LDAP Query To JumpCloud Not Doing Group Searches

[tjmoyes]

Hello!

I am trying to authenticate a Kubernetes user with JumpCloud LDAP credentials through Dex. The user can authenticate no problem but the group search never runs. I have added the OIDC sections to the kube-apiserver manifest as such:

    - --oidc-issuer-url=https://dex.k8s-demo.cengn.ca
    - --oidc-client-id=gangway
    - --oidc-ca-file=/etc/ssl/certs/ca-bundle.crt
    - --oidc-username-claim=email
    - --oidc-groups-claim=groups

And have set up the ConfigMap for Dex

connectors:
    - id: ldap
      type: ldap
      name: JumpCloud
      config:
        host: ldap.jumpcloud.com:636
        bindDN: uid={redacted},ou=Users,o={redacted},dc=jumpcloud,dc=com
        bindPW: {redacted}
        userSearch:
          baseDN: ou=Users,o={redacted},dc=jumpcloud,dc=com
          filter: "(objectClass=inetOrgPerson)"
          username: uid
          idAttr: uid
          emailAttr: mail
          nameAttr: cn

        groupSearch:
          baseDN: ou=Users,o={redacted},dc=jumpcloud,dc=com
          filter: "(objectClass=groupOfNames)"
          userMatchers:
          - userAttr: DN
            groupAttr: member
          nameAttr: cn

However, the logs for the Dex container do not show even attempting to search for groups, and neither does the provided JWT. I am not sure what I am missing here.

The pod is the most recent version of Dex.

[nabokihms]

I assume that you forgot to add groups to the gangway scopes configuration. See the scopes option here. You can find more about scopes supported by dex here.

[tjmoyes]

That was it! Thank you so much!