Skip to content

/api/v3/rbac/permissions/roles/ API returns incorrect object_description when multiple group permissions are added to a rule #11579

@oliverfrye

Description

@oliverfrye

Describe the bug

When a role has group permissions from more than one group added to it, the /api/v3/rbac/permissions/roles/ API returns the same object_description for each binding, even when different groups (and thus group names) are involved.

This can be seen in the RBAC UI for a role, which uses said API call.

To Reproduce

  1. Create a new role
  2. Assign two or more group-level permissions for two different groups to the new role
  3. Go to the role's detail page -> Permissions -> Assigned object permissions
  4. Note that the value under "Object" will be repeated for each row, even though they refer to different groups

Expected behavior

Each object_description should be correctly set to the name of the group to which the binding refers.

Screenshots

image

In the above image, I have bound the role to three different groups, but they all show up with the same "Object" value.

Logs

N/A

Version and Deployment (please complete the following information):

  • authentik version: 2024.8.3
  • Deployment: helm

Additional context

N/A

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingbug/confirmedConfirmed bugs

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions