oidc groups: expose Groups through the gRPC API

The Groups column is already persisted on users.User (migration
202505141323) and populated from claims.Groups in FromClaim. This
makes the value visible through the gRPC/REST surface so external
tools (notably Headplane, which is the motivation for storing the
claim in the first place) can read group membership without
poking at the database.

- proto/headscale/v1/user.proto: add `repeated string groups = 9;`
  with a doc comment describing where the value comes from.
- gen/go/headscale/v1/user.pb.go,
  gen/openapiv2/headscale/v1/headscale.swagger.json: regenerated
  via `buf generate --template ../buf.gen.yaml -o .. ../proto`.
- hscontrol/types/users.go: populate v1.User.Groups in Proto() by
  decoding the JSON-encoded users.groups column via GetGroups().
- integration/oidc_groups_test.go: drop the sqlite3-via-Execute hack
  and verify groups through headscale.ListUsers() like every other
  user-state integration test.
This commit is contained in:
Ryan Malloy 2026-05-21 21:29:54 -06:00
parent 32ea1c1c84
commit 9ca200b6bc
5 changed files with 57 additions and 56 deletions

View file

@ -1,11 +1,10 @@
package integration
import (
"encoding/json"
"sort"
"strings"
"testing"
v1 "github.com/juanfont/headscale/gen/go/headscale/v1"
"github.com/juanfont/headscale/integration/hsic"
"github.com/oauth2-proxy/mockoidc"
"github.com/stretchr/testify/assert"
@ -13,30 +12,27 @@ import (
)
// TestOIDCGroupsPersisted verifies that the `groups` claim from an OIDC
// provider is persisted into the users.groups column after the user logs in.
// provider is persisted on the user and exposed through the gRPC API.
//
// The implementation under test:
// - User.Groups column (TEXT, JSON-encoded []string) added by migration
// 202505141323 in hscontrol/db/db.go.
// - User.SetGroups / User.GetGroups in hscontrol/types/users.go.
// - FromClaim() calls SetGroups(claims.Groups) so login populates the column.
// - OIDCClaims.Groups is FlexibleStringSlice so providers like JumpCloud
// that return a single string instead of a one-element array also work.
//
// Verification is done by reading the SQLite database inside the headscale
// container directly, because the gRPC User message does not currently
// expose Groups. Adding groups to the gRPC API is a separate, larger change.
// Implementation under test:
// - users.groups TEXT column added by migration 202505141323.
// - hscontrol/types.User.SetGroups / GetGroups round-trip via JSON.
// - FromClaim calls SetGroups(claims.Groups) so login populates the
// column. OIDCClaims.Groups is FlexibleStringSlice, so providers like
// JumpCloud that return a single string instead of an array also work.
// - v1.User.Groups (proto field 9) is populated by User.Proto() so
// external tools (Headplane) can read group membership over gRPC.
func TestOIDCGroupsPersisted(t *testing.T) {
IntegrationSkip(t)
// mockoidc serves logins in strict queue order, so keep NodesPerUser=1.
// mockoidc serves logins from a strict queue, so keep NodesPerUser=1.
spec := ScenarioSpec{
NodesPerUser: 1,
Users: []string{"admin", "dev", "solo"},
OIDCUsers: []mockoidc.MockUser{
oidcMockUserWithGroups("admin", true, []string{"admins", "engineering"}),
oidcMockUserWithGroups("dev", true, []string{"engineering"}),
// User with empty groups — must round-trip as no Groups stored.
// User with empty groups — round-trips as no Groups.
oidcMockUserWithGroups("solo", true, nil),
},
}
@ -50,7 +46,7 @@ func TestOIDCGroupsPersisted(t *testing.T) {
"HEADSCALE_OIDC_CLIENT_ID": scenario.mockOIDC.ClientID(),
"CREDENTIALS_DIRECTORY_TEST": "/tmp",
"HEADSCALE_OIDC_CLIENT_SECRET_PATH": "${CREDENTIALS_DIRECTORY_TEST}/hs_client_oidc_secret",
// Make sure the OIDC scope set includes "groups" so the IdP emits the claim.
// Make sure the OIDC scope set includes "groups" so mockoidc emits the claim.
"HEADSCALE_OIDC_SCOPE": "openid,profile,email,groups",
}
@ -71,17 +67,10 @@ func TestOIDCGroupsPersisted(t *testing.T) {
headscale, err := scenario.Headscale()
require.NoError(t, err)
// Query the SQLite database inside the headscale container for the groups
// column. CLI/gRPC do not expose it yet; this is the authoritative store.
const dbPath = "/tmp/integration_test_db.sqlite3"
out, err := headscale.Execute([]string{
"sqlite3", dbPath,
"-cmd", ".mode tabs",
"SELECT name, COALESCE(groups, '') FROM users WHERE provider = 'oidc' ORDER BY name;",
})
require.NoError(t, err, "querying users.groups from sqlite")
users, err := headscale.ListUsers()
require.NoError(t, err)
got := parseGroupsRows(t, out)
got := groupsByOIDCUserName(users)
want := map[string][]string{
"admin": {"admins", "engineering"},
@ -91,40 +80,28 @@ func TestOIDCGroupsPersisted(t *testing.T) {
for name, wantGroups := range want {
gotGroups, ok := got[name]
assert.True(t, ok, "user %q not present in users table", name)
assert.ElementsMatch(t, wantGroups, gotGroups,
"groups mismatch for user %q (raw rows: %q)", name, out)
assert.True(t, ok, "OIDC user %q not present in ListUsers response", name)
assert.ElementsMatch(t, wantGroups, gotGroups, "groups mismatch for user %q", name)
}
}
// parseGroupsRows parses the tab-separated output of:
//
// SELECT name, COALESCE(groups, '') FROM users ...
//
// Returns a map of username -> decoded groups slice. An empty groups column
// (stored as "" by SetGroups when the input slice is empty) decodes to nil.
func parseGroupsRows(t *testing.T, raw string) map[string][]string {
t.Helper()
rows := map[string][]string{}
for _, line := range strings.Split(strings.TrimSpace(raw), "\n") {
if line == "" {
// groupsByOIDCUserName picks out OIDC users from a ListUsers response and
// returns a map of username -> sorted groups. CLI-created users (no provider)
// are filtered out so the assertions don't need to know about them.
func groupsByOIDCUserName(users []*v1.User) map[string][]string {
out := map[string][]string{}
for _, u := range users {
if u.GetProvider() != "oidc" {
continue
}
parts := strings.SplitN(line, "\t", 2)
require.Len(t, parts, 2, "unexpected sqlite row format: %q", line)
name, groupsJSON := parts[0], parts[1]
if groupsJSON == "" {
rows[name] = nil
continue
g := append([]string(nil), u.GetGroups()...)
sort.Strings(g)
if len(g) == 0 {
g = nil
}
var gs []string
require.NoError(t, json.Unmarshal([]byte(groupsJSON), &gs),
"groups column for %q is not valid JSON: %q", name, groupsJSON)
sort.Strings(gs)
rows[name] = gs
out[u.GetName()] = g
}
return rows
return out
}
// oidcMockUserWithGroups extends [oidcMockUser] with a Groups claim.