-
-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Closed
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
When using Authentik as a HTTP proxy, the X-Authentik-Groups header only includes the groups the current user is a direct member of. Groups which are a parent to any groups they belong to are not listed in the header.
To Reproduce
- Create a group called
foo - Create a group called
admin - Set the
admingroup's parent to be groupfoo - set your user to be a member of
adminand ensure you are not a direct member offoo - clear all cookies (to force a clean auth state) and login again
- use a service like whoami to see the HTTP headers authentik is forwarding to the backend http service.
- Observe the
X-Authentik-Groupsheader only contains the groupadmin, and does not containfoo.
Expected behavior
The X-Authentik-Groups header should contain admin and foo.
According to the Authentik Groups Documentation, groups which have a parent group inherit their parent's privileges as well. Which should also be reflected on the X-Authentik-Groups http header so that HTTP services that check for group membership can see the full list of groups a member belongs to.
Version and Deployment (please complete the following information):
- authentik version: 2023.5.4
- Deployment: docker-compose
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working