OIDC group scope? Harbor

[badsmoke]

Hello,

i am pretty new to the saml/oidc/ldap material

i am currently testing with authentik, 2022.8.2 and harbor 2.6.0

i would like to have the groups i have in authentik also available in harbor, what do i have to create for this? i assume that i can adapt this for portainer and rancher for example?

thanks already

[BeryJu]

The screenshot in the harbor documentation is a bit outdated, you dont have to create anything for this you can just set the groups claim to groups

[badsmoke]

thanks, don't i have to create another group scope on the authentics page?

in the harbor at least it does not look like it would work

[BeryJu]

No, the groups claim is included in the default profile scope, see https://github.com/goauthentik/authentik/blob/main/blueprints/system/providers-oauth2.yaml#L47

[badsmoke]

ah cool thanks.

should I automatically see something in the harbor?

i have for example the group maintainer, with a user test.

but in the harbor this group does not exist automatically, and when i add it manually the user test still does not have access.

[badsmoke]

everything works now, I just forgot to set the "group claim name"

but the groups are only set when someone has logged in with the corresponding group?

[BeryJu]

What do you mean with has logged in with the corresponding group?

[BeryJu]

Due to the way OIDC works the Groups are only provisioned when the user logs in. I don't know if Harbor has support for something like SCIM or supports OIDC and LDAP at the same time, but that would solve this issue.