You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
After logging in via Keycloak to OpenUnison, on the Home tab I see:
"USERNAME has no roles assigned"
On the left side there's only a "Login ID" attribute. None of the other attributes (names, email address, etc) are shown
Keycloak configuration
I have a groups mapper which looks like this:
My client app adds it to Client scopes as "Default", but OpenUnison is also configured to request the groups scope (see below) just in case.
I'm testing what the generated payload looks like in Keycloak via Clients -> openunison -> Client scopes -> Evaluate.
"Generated access token", "Generated ID token" and "Generated user info" all contain something like this:
The roles seem to be obtained correctly, because it lets me see the services (Kubernetes Dashboard and Kubernetes Tokens) and az_groups is being obeyed.
kubectl auth whoami shows:
ATTRIBUTE VALUE
Username USERNAME
Groups [Kubernetes-Developer Kubernetes-SuperAdministrator system:authenticated]
Role bindings work as expected to grant access based on these groups (confirmed via Kubernetes Dashboard and kubectl).
So, the groups seem to be there somewhere, but.. It just doesn't seem like the UI shows them and the other attribute data (full name, email address, etc).
Logs
These are the logs for openunison-openunison related to logging in again with an existing user:
After logging in via Keycloak to OpenUnison, on the Home tab I see:
Keycloak configuration
I have a
groupsmapper which looks like this:My client app adds it to Client scopes as "Default", but OpenUnison is also configured to request the
groupsscope (see below) just in case.I'm testing what the generated payload looks like in Keycloak via Clients ->
openunison-> Client scopes -> Evaluate."Generated access token", "Generated ID token" and "Generated user info" all contain something like this:
{ "sub": "...", "email_verified": true, "name": "Full Name", "groups": [ "Kubernetes-Developer", "Kubernetes-SuperAdministrator" ], "preferred_username": "USERNAME", "given_name": "Full", "family_name": "Name", "email": "email@example.com" }OpenUnison configuration
The roles seem to be obtained correctly, because it lets me see the services (Kubernetes Dashboard and Kubernetes Tokens) and
az_groupsis being obeyed.kubectl auth whoamishows:Role bindings work as expected to grant access based on these groups (confirmed via Kubernetes Dashboard and
kubectl).So, the groups seem to be there somewhere, but.. It just doesn't seem like the UI shows them and the other attribute data (full name, email address, etc).
Logs
These are the logs for
openunison-openunisonrelated to logging in again with an existing user:The text was updated successfully, but these errors were encountered: