tchiotludo / akhq

Kafka GUI for Apache Kafka to manage topics, topics data, consumers group, schema registry, connect and more...
https://akhq.io/
Apache License 2.0
3.41k stars 660 forks source link

OIDC google login with groups not working #2006

Closed wineth closed 5 hours ago

wineth commented 6 hours ago

We have google groups created with gsuite. We want to use google groups for RBAC. This configuration is used with last version 0.25.1 Is there something missing ? it seems like ignoring groups ?

configuration:
  logger:
    levels:
      io.micronaut.security: TRACE
  micronaut:
    security:
      enabled: true
      oauth2:
        enabled: true
        clients:
          google:
            client-id: "xxxxxx"
            client-secret: "xxx"
            openid:
              issuer: "https://accounts.google.com"

  akhq:
    security:
      roles:
        topic-reader:
          - resources: [ "TOPIC", "TOPIC_DATA" ]
            actions: [ "READ" ]
          - resources: [ "TOPIC" ]
            actions: [ "READ_CONFIG" ]
        topic-writer:
          - resources: [ "TOPIC", "TOPIC_DATA" ]
            actions: [ "CREATE", "UPDATE" ]
          - resources: [ "TOPIC" ]
            actions: [ "ALTER_CONFIG" ]
        topic-admin:
          - resources: [ "TOPIC", "TOPIC_DATA" ]
            actions: [ "READ", "CREATE", "DELETE" ]
          - resources: [ "TOPIC" ]
            actions: [ "UPDATE", "READ_CONFIG", "ALTER_CONFIG" ]
      groups:
        hp-topic-admin:
          - role: topic-admin
            patterns: ".*"
            clusters: [ "aiven-hp" ]
        nohp-topic-reader:
          - role: topic-reader
            patterns: ".*"
            clusters: [ "aiven-ciapp", "aiven-pp", "aiven-pr" ]
      default-group: no-roles
      oidc:
        enabled: true
        providers:
          google:
            label: "Login with GL Google Account"
            username-field: email
            groups-field: roles
            default-group: reader
            groups:
              - name: google_group@compagny.com
                groups:
                  - hp-topic-admin
                  - nohp-topic-reader
    server:
      access-log: 
        enabled: true
        name: org.akhq.log.access
tchiotludo commented 5 hours ago

It's not possible, google on OIDC don't return any groups (and will never as I understand).