Fix OIDCClients that need groups claim #49

New Issue

2024-08-26T20:15:27Z

eaas commented

2024-08-26 20:15:27 +00:00

Before, groups we're always included. Now, groups (and allowed_groups) are separate scopes. Reconfigure OIDCClients and applications. Use overrideIncomingScopes, if needed.

eaas commented

2024-08-26 20:17:56 +00:00

Desired OIDCClient for wiki.js (only returns one or many relevant groups for wiki):

---
apiVersion: codemowers.cloud/v1beta1
kind: OIDCClient
metadata:
  name: wiki
spec:
  displayName: Wiki
  uri: https://wiki.k-space.ee
  redirectUris:
    - https://wiki.k-space.ee/login/a4cdccdc-c879-4387-a64a-6584a02a85e9/callback
  allowedGroups:
    - k-space:floor
  grantTypes:
    - authorization_code
    - refresh_token
  responseTypes:
    - code
  availableScopes:
    - openid
    - profile
    - allowed_groups
  overrideIncomingScopes: true
  tokenEndpointAuthMethod: client_secret_post
  pkce: false
  secretRefreshPod:
    apiVersion: v1
    kind: Pod
     ....

@rasmus jfyi, will let you know when passmower updated and wikijs client configured

Desired OIDCClient for wiki.js (only returns one or many relevant groups for wiki): ``` --- apiVersion: codemowers.cloud/v1beta1 kind: OIDCClient metadata: name: wiki spec: displayName: Wiki uri: https://wiki.k-space.ee redirectUris: - https://wiki.k-space.ee/login/a4cdccdc-c879-4387-a64a-6584a02a85e9/callback allowedGroups: - k-space:floor grantTypes: - authorization_code - refresh_token responseTypes: - code availableScopes: - openid - profile - allowed_groups overrideIncomingScopes: true tokenEndpointAuthMethod: client_secret_post pkce: false secretRefreshPod: apiVersion: v1 kind: Pod .... ``` @rasmus jfyi, will let you know when passmower updated and wikijs client configured

👍 1

rasmus commented

2026-01-31 22:24:00 +00:00

WikiJS groups mapping isn't working, this is probably a problem with wiki.js.

https://github.com/requarks/wiki/discussions/6894

Even when "k-space:floor" group is created in WikiJS, the mapping does nothing. There aren't meaningful debug facilities in WikiJS, apart from compiling your own / running with a debugger.

WikiJS groups mapping isn't working, this is probably a problem with wiki.js. https://github.com/requarks/wiki/discussions/6894 Even when "k-space:floor" group is created in WikiJS, the mapping does nothing. There aren't meaningful debug facilities in WikiJS, apart from compiling your own / running with a debugger.

rasmus added the disposal label 2026-01-31 22:24:17 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: k-space/kube#49