Skip to content

Proxy header X-Authentik-Groups does not include parent groups #6477

@lanrat

Description

@lanrat

Describe the bug
When using Authentik as a HTTP proxy, the X-Authentik-Groups header only includes the groups the current user is a direct member of. Groups which are a parent to any groups they belong to are not listed in the header.

To Reproduce

  1. Create a group called foo
  2. Create a group called admin
  3. Set the admin group's parent to be group foo
  4. set your user to be a member of admin and ensure you are not a direct member of foo
  5. clear all cookies (to force a clean auth state) and login again
  6. use a service like whoami to see the HTTP headers authentik is forwarding to the backend http service.
  7. Observe the X-Authentik-Groups header only contains the group admin, and does not contain foo.

Expected behavior
The X-Authentik-Groups header should contain admin and foo.

According to the Authentik Groups Documentation, groups which have a parent group inherit their parent's privileges as well. Which should also be reflected on the X-Authentik-Groups http header so that HTTP services that check for group membership can see the full list of groups a member belongs to.

Version and Deployment (please complete the following information):

  • authentik version: 2023.5.4
  • Deployment: docker-compose

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions