RBAC doesnt work correct for oauth2 internal gitlab (helm_chart)

[balobin]

Issue submitter TODO list

• I've looked up my issue in FAQ
• I've searched for an already existing issues here
• I've tried running master-labeled docker image and the issue still persists there
• I'm running a supported version of the application which is listed here

Describe the bug (actual behavior)

Can you help me pls with configuration RBAC for internal gitlab provider? I cant see any cluster for Kafka-ui when RBAC configured, but when i turn off rbac config my clusters is showed. I'm trying to set up a configuration file so that only users who are in a specific group in gitlab have access to the clusters. Configuration file:

auth:
  oauth2:
    client:
      oauth:
        authorization-grant-type: authorization_code
        authorization-uri: https://gitlab.xxx.xx/oauth/authorize
        clientId: xxx
        clientSecret: yyy
        custom-params:
          type: oauth
          roles-field: group 
        issuer-uri: https://gitlab.xxx.xx
        user-name-attribute: name
        provider: oauth
        redirect-uri: https://xxx/login/oauth2/code/gitlab
        scope: openid
        token-uri: https://gitlab.xxx.xx/oauth/token
rbac:
  roles:
    - name: "readonly"
      clusters:
        - dev
      subjects:
        - provider: oauth
          type: group  
          value: "my_group_in_gitlab"
      permissions:
        - resource: clusterconfig
          value: ".*"
          actions: [ "view" ]
        - resource: topic
          value: ".*"
          actions: 
            - VIEW
            - MESSAGES_READ
       ......

Expected behavior

No response

Your installation details

0.7.1 Helm chart

Steps to reproduce

Set up conf file like higher

Screenshots

Logs

o.s.s.w.s.c.WebSessionServerSecurityContextRepository: Saved SecurityContext 'SecurityContextImpl [Authentication=OAuth2AuthenticationToken [Principal=RbacOidcUser[user=Name: [xxx.com], Granted Authorities: [[OIDC_USER, SCOPE_openid]], User Attributes: [{sub=17245, groups_direct=[xxx] groups=[]], Credentials=[PROTECTED], Authenticated=true, Details=null, Granted Authorities=[OIDC_USER, SCOPE_openid]]]' in WebSession: 'org.springframework.web.server.session.InMemoryWebSessionStore$InMemoryWebSession@732cf34f'

Additional context

No response

[github-actions[bot]]

Hello there balobin! 👋

Thank you and congratulations 🎉 for opening your very first issue in this project! 💖

In case you want to claim this issue, please comment down below! We will try to get back to you as soon as we can. 👀

[Haarolean]

Most likely, this value is invalid: roles-field: group . You have to figure it out yourself as I don't know the field name gitlab puts roles into.
You can enable granular logging by adding this setting: logging.level.com.provectus.kafka.ui.service.rbac.extractor: TRACE. Also, try asking folks in our discord, some might've used gitlab.

[S0n98]

I have tested the below config with private our gitlab and it worked

auth:
  oauth2:
    client:
      oauth:
        custom-params:
          type: oauth
          roles-field: email
          ......
rbac:
   roles:
     - subjects:
        -  provider: oauth
           type: role
           value: "abc@mail"
        -  provider: oauth
           type: role
           value: "xyz@mail"
           ......

[imrein]

Did anyone find an actual fix for this? Having the exact same issue here. The email is not really what I'm looking for, there should be a way to use gitlab groups?

[Haarolean]

You have to specify provider as oauth and type as role, and set roles-field to the field name which represents roles in your oauth token.

Please note that this repo is not maintained (#4255), and the project lives here now: https://github.com/kafbat/kafka-ui