Param missing from attributes when login with oauth2

[marcosschroh]

I am having a problem with oauth2. After the configuration I can properly login, the rbac works as expected only with type: user on subjects but does not with type: role. I can see in the logs these lines:

DEBUG [reactor-http-epoll-1] i.k.u.s.r.e.OauthAuthorityExtractor: Param missing from attributes, skipping
DEBUG [reactor-http-epoll-1] i.k.u.s.r.e.OauthAuthorityExtractor: Token's groups: []
DEBUG [reactor-http-epoll-1] i.k.u.s.r.e.OauthAuthorityExtractor: Matched roles: []

I think the config is correct:

auth:
  type: OAUTH2
  oauth2:
    client:
      my-oauth:
        provider: my-oauth
        clientId: ...
        clientSecret: ...
        client-name: "my-oauth" # will be displayed on the login page
        redirect-uri: https://...
        authorization-grant-type: authorization_code
        issuer-uri: https://d...
        scope: ["openid", "groups", "userinfo"]
        custom-params:
          type: oauth
          roles-field: groups # required for RBAC, a field name in OAuth token which will contain user's roles/groups

Any ideas? Does Param missing from attributes, skipping mean that groups were not found in the response from the oauth2 provider? Thanks

[Haarolean]

Hi, yes, exactly that, "groups" field couldn't be found in your user's token.
I also recommend updating the latest (main-tagged image) version, which contains some improvements on this topic.

[marcosschroh]

Thanks for the answer @Haarolean. If the response from the oauth2 provider has the following structure: [{"name": "group_1"}, {...}...], is there a way to convert it to a flat list ["group_1", ...] using custom-params?

[Haarolean]

nope, this has to a single field.

[woile]

Would it be possible to add a syntax similar to jq? like roles-field: groups[].name?

[Haarolean]

We believe it's the responsibility of the auth provider to do this.