can't use group members with OIDC Google

[fatsolko]

I create OIDC authentication with Google and add user in Google to group devops

After adding group member to project I expected user to have access to project docker.


but it doesn't work, I only see the public project

UPD:
log when I set Group Claim Name groups
2024-07-10T07:10:23Z [WARNING] [/pkg/oidc/helper.go:394]: Unable to get groups from claims, claims: map[email:some@py.com email_verified:true family_name:some given_name:some hd:py.com name:some picture:https://lh3.googleusercontent.com/a/ACg8ocKi_Ub65nJIOAbVEu3AUSNWpEC7pHeI=s96-c sub:11286363274952], groups claims key: groups

What am I doing wrong?

[fatsolko]

I think the main problem is not being able to get groups from Google account.
I don't know which scope should work and how to add that scope to the Harbor.

[stonezdj]

You should set the Group Claim Name

Group Claim Name: The name of a custom group claim that you have configured in your OIDC provider, that includes the groups to add to Harbor.

see: https://goharbor.io/docs/edge/administration/configure-authentication/oidc-auth/#configure-an-oidc-provider-in-harbor

[fatsolko]

You should set the Group Claim Name

Group Claim Name: The name of a custom group claim that you have configured in your OIDC provider, that includes the groups to add to Harbor.

see: https://goharbor.io/docs/edge/administration/configure-authentication/oidc-auth/#configure-an-oidc-provider-in-harbor

yes, but google does not provide group scope info
for example: there is log when I set Group Claim Name groups
2024-07-10T07:10:23Z [WARNING] [/pkg/oidc/helper.go:394]: Unable to get groups from claims, claims: map[email:some@py.com email_verified:true family_name:some given_name:some hd:py.com name:some picture:https://lh3.googleusercontent.com/a/ACg8ocKi_Ub65nJIOAbVEu3AUSNWpEC7pHeI=s96-c sub:11286363274952], groups claims key: groups