Trouble setting up RBAC (OIDC auth works fine)

[landbaychrisburrell]

Hi

I'm wondering if i'm missing some RBAC configuration - I'm starting small but for some reason i can no longer list my clusters when i turn on RBAC. I assume the 'name' in the clusters must match the list of clusters. Also i assume that kafka, rbac, auth are all at the same level (e.g. rbac isn't specified under 'auth')

Here's the configuration I have:

    yamlApplicationConfig:
      kafka:
        clusters:
          - name: mycluster
             ...

then in my rbac configuration

          rbac:
            roles:
              - name: "readonly"
                clusters:
                  - mycluster
                subjects:
                  - provider: oauth
                    type: role
                    value: "my-group-id-1"
                permissions:
                  - resource: clusterconfig
                    actions: [ "view" ]

                  - resource: topic
                    value: ".*"
                    actions:
                      - VIEW
                      - MESSAGES_READ
                      - ANALYSIS_VIEW

                  - resource: consumer
                    value: ".*"
                    actions: [ view ]

                  - resource: schema
                    value: ".*"
                    actions: [ view ]

                  - resource: connect
                    value: ".*"
                    actions: [ view ]

                  - resource: acl
                    actions: [ view ]

I've turned debugging on and can see that my user is getting the groups passed in spring, at least in some form

Principal=Name: [[email protected]]
Granted Authorities: [[OIDC_USER, SCOPE_GroupMember.Read.All, SCOPE_User.Read, SCOPE_email, SCOPE_openid, SCOPE_profile]]
User Attributes: [{ ... groups=[my-group-id-1, my-group-id2] ... }

My oauth set up

        type: OAUTH2
        oauth2:
          client:
            azure:
              clientId: "${AZURE_CLIENT_ID}"
              clientSecret: "${AZURE_CLIENT_SECRET}"
              scope:
                - openid
                - profile
                - email
              client-name: azure
              provider: azure
              user-name-attribute: email
              issuer-uri: "..."
              jwk-set-uri: "..."
            custom-params:
              type: oauth
              roles-field: groups

Any ideas on where to go from there?

Thanks
Chris

[fallen-up]

you forgot groups in scope

              scope:
                - openid
                - profile
                - email
                - groups

[landbaychrisburrell]

Hi

Thanks - i've tried that - but if i add 'groups' - i get "Invalid credentials" on the front-end and no error logs in the backend.

As per above though, I could see in the logs the groups field being returned when kafbat is querying Azure, with the original configuration. I believe this is because the 'profile' scope returns groups as a claim.

Cheers
Chris

[fallen-up]

did you try only
scope: openid as in example https://ui.docs.kafbat.io/configuration/authentication/for-the-ui/oauth2#azure?

[landbaychrisburrell]

I've tried this just now - and with scope: openid only - the authentication piece still works (i can see my name at the top) but i still cannot see any clusters.

I can however still see the groups being returned:

Found SecurityContext 'SecurityContextImpl [Authentication=OAuth2AuthenticationToken [Principal=Name: [{REDACTED}], Granted Authorities: [[OIDC_USER, SCOPE_GroupMember.Read.All, SCOPE_User.Read, SCOPE_email, SCOPE_openid, SCOPE_profile]], User Attributes: [{sub={REDACTED}, ver=2.0, aio={REDACTED}{REDACTED}, iss=https://login.microsoftonline.com/{REDACTED}/v2.0, *******groups=[group1, group2]******, uti={REDACTED}, given_name={REDACTED}, nonce={REDACTED}, picture=https://graph.microsoft.com/v1.0/me/photo/$value, tid=98c4f78a-031c-49ac-9eb9-a03f4ebcc33e, aud=[557d47d6-f696-4d6d-be84-30a9eab4717c], nbf=Fri Aug 15 07:46:38 UTC 2025, rh=1.AQkAivfEmBwDrEmeuaA_TrzDPtZHfVWW9m1NvoQwqeq0cXzeANMJAA., name={REDACTED}, exp=2025-08-15T08:51:38Z, family_name={REDACTED}, iat=2025-08-15T07:46:38Z, email={REDACTED}}], Credentials=[PROTETED[], Authenticated=true, Details=null, Granted Authorities=[OIDC_USER, SCOPE_GroupMember.Read.All, SCOPE_User.Read, SCOPE_email, SCOPE_openid, SCOPE_profile]]]' in WebSession: 'org.springframework.web.server.session.InMemoryWebSessionStore$InMemoryWebSession@769bc5ea'

[landbaychrisburrell]

Ok - so totally my fault - there were 2 spaces missing around the custom-params which should be under azure... Sorry about this! Thanks for the help.

[Haarolean]

No worries! Glad it works