<p>Posting this question on behalf of a customer:</p>

<p>We are trying to integrate Kubernetes OIDC authentication with Azure AD.
According to the documentation in order to use User groups we need to pass the following option to the Kubernetes API service:
<code>--oidc-groups-claim user_roles</code>
Api service uses <code>user_roles</code> to look up the group names of the groups the user is a member of in the JWT returned by Azure AD.</p>

<p>However, when we decode the JWT returned by Azure AD, we can't find any field called <code>user_roles</code> in the returned JWT. The decoded JWT looks like this (redacted):  </p>

<pre><code>{  
  "aud": "spn:XXX",  
  "iss": "https://sts.windows.net/XXX/ ",  
  "iat": XXX,  
  "nbf": XXX,  
  "exp": XXX,  
  "acr": "1",  
  "aio": "XXX",  
  "amr": [  
    "pwd",  
    "mfa"  
  ],  
  "appid": "XXX",  
  "appidacr": "0",  
  "family_name": "Foo",  
  "given_name": "Bar",  
  "groups": [  
    "gid1",  
    "gid2"  
  ],  
  "ipaddr": "XXX",  
  "name": "Foo Bar",  
  "oid": "XXX",  
  "onprem_sid": "XXX",  
  "scp": "user_impersonation",  
  "sub": "XXX",  
  "tid": "XXX",  
  "unique_name": "XXX",  
  "upn": "XXX",  
  "uti": "XXX",  
  "ver": "1.0"  
}   
</code></pre>

<p>As you can see there is no user_role field present in the returned JWT. Is there anything we are missing ie. should we enable some settings in the Azure AD that will get the Azure return user_role populated with the group names the user is a member of?
JWT we are hoping to get should look something like this (please note the user_role field):  </p>

<p><a href="https://github.com/kubernetes/kubernetes/issues/33290#issue-178672086" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/33290#issue-178672086</a> </p>

<pre><code>{  
  "iss": "XXX",  
  "aud": "XXX",  
  "exp": XXX,  
  "jti": "XXX",  
  "iat": XXX,  
  "nbf": XXX,  
  "sub": "mmosley",  
  "user_role": [  
    "admin",  
    "users",  
    "approvers"  
  ],  
  "email": "XXX"  
}   
</code></pre>

<p>Any help or pointers would be greatly appreciated.</p>

<p>First,as I known, AAD <code>id_token</code> only supports <code>role</code> claim, NOT <code>user_role</code>. It can be added into <code>id_token</code> by adding <code>appRoles</code> property of the AAD application manifest.
And bit in theconfig is needed to match the audience from tokens retrieved by the Azure AAD. </p>

<p>Second,<code>--oidc-groups-claim</code> should not use <code>user_role</code> claim. According to my understanding, it should be <code>groups</code> which match the <code>groups</code> claim in <code>id_token</code>.</p>

<p>Also, you can refer to <a href="https://pepperprovesapoint.com/2018/01/03/integrating-kubernetes-rbac-with-azure-ad/" rel="nofollow noreferrer"><strong>this blog</strong></a> and <a href="https://github.com/colemickens/azure-ad-k8s-oidc-example" rel="nofollow noreferrer"><strong>this sample</strong></a> to Integrate Kubernetes RBAC with Azure AD.</p>

<p>See more details about RBAC authentication for Kubernetes in <a href="https://kubernetes.io/docs/admin/authorization/#rbac-mode" rel="nofollow noreferrer">this document.</a></p>
