OIDC scopes groups not working

[creeram]

I'm trying to use groups for the admin permissions.

api:
  enabled: true
  replicas: 1
  host: kargo.example.com
  tls:
    enabled: false
  ingress:
    enabled: true
    ingressClassName: nginx
    tls:
      enabled: false

  adminAccount:
    enabled: false
  oidc:
    enabled: true
    issuerURL: https://keycloak.example/realms/{realmname}
    clientID: kargo
    additionalScopes: []
    admins:
      claims:
        email:
        - [email protected]
        groups:
        - kargo-admin

the api.oidc.claims.email works as an admin user. But the groups are not working.

kargo-admin is a i tried creating groups on Keycloak and Google Group with users added in the group for testing but could not get the admin permissions.

am I doing something wrong here?

[krancour]

You either need to remove the override for additionalScopes or include groups in that override.

The default additionalScopes has groups in it since, I think v1.0.0, but you're clobbering it here.

[creeram]

I already tried groups in additionalScopes but it didn't work.

[creeram]

Is it tested on your side with dex if it works with Google Groups?

[krancour]

I have a vague recollection of not getting groups to work with Google, but that was well over a year ago. If I didn't pursue that too hard, it's because that difficulty was entirely on their end.

Groups are just another scope/claim. From Kargo's perspective, there's nothing different about groups than any other claim. They're all handled the same.

We've seen this working correctly with many different configurations, with and without Dex. With some IDPs, that has included the groups claim, among others.

[krancour]

@creeram just following up, seeing as you've confirmed you're not receiving any groups claim from Google, I think the answer lies in configuration (or limitations) on that end. Tentatively closing this, but please do re-open if we can be of further assistance on this.

[creeram]

Yes, it was a limitation from google itself.

[krancour]

Thanks for confirming!