expression policy: Get user object(s) from group object

[cheggerdev]

Describe your question/
In an expression policy I can get group objects from a user object: groups = user.ak_groups.all()
How can I do the reverse? How can I get user objects that are a member of a group?

• authentik version: 2025.2.1
• Deployment: docker-compose

[rissson]

group.users.all(), or Group.objects.get(name="my group").users.all()

[cheggerdev]

Thank you.

Would you mind to document this at https://docs.goauthentik.io/docs/users-sources/groups/group_ref ?

[cheggerdev]

I just tried Group.object.get(name="my group").users.all() and I got this error in the expression policy:

builtins.NameError: name 'Group' is not defined

Is there an import needed?

[rissson]

ah yeah, you might need to from authentik.core.models import Group

Would you mind to document this at docs.goauthentik.io/docs/users-sources/groups/group_ref ?

Feel free to open a PR :D