privacyidea/keycloak-provider

Subgroups in Included groups.

jkovaliov opened this issue · 3 comments

jkovaliov commented

Hello, is it possible for subgroups users to be included in 2FA by entering only the master group into the “Included groups” field? Or it is required to name all of them altogether groups and every subgroup in that field?

lukasmatusiewicz commented

Hi @jkovaliov, as I see subgroups are since KC18. 'Included groups' was made with KC17. I'll check it and let you know soon. Have you already tried to do it without success?

jkovaliov commented

You're right, I have no luck with this. For example, I have a group Sales and subgroups Europe and North America like in this manual https://wjw465150.gitbooks.io/keycloak-documentation/content/server_admin/topics/groups.html
Every group has its own members.
I am just curious if it is possible just to add the Sales group to the “Included groups” field or if I need to enter Sales, Europe, and North America.

lukasmatusiewicz commented

So I have tested it. Every child group inherits from "included groups" in this situation and will be joined to included automatically. You don't have to add every subgroup to the list. Btw. good lifehack:)