+
+        if groups_claim and superuser_group_names:
+            claim_groups = glom(claims, groups_claim, default=[])
+            if set(superuser_group_names) & set(claim_groups):
+                user.is_superuser = True
+            else:
+                user.is_superuser = False
+            user.save()
+
     def update_user_groups(self, user, claims):
         """
         Updates user group memberships based on the group_claim setting.

mozilla_django_oidc_db/migrations/0012_openidconnectconfig_superuser_group_names.py

@@ -0,0 +1,32 @@
+# Generated by Django 3.2.18 on 2023-12-21 11:59
+
+from django.db import migrations, models
+
+import django_better_admin_arrayfield.models.fields
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        (
+            "mozilla_django_oidc_db",
+            "0011_alter_openidconnectconfig_userinfo_claims_source",
+        ),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="openidconnectconfig",
+            name="superuser_group_names",
+            field=django_better_admin_arrayfield.models.fields.ArrayField(
+                base_field=models.CharField(
+                    max_length=50, verbose_name="Superuser group name"
+                ),
+                blank=True,
+                default=list,
+                help_text="If any of these group names are present in the claims upon login, the user will be marked as a superuser. If none of these groups are present the user will lose superuser permissions.",
+                size=None,
+                verbose_name="Superuser group names",
+            ),
+        ),
+    ]

mozilla_django_oidc_db/models.py

@@ -293,6 +293,17 @@ class OpenIDConnectConfig(CachingMixin, OpenIDConnectConfigBase):
             "users to login to the admin interface. By default they have no permissions, even if they are staff."
         ),
     )
+    superuser_group_names = ArrayField(
+        verbose_name=_("Superuser group names"),
+        base_field=models.CharField(_("Superuser group name"), max_length=50),
+        default=list,
+        blank=True,
+        help_text=_(
+            "If any of these group names are present in the claims upon login, "
+            "the user will be marked as a superuser. If none of these groups are present "
+            "the user will lose superuser permissions."
+        ),
+    )
 
     class Meta:
         verbose_name = _("OpenID Connect configuration")