Open joesims22 opened 1 month ago
By default with keycloak as well as other oidc providers, the "sub" claim (which we use to form our principal ID) is populated with the ID of the user. It is possible to map a different value to the sub claim to make for a more user-friendly UX, but you do need to be careful to set it to something that is guaranteed to be unique (which username should be) and ideally immutable because if it changes and the user logs in, it will be seen as a new Rancher user.
Rancher Server Setup
3a6de11e
Information about the Cluster
Describe the bug When GenericOIDC(keycloak) auth provider is enabled, auth provider users that are added to a cluster/project by their username are not able to access resources upon logging in. Only if a user is added by their userID will they have access to resources upon logging in.
To Reproduce
Expected Result Users should be able to access resources when added by their username.