WIP: make it work

Signed-off-by: Louis Chmn <louis@chmn.me>

blueprints/authentik-oidc.yaml

@@ -18,7 +18,11 @@ entries:
       name: haze-nextcloud-oidc-uid
     attrs:
       scope_name: nextcloud
-      expression: 'return {"nextcloud_uid": "oidc-" + request.user.username}'
+      expression: |
+        return {
+            "nextcloud_uid": "oidc-" + request.user.username,
+            "nextcloud_gss_node": request.user.attributes.get("nextcloud_gss_node", ""),
+        }
 
   - model: authentik_providers_oauth2.oauth2provider
     id: nextcloud-oidc-provider

blueprints/authentik-saml.yaml

@@ -20,6 +20,16 @@ entries:
       saml_name: http://haze.test/nextcloud/uid
       expression: 'return "saml-" + request.user.username'
 
+  # Symbolic name of the Global Scale node the user belongs to, resolved to an
+  # address by the mapping file maintained by haze.
+  - model: authentik_providers_saml.samlpropertymapping
+    id: haze-nextcloud-gss-node
+    identifiers:
+      name: haze-nextcloud-gss-node
+    attrs:
+      saml_name: http://haze.test/nextcloud/gss-node
+      expression: 'return request.user.attributes.get("nextcloud_gss_node", "")'
+
   - model: authentik_providers_saml.samlprovider
     id: nextcloud-provider
     identifiers:
@@ -65,6 +75,7 @@ entries:
       name_id_mapping: !KeyOf haze-nextcloud-uid
       property_mappings:
         - !KeyOf haze-nextcloud-uid
+        - !KeyOf haze-nextcloud-gss-node
         - !Find [
             authentik_providers_saml.samlpropertymapping,
             [managed, goauthentik.io/providers/saml/username],

blueprints/authentik.yaml

@@ -25,6 +25,8 @@ entries:
       email: alice@haze.test
       password: password
       type: internal
+      attributes:
+        nextcloud_gss_node: slave1
       groups:
         - !KeyOf authentik-group1
   - model: authentik_core.user
@@ -36,6 +38,8 @@ entries:
       email: bob@haze.test
       password: password
       type: internal
+      attributes:
+        nextcloud_gss_node: slave2
       groups:
         - !KeyOf authentik-group2
   - model: authentik_core.user
@@ -47,5 +51,7 @@ entries:
       email: charlie@haze.test
       password: password
       type: internal
+      attributes:
+        nextcloud_gss_node: slave3
       groups:
         - !KeyOf authentik-group3