Subgroup for users

[sherlant]

Hello, i test actually the operator and it looks great ! Thanks for the job. I have testing to create a subgroup, who works, but i can't add it in user definition. I have try with direct name and path "titi/toto" or "/titi/toto", but the group is not found by the operator. I have miss something ?

Thanks for your response.

[zmotso]

Hi, @sherlant . Please provide examples of your CRs.

[sherlant]

In fact, i don't create two groups with subgroup dependency correctly. I create two groups with the following definition :

• group test1:

  ---
  apiVersion: v1.edp.epam.com/v1
  kind: KeycloakRealmGroup
  metadata:
  name: test1
  namespace: cloudcrane-lab-keycloak-lab
  spec:
  name: test1
  path: /test1
  realmRef:
      kind: KeycloakRealm
      name: master
  subGroups:
      - test2

• group test2:

  ---
  apiVersion: v1.edp.epam.com/v1
  kind: KeycloakRealmGroup
  metadata:
  name: test2
  namespace: cloudcrane-lab-keycloak-lab
  spec:
  name: test2
  path: /test1/test2
  realmRef:
      kind: KeycloakRealm
      name: master

  but i have an error. if i want to synchronise test2 first, when i want to synchronise test1 :

  unable to sync realm group: unable to sync subgroups, group: {
  "id": "20bd9409-a37d-44e8-962c-6e4e5f065515",
  "name": "test1",   
  "path": "/test1",  
  "subGroups": [],   
  "attributes": null,
  "access": null     
  } with spec: &{Name:test1 Realm: RealmRef:{Kind:KeycloakRealm Name:master} Path:/test1 Attributes:map[] Access:map[] RealmRoles:[] SubGroups:[test2] ClientRoles:[]}: unable to get group, realm: master, group: test2: group not found

  but in kc, the two groups look like OK. if i want to synchronise test1 first, same error. What is the correct way to create two groups with subGroup dependency, and a user that use the test2 subgroup ?

[zmotso]

@sherlant Thank you for the feedback. I have checked the subgroup functionality and confirm we have a bug here. It is due to changes to the keycloak version 23. https://www.keycloak.org/docs/latest/upgrading/index.html#grouprepresentation-changes

I'm working on a fix and will provide it soon.

[sherlant]

thanks a lot, please ping me when it's ok. I can test your fix quickly