website/docs: Add note about single group per role#12169
website/docs: Add note about single group per role#12169tanberry merged 1 commit intogoauthentik:mainfrom
Conversation
This change adds an admonition to document the fact that every role can only ever be assigned to a single group at the same time. Since this is surprising based on a traditional understanding of role-based models, I've decided to make this a `:::warning`. I'm undecided on the best place for this information, but for now, decided on putting it into the context of the action that can fail: assigning a role to a group. While this does not close the issue, it documents this behavior to at least address the "needs documentation" aspect of goauthentik#10983 . Signed-off-by: Zuri Klaschka <pklaschka@users.noreply.github.com>
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
✅ Deploy Preview for authentik-storybook ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
|
Hi @pklaschka thanks so much for this PR. It also helped me catch the fact that I need to update the docs to use the new "dual-select" UI component that is now in the UI for selecting roles. I think we introduced it in version 2024.8, but I failed to update the docs about assigning roles to a group. Which version are you running? On your point, though, about not being able to assign a single role (say Role X) to multiple groups... I don't think that is correct. I was able to assign a role called Multiple Group Role to two different Groups. Maybe you mean "at the same time" as in during same action? That is true; one has to go to each Group separately, and assign the role. |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #12169 +/- ##
==========================================
- Coverage 92.67% 92.43% -0.24%
==========================================
Files 761 761
Lines 38025 38025
==========================================
- Hits 35239 35149 -90
- Misses 2786 2876 +90
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
|
Hi @tanberry , thanks for your quick response!
If I assign a role ( ["Roles can only be used with a single group."]in the underlying call to 
When I unassign the role from its current group assignment ( This is the case in 2024.10.4, at least… So on my end, the behavior matches the behavior in #10983 (where @BeryJu confirmed that limitation). |
|
My best guess would be that this limitation stems from this authentik/authentik/rbac/models.py Lines 38 to 47 in 5e72ec9 But I have no experience with Django, so this is nothing more than an educated guess by a non-Django dev (and also makes limited sense as it's technically a 1:n instead of a 1:1 relationship – whereas the expectation would be N:M) 😉 . |
|
Aha, I learned a ton here, including the fact that I need to do a search on the I want to do a bit more research about exactly which version this changed in (I suspect it is above in your notes but I need more coffee), and see if Notes are needed about that. But in meantime, let's merge your PR, and then I will open one to update the steps to use the dual-select component. |
tanberry
left a comment
There was a problem hiding this comment.
Thanks again, you are welcome to comb over the docs and help us as much as you want! :-)
* main: website/docs: Add note about single group per role (#12169) website/docs: Fix documentation about attribute merging for indirect membership (#12168) root: support running authentik in subpath (#8675) docs: fix contribution link (#12189) core, web: update translations (#12190) core: Bump msgraph-sdk from 1.12.0 to 1.13.0 (#12191) core: Bump selenium from 4.26.1 to 4.27.0 (#12192)
Details
This change adds an admonition to document the fact that every role can only ever be assigned to a single group at the same time. Since this is surprising based on a traditional understanding of role-based models, I've decided to make this a
:::warning.I'm undecided on the best place for this information, but for now, decided on putting it into the context of the action that can fail: assigning a role to a group.
While this does not close the issue, it documents this behavior to at least address the "needs documentation" aspect of #10983 .
Checklist
ak test authentik/)make lint-fix)If an API change has been made
make gen-build)If changes to the frontend have been made
make web)If applicable
make website)