Clarification about wildcard to allow domains in team setting and OIDC scope for GitLab

[almereyda]

It now occurs to me, that I hadn't completely understood how ALLOWED_DOMAINS was moved to /settings/security. While we tried to use ALLOWED_DOMAINS=* before #2678, we're now aware that #3412 / #3489 moved this into the team settings, where we find a happy list of allowed domains.

For clarification, I would like to ask:

Do I interpret the || in the isDomainAllowed return correctly, that all domains will be allowed, when none is configured there?

outline/server/models/Team.ts

Lines 319 to 329 in 5d810ac

	public isDomainAllowed = async function (
	this: Team,
	domain: string
	): Promise<boolean> {
	const allowedDomains = (await this.$get("allowedDomains")) || [];
	return (
	allowedDomains.length === 0 ||
	allowedDomains.map((d: TeamDomain) => d.name).includes(domain)
	);
	};

If yes, it would be very good to make this more expressive and

• leave a sentence in https://docs.getoutline.com/s/guide/doc/authentication-Wr4sfjvmL1#h-allowed-domains
• mention this in the description text
  

[tommoor]

Do I interpret the || in the isDomainAllowed return correctly, that all domains will be allowed, when none is configured there?

That's correct, but it's important to remember this is just an addition level of security to your authentication provider which would be the primary place to restrict access.

[almereyda]

Pleased to hear. I'm waiting for user feedback at the moment. My own tests didn't cease the expected results, yet, which means something else might still be at play.

Interestingly, the require invites section mentioned in the documentation does not show up on this security settings page.

I'm happy to let anyone in, as long as they passed the registration to the invite-only identity provider in this use case.

[almereyda]

Thanks @tommoor for keeping the documentation up to date. As it turns out the email scope was missing from our early GitLab OIDC implementation. Was this added at some point?

GitLab - Outline led me in the right direction.

[tommoor]

Interestingly, the require invites section mentioned in the documentation does not show up on this security settings page.

It is not available in the community edition, I added a note to the docs just now