OIDC Group/Role-Based Access Control and Membership Sync

[sasirven]

Issue: Closes #3876

What existing problem does this PR solve?

Previously, Timesketch OIDC authentication only supported user-level access control via allow-lists. This meant:

• Group and role information from the identity provider was ignored
• Users had to be manually added to Timesketch groups through tsctl
• Admin privileges couldn't be automatically granted based on group membership
• Stale group memberships accumulated when users changed teams or left the organization

What new feature is being introduced with this PR?

This PR adds comprehensive OIDC group/role-based access control with automatic membership synchronization:

1. Group-based access control - Restrict login to users who are members of specific groups/roles via GOOGLE_OIDC_ALLOWED_GROUPS
2. Automatic group membership sync - Auto-create Timesketch groups and add users based on their OIDC token claims
3. Admin group provisioning - Automatically grant admin privileges to members of GOOGLE_OIDC_ADMIN_GROUP
4. Stale membership cleanup - Remove users from groups they're no longer members of and revoke admin privileges when they leave the admin group
5. Flexible claim parsing - Support various OIDC provider formats using configurable separators, regex extraction, and custom claim names

Overview of changes to existing functions

• timesketch/lib/google_auth.py:

  • Added get_groups_from_jwt() to extract and normalize group/role names from JWT claims with regex and separator support
  • Updated get_oauth2_authorize_url() to make OIDC scopes configurable

• timesketch/views/auth.py:

  • Refactored google_openid_connect() callback to support group-based access control and automatic group synchronization
  • Added logic to sync group membership and admin privileges during login

• data/timesketch.conf:

  • Added 8 new configuration parameters for group claim extraction and synchronization

Checks

• All tests succeed.
• Unit tests added.
• e2e tests added.
• Documentation updated (configuration examples in timesketch.conf).

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[sasirven]

For the CLA, except if I’m missing something, if you check my committer email, it is covered under Michelin’s CLA.
If you need any additional information, or if there’s anything I can do, please let me know!

[jkppr]

/Gemini review

[gemini-code-assist]

Code Review

This pull request introduces Google OIDC group synchronization and access control features to Timesketch, allowing group memberships and admin privileges to be synced directly from OIDC tokens. It includes configuration updates, helper functions for extracting groups from JWTs, and a refactored authentication flow with comprehensive tests. The review feedback highlights three key issues: a potential runtime error when modifying user.groups while iterating over it, a possible AttributeError in regex group extraction if an optional capture group is None, and a style guide violation where an f-string is used for logging instead of the preferred % formatting.