RBAC with okta - Roles/groups not getting mapped

[ragavse]

I like to implement RBAC with okta but got below error, can someone kindly help me with this ? the app loads fine if I do not use RBAC configurations.

When I preview the token with okta admin, I see claims are added only to the id_token and not in access token. could this be a reason ?

LOGS:
[30m2024-07-22 20:07:23,417�[0;39m �[39mDEBUG�[0;39m [�[34mreactor-http-epoll-3�[0;39m] �[33mi.k.u.s.r.e.OauthAuthorityExtractor�[0;39m: Param missing from attributes, skipping

yaml Configurations:

yamlApplicationConfig:
  kafka:
    clusters:
      - name: <<ClusterName>
        bootstrapServers: <<Broker url>>
        properties:
          security.protocol: SASL_SSL
          sasl.mechanism: AWS_MSK_IAM
          sasl.client.callback.handler.class: software.amazon.msk.auth.iam.IAMClientCallbackHandler
          sasl.jaas.config: software.amazon.msk.auth.iam.IAMLoginModule required;
  auth:
    type: OAUTH2
    oauth2:
      client:
        okta:
          clientId:
          clientSecret:
          scope: [ 'openid', 'profile', 'email', 'groups' ]
          client-name: Okta
          provider: okta
          redirect-uri: http://<< internal >>/login/oauth2/code/okta
          authorization-grant-type: authorization_code
          issuer-uri: https://<< internal >>.oktapreview.com
          jwk-set-uri: https://<< internal >>.oktapreview.com/oauth2/v1/keys?client_id=<< Client id >>
          user-name-attribute: email
          custom-params:
            type: oauth
            roles-field: groups
  rbac:
    roles:
      - name: "Editors"
        clusters:
          - <<ClusterName>
        subjects:
          - provider: oauth
            type: role
            value: "Editors"
        permissions:
          - resource: topic
            value: ".*"
            actions:
              - VIEW
              - MESSAGES_READ
              - EDIT
              - CREATE
              - EDIT
              - MESSAGES_PRODUCE

Result:

Okta Groups claim:

Originally posted by @ragavse in #491

[github-actions[bot]]

Hi ragavse! 👋

Welcome, and thank you for opening your first issue in the repo!

Please wait for triaging by our maintainers.

As development is carried out in our spare time, you can support us by sponsoring our activities or even funding the development of specific issues.
Sponsorship link

If you plan to raise a PR for this issue, please take a look at our contributing guide.

[Haarolean]

"Param missing from attributes" means that the param (roles-field: groups) is not present in your auth token so we can't extract the groups.

[ragavse]

Thanks for getting back to me on this @Haarolean , Is there any configuration options to use id token to read the groups claim instead of expecting it from access token ? (assuming the authorization code flow will include both id and access tokens )

[Haarolean]

@ragavse there are multiple user cases with okta working fine with our RBAC, I suggest searching "okta" up in our discord (the invite link is available in readme)
also:
https://github.com/kafbat/ui-config-examples/tree/main/rbac-keycloak
https://discord.com/channels/897805035122077716/897805035122077719/1108370796960825355