Merge pull request #1297 from tburko/use-github-team-slug-instead-of-name

Allow using GitHub Team slug instead of name via connector config option

Documentation/connectors/github.md

@@ -28,6 +28,7 @@ connectors:
     clientID: $GITHUB_CLIENT_ID
     clientSecret: $GITHUB_CLIENT_SECRET
     redirectURI: http://127.0.0.1:5556/dex/callback
+
     # Optional organizations and teams, communicated through the "groups" scope.
     #
     # NOTE: This is an EXPERIMENTAL config option and will likely change.
@@ -51,6 +52,14 @@ connectors:
       teams:
       - red-team
       - blue-team
+
+    # Optional choice between 'name' (default) or 'slug'.
+    #
+    # As an example, group claims for member of 'Site Reliability Engineers' in
+    # Acme organization would yield:
+    #   - ['acme:Site Reliability Engineers'] for 'name'
+    #   - ['acme:site-reliability-engineers'] for 'slug'
+    teamNameField: slug
 ```
 
 ## GitHub Enterprise

connector/github/github.go

@@ -47,6 +47,7 @@ type Config struct {
 	Orgs          []Org  `json:"orgs"`
 	HostName      string `json:"hostName"`
 	RootCA        string `json:"rootCA"`
+	TeamNameField string `json:"teamNameField"`
 }
 
 // Org holds org-team filters, in which teams are optional.
@@ -107,6 +108,13 @@ func (c *Config) Open(id string, logger logrus.FieldLogger) (connector.Connector
 
 	}
 
+	switch c.TeamNameField {
+	case "name", "slug", "":
+		g.teamNameField = c.TeamNameField
+	default:
+		return nil, fmt.Errorf("invalid connector config: unsupported team name field value `%s`", c.TeamNameField)
+	}
+
 	return &g, nil
 }
 
@@ -135,6 +143,7 @@ type githubConnector struct {
 	rootCA string
 	// HTTP Client that trusts the custom delcared rootCA cert.
 	httpClient    *http.Client
+	teamNameField string
 }
 
 // groupsRequired returns whether dex requires GitHub's 'read:org' scope. Dex
@@ -566,6 +575,7 @@ type team struct {
 	Org  struct {
 		Login string `json:"login"`
 	} `json:"organization"`
+	Slug string `json:"slug"`
 }
 
 // teamsForOrg queries the GitHub API for team membership within a specific organization.
@@ -586,7 +596,12 @@ func (c *githubConnector) teamsForOrg(ctx context.Context, client *http.Client,
 
 		for _, team := range teams {
 			if team.Org.Login == orgName {
+				switch c.teamNameField {
+				case "name", "":
 					groups = append(groups, team.Name)
+				case "slug":
+					groups = append(groups, team.Slug)
+				}
 			}
 		}