Implement static group assignments by backend

README.md

@@ -90,6 +90,8 @@ Each service definition is a dictionary with the following attributes:
   * `file` is simply a path to a user list file, see the *File
     backend* section below
   * `ldap` configues the LDAP backend for this service
+  * `static_groups` is a list of group names that users sourced from
+    this backend will automatically be added to
 * `challenge_response` is a boolean parameter that, when true, enables
   two-factor authentication for this service (it should be enabled
   only for interactive services)

server/authserver.go

@@ -162,6 +162,7 @@ type requestFilter interface {
 type BackendSpec struct {
 	LDAPSpec     *LDAPServiceConfig `yaml:"ldap"`
 	FileSpec     string             `yaml:"file"`
+	StaticGroups []string           `yaml:"static_groups"`
 }
 
 // ServiceConfig defines the authentication backends for a service.
@@ -385,6 +386,9 @@ func (s *Server) getUser(ctx context.Context, serviceConfig *ServiceConfig, user
 	for _, spec := range serviceConfig.BackendSpecs {
 		for _, b := range s.backends {
 			if user, ok := b.GetUser(ctx, spec, username); ok {
+				if len(spec.StaticGroups) > 0 {
+					user.Groups = append(user.Groups, spec.StaticGroups...)
+				}
 				return user, true
 			}
 		}