OIDC: assign user Type (Admin/Regular) from a group claim

[ivanroussev]

Hi,

We use EspoCRM 10.0.x with Keycloak as our OIDC identity provider, with group claim sync to Teams enabled (Group Claim + Sync Teams). This works well for Teams, but there's no way to control the user Type (Admin/Regular) from the identity provider. Admins have to be promoted manually under Administration → Users after their first login.

Request: an OIDC setting that maps a group claim value to the Admin user type. For example, an "Admin Group" field: if the user's group claim contains that value, they're synced as Admin on login, and if it doesn't, they're set back to Regular.

Why:

• We can manage access centrally in the identity provider. Many other apps (Grafana, Argo CD, Superset) already support this.
• Removing someone from the admin group in the identity provider would revoke their EspoCRM admin rights automatically. Today it doesn't, so it's easy to forget during offboarding.
• No manual step after each user's first login.

It could be opt-in, and only apply when "Sync" is enabled, so existing setups aren't affected.

Thanks!

[emillod]

If you can manage groups via OIDC and link them to a team, maybe you can simply create a script which based on that gives permissions in EspoCRM? It's actually one field.