Skip to content

bug: (coder OSS) CODER_OIDC_ALLOWED_GROUPS not working as expected if IDP returns ldap groups containing commas #21878

@mardonner

Description

@mardonner

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

Hi,
when trying to restrict the oidc groups with CODER_OIDC_ALLOWED_GROUPS, I'm facing unexpected results. Even though I configured all parameters to make this happen, I always get the error that I'm not in an allowed group.
My IDP returns its groups in ldap format (for example cn=abc,ou=xyz,ou=123,o=def). This whole string is one singular group.

When setting the value like this in the helm chart, this will get parsed into 4 separate groups. So far, no variation of quoting/formatting I've tried results in this being treated as a singular group. Is there a way to make coder take this value literally or prevent it from splitting on commas?

Any advice? I don't see this issue with grafana or argocd.

ref.: #21308

Relevant Log Output

Expected Behavior

Treat strings that contain commas as singular group. Maybe via special quoting.
cn=abc,ou=xyz,ou=123,o=def should be one group, not 4.

Steps to Reproduce

Have the group string contain commas.

- name: CODER_OIDC_ALLOWED_GROUPS
  value: "cn=abc,ou=xyz,ou=123,o=def"
# or ["cn=abc,ou=xyz,ou=123,o=def"]
# or ['cn=abc,ou=xyz,ou=123,o=def']
# or 'cn=abc,ou=xyz,ou=123,o=def'
# or "'cn=abc,ou=xyz,ou=123,o=def'"
# or '"cn=abc,ou=xyz,ou=123,o=def"'

Environment

Helm Chart 2.29.1

Additional Context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    s2Broken use cases or features (with a workaround). Only humans may set this.

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions