netbirdio / netbird

Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.
https://netbird.io
BSD 3-Clause "New" or "Revised" License
11.24k stars 517 forks source link

Cant assign manually created groups via jwt group sync #2685

Open BcTpe4HbIu opened 1 month ago

BcTpe4HbIu commented 1 month ago

Is your feature request related to a problem? Please describe. If group was created via api it wont be assigned on users via jwt group sync. For example, if you prepare routes and policies before any user login with new groups, group will be created via API and jwt sync will ignore it. See here

Describe the solution you'd like Some kind of switch in UI for group to change group.Issued to JWT would be great. A switch in UI to change group type (group.Issued) to JWT. And/Or property in api method "update group".

Describe alternatives you've considered Currently I've changed group.Issued directly in sqlite and will try to ensure that groups are created via jwt sync. But it's not exactly easy.

salvatorebic commented 1 month ago

Apart from interacting with the db, is there any other workaround that could work? Thx.

febs commented 4 weeks ago

@BcTpe4HbIu Would you mind please sharing how did you edit the database? Thank you.

BcTpe4HbIu commented 3 weeks ago

@febs That's depends on what database you are using and how you deploy your netbird management service. Assuming default docker-compose setup:

  1. Get static sqlite3 binary from here
  2. Copy binary to management container docker-compose cp ./sqlite3 management:/var/lib/netbird/sqlite3
  3. Exec into management container docker-compose exec -ti management bash
  4. Make a database backup (just in case) cd /var/lib/netbird && cp store.db store.db.$(date +%s)
  5. Make sqlite3 excutable and connect to DB cd /var/lib/netbird && chmod +x sqlite3 && ./sqlite3 store.db
  6. Update required groups with "jwt" type update groups set issued='jwt' where name='GROUP_NAME_HERE';
  7. Done.