<p>I have been trying to authenticate OIDC using DEX for LDAP. I have succeeded in authenticating but the problem is, LDAP search is not returning the groups. Following are my DEX configs and LDAP Data. Please help me out</p>

<p>Screenshot: Login successful, groups are empty</p>

<p><a href="https://i.stack.imgur.com/YbUwj.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/YbUwj.png" alt="enter image description here"></a></p>

<p><strong>My Dex Config</strong></p>

<pre><code># User search maps a username and password entered by a user to a LDAP entry.
userSearch:
# BaseDN to start the search from. It will translate to the query
# "(&amp;(objectClass=person)(uid=&lt;username&gt;))".
baseDN: ou=People,dc=ec2-54-185-211-121,dc=us-west-2,dc=compute,dc=amazonaws,dc=com
# Optional filter to apply when searching the directory.
#filter: "(objectClass=posixAccount)"
# username attribute used for comparing user entries. This will be translated
# and combine with the other filter as "(&lt;attr&gt;=&lt;username&gt;)".
username: mail
# The following three fields are direct mappings of attributes on the user entry.
# String representation of the user.
idAttr: uid
# Required. Attribute to map to Email.
emailAttr: mail
# Maps to display name of users. No default value.
nameAttr: uid

# Group search queries for groups given a user entry.
groupSearch:
# BaseDN to start the search from. It will translate to the query
# "(&amp;(objectClass=group)(member=&lt;user uid&gt;))".
baseDN: dc=ec2-54-185-211-121,dc=us-west-2,dc=compute,dc=amazonaws,dc=com
# Optional filter to apply when searching the directory.
#filter: "(objectClass=posixGroup)"
# Following two fields are used to match a user to a group. It adds an additional
# requirement to the filter that an attribute in the group must match the user's
# attribute value.
userAttr: uid
groupAttr: memberUid
# Represents group name.
nameAttr: cn
</code></pre>

<p><strong>My LDAP Data</strong></p>

<blockquote>
  <p>dn:
  ou=People,dc=ec2-54-185-211-121,dc=us-west-2,dc=compute,dc=amazonaws,dc=com
  ou: People objectClass: organizationalUnit</p>
  
  <p>dn:
  uid=johndoe,ou=People,dc=ec2-54-185-211-121,dc=us-west-2,dc=compute,dc=amazonaws,dc=com
  gecos: John Doe uid: johndoe loginShell: / bin / bash mail:
  john.doe@example.org homeDirectory: / home / jdoe cn: John Doe sn: Doe
  uidNumber: 10002 objectClass: posixAccount objectClass: inetOrgPerson
  objectClass: top userPassword: bar gidNumber: 10002</p>
  
  <p>dn:
  uid=janedoe,ou=People,dc=ec2-54-185-211-121,dc=us-west-2,dc=compute,dc=amazonaws,dc=com
  gecos: Jane Doe uid: janedoe loginShell: / bin / bash mail:
  jane.doe@example.org homeDirectory: / home / jdoe cn: Jane Doe sn: Doe
  uidNumber: 10001 objectClass: posixAccount objectClass: inetOrgPerson
  objectClass: top userPassword: foo gidNumber: 10001</p>
  
  <p>dn:
  ou=Groups,dc=ec2-54-185-211-121,dc=us-west-2,dc=compute,dc=amazonaws,dc=com
  ou: Groups objectClass: organizationalUnit</p>
  
  <p>dn:
  cn=admins,ou=Groups,dc=ec2-54-185-211-121,dc=us-west-2,dc=compute,dc=amazonaws,dc=com
  cn: admins objectClass: posixGroup objectClass: top gidNumber: 20001
  memberUid: janedoe memberUid: johndoe</p>
  
  <p>dn:
  cn=developers,ou=Groups,dc=ec2-54-185-211-121,dc=us-west-2,dc=compute,dc=amazonaws,dc=com
  cn: developers objectClass: posixGroup objectClass: top gidNumber:
  20002 memberUid: janedoe</p>
</blockquote>

<p>Sorry for a late replay but I didnt know the answer until now :)</p>

<p>I had the same problem, in my setup I used <code>dex (quay.io/dexidp/dex:v2.16.0)</code> to use MS AD. I used <strong>kubernetes 1.13</strong> in my tests.</p>

<p>To generate kubeconfig i used <code>heptiolabs/gangway (gcr.io/heptio-images/gangway:v3.0.0)</code> and for handle dashboard login i used <code>pusher/oauth2_proxy (quay.io/pusher/oauth2_proxy)</code>.</p>

<p>I spent a lot of time trying different ldap setups in dex but didnt get the AD groups to show up in dex log or get them to work in kubernetes, and every example I read was using only users.</p>

<p>The problem and solution for me was not in the dex config, dex will request groups from ldap if you tell dex to do so.
Its all in the clients. OIDC have a "concept" of scopes and I guess that most (all?) oidc clients implement it, at least both gangway and oauth2-proxy does.
So the solution for me was to configure the client (gangway and oauth2-proxy in my case) so that they also ask dex for groups.</p>

<p>In gangway I used the following config (including the comments)</p>

<pre><code># Used to specify the scope of the requested Oauth authorization.
# scopes: ["openid", "profile", "email", "offline_access"]
scopes: ["openid", "profile", "email", "offline_access", "groups"]
</code></pre>

<p>For oauth2-proxy I added this to the args deployment</p>

<pre><code>- args:
        - --scope=openid profile email groups
</code></pre>

<p>And then I could use groups instead of users in my rolebindings, dont forget to also configure the api-server to use dex for its oidc.</p>

<p>Hope that helps</p>

<p>-Robert</p>
