Portal fails to map single OIDC group to multiple Portal groups

jameshbarton commented 2 years ago

Describe the bug A Portal user need to map single OIDC group to multiple Portal groups.

Team 1 should be able to create GROUP-1 mapping to OIDC-Group-2
Team 2 should be able to create GROUP-2 mapping to OIDC-Group-2 In the above case, members of OIDC-Group-2 should have access to union of API products allowed by GROUP-1 and GROUP-2. But the Portal only reflects products from one of the two groups.

There is a related but less important issue with how status is reported from conflicting groups:

In the attached groups.yaml file, I created 2 Gloo Group CRs. Both map to same OIDC Group PROJ1-DEV.

The Gloo documentation mentioned the following: OIDC group name should be unique across all Gloo Groups. In this case, Gloo should have rejected the second group. However, both groups show in Succeeded status. When I log in to the Portal, I only see API Products accessible via project-1-group.

To Reproduce

See attached groups.yaml.zip
Apply both groups.
See both groups show as Succeeded, but only first group's APIProducts are visible.

Expected behavior Gloo Portal should cleanly reject second group added. Ideally, a single OIDC group should be mappable to multiple Portal groups.

Additional context

Gloo Portal version 1.2.0-beta4

spunuru commented 2 years ago

Any time estimate for this fix? Thanks!

jameshbarton commented 2 years ago

Any time estimate for this fix?

@spunuru The goal is to deliver this by mid-January. We will let you know if it's available sooner.

jameshbarton commented 2 years ago

Related Zendesk ticket: https://solo-io.zendesk.com/agent/tickets/463

jenshu commented 2 years ago

this has been implemented and will be available in Gloo Portal v1.2.0-beta6

solo-io / gloo-portal-issues

Portal fails to map single OIDC group to multiple Portal groups #145