Role bindings not working for groups

[atorrescogollo]

I am using Gangway+Dex+ActiveDirectory for authentication. I am able to use role bindings for users but not for groups.

Config:

• /etc/kubernetes/manifests/kube-apiserver.yaml:

...
    - --oidc-issuer-url=https://auth.k8s1.domain.es/
    - --oidc-ca-file=/usr/local/share/ca-certificates/oidc-ca.crt
    - --oidc-client-id=oidc-auth-client
    - --oidc-username-claim=name
    - '--oidc-username-prefix=AD:'
    - --oidc-groups-claim=name
    - '--oidc-groups-prefix=AD:'
    image: k8s.gcr.io/kube-apiserver:v1.19.0
...

• kubectl -n auth-system get cm dex -o yaml:

apiVersion: v1
data:
  config.yaml: |
    issuer: https://auth.k8s1.domain.es/
    ...
    staticClients:
    - id: oidc-auth-client
      redirectURIs:
      - 'https://kubectl.k8s1.domain.es/callback'
      name: 'oidc-auth-client'
      secret: 5ef...
    connectors:
    - type: ldap
      id: ldap
      name: LDAP
      config:
        host: "dc01.domain.es:636"
        use_tls: True
        insecureNoSSL: False
        insecureSkipVerify: False
        rootCA: /etc/dex/cfg/connector_ldap_ca.crt
        bindDN: "cn=Administrator,cn=Users,dc=ad,dc=domain,dc=es"
        bindPW: "password"
        userSearch:
          baseDN: "DC=ad,DC=domain,DC=es"
          filter: "(objectClass=user)"
          username: sAMAccountName
          idAttr: DN
          emailAttr: mail
          nameAttr: sAMAccountName
        groupSearch:
          baseDN: "DC=ad,DC=domain,DC=es"
          filter: "(objectClass=group)"
          userAttr: DN
          groupAttr: member
          nameAttr: name

• In Active Directory, I have one user (admin1) in group (admins-k8s1):

# First Admin, Users, ad.domain.es
dn: CN=First Admin,CN=Users,DC=ad,DC=domain,DC=es
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: First Admin
sn: Admin
givenName: First
displayName: First Admin
name: First Admin
sAMAccountName: admin1
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=ad,DC=domain,DC=es
memberOf: CN=admins-k8s1,OU=kubernetes,DC=ad,DC=domain,DC=es
distinguishedName: CN=First Admin,CN=Users,DC=ad,DC=domain,DC=es

• When I login with this user, I receive the following JWT:

{
  "iss": "https://auth.k8s1.domain.es/",
  "sub": "Ci5D...",
  "aud": "oidc-auth-client",
  "exp": 1614810594,
  "iat": 1614724194,
  "at_hash": "uFKL...",
  "email": "admin1@domain.es",
  "email_verified": true,
  "groups": [
    "admins-k8s1"
  ],
  "name": "admin1"
}

Behaviour

Now, I create the following ClusterRoleBinding so I can get nodes with admin1 user:

# kubectl get clusterrolebindings admin1-admin -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin1-admin
...
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: AD:admin1

On the other hand, if I edit the manifest like i attach below, I cannot get nodes:

# kubectl get clusterrolebindings admin1-admin -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin1-admin
...
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: AD:admins-k8s1

[nabokihms]

Hello! I assume that you need to change kube-apiserver flag --oidc-groups-claim=name to --oidc-groups-claim=groups to make it works.

[atorrescogollo]

Oh! It's true. Thank you so much!