extractGroups extracts group names from claims (groups or ak_groups for Authentik). Supports: array of strings, array of objects with "name" key, or single string.
(primary, fallback map[string]interface{})
| 418 | // extractGroups extracts group names from claims (groups or ak_groups for Authentik). |
| 419 | // Supports: array of strings, array of objects with "name" key, or single string. |
| 420 | func extractGroups(primary, fallback map[string]interface{}) []string { |
| 421 | for _, key := range []string{"groups", "ak_groups"} { |
| 422 | for _, claims := range []map[string]interface{}{primary, fallback} { |
| 423 | if v, ok := claims[key]; ok && v != nil { |
| 424 | switch val := v.(type) { |
| 425 | case []interface{}: |
| 426 | out := make([]string, 0, len(val)) |
| 427 | for _, item := range val { |
| 428 | switch t := item.(type) { |
| 429 | case string: |
| 430 | out = append(out, t) |
| 431 | case map[string]interface{}: |
| 432 | if n, ok := t["name"].(string); ok && n != "" { |
| 433 | out = append(out, n) |
| 434 | } |
| 435 | } |
| 436 | } |
| 437 | return out |
| 438 | case string: |
| 439 | return []string{val} |
| 440 | } |
| 441 | } |
| 442 | } |
| 443 | } |
| 444 | return nil |
| 445 | } |
| 446 | |
| 447 | // LogoutURL builds the RP-initiated logout URL if the provider supports it. |
| 448 | // Returns empty string if the provider has not yet been discovered or does not |