<p>I am using keycloak to authenticate with kubernetes using kube-oidc-proxy and oidc-login.</p>
<p>I have created a client in keycloak and a mapper with the following configuration.
<a href="https://i.stack.imgur.com/QwQOW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QwQOW.png" alt="enter image description here" /></a></p>
<p>The kube-oidc-proxy is running with this configuration:</p>
<pre class="lang-yaml prettyprint-override"><code>command: [&quot;kube-oidc-proxy&quot;]
args:
  - &quot;--secure-port=443&quot;
  - &quot;--tls-cert-file=/etc/oidc/tls/crt.pem&quot;
  - &quot;--tls-private-key-file=/etc/oidc/tls/key.pem&quot;
  - &quot;--oidc-client-id=$(OIDC_CLIENT_ID)&quot;
  - &quot;--oidc-issuer-url=$(OIDC_ISSUER_URL)&quot;
  - &quot;--oidc-username-claim=$(OIDC_USERNAME_CLAIM)&quot;
  - &quot;--oidc-signing-algs=$(OIDC_SIGNING_ALGS)&quot;
  - &quot;--oidc-username-prefix='oidcuser:'&quot;
  - &quot;--oidc-groups-claim=groups&quot;
  - &quot;--oidc-groups-prefix='oidcgroup:'&quot;
  - &quot;--v=10&quot;
</code></pre>
<p>And the kube config has this configuration:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
clusters:
- cluster:
    server: &lt;KUBE_OIDC_PROXY_URL&gt;
  name: default
contexts:
- context:
    cluster: default
    namespace: default
    user: oidc
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: oidc
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
      - oidc-login
      - get-token
      - -v10
      - --oidc-issuer-url=&lt;ISSUER_URL&gt;
      - --oidc-client-id=kube-oidc-proxy
      - --oidc-client-secret=&lt;CLIENT_SECRET&gt;
      - --oidc-extra-scope=email
      - --grant-type=authcode
      command: kubectl
      env: null
      provideClusterInfo: false

</code></pre>
<p>I can successfully get the user info with groups in the jwt token as shown below:</p>
<pre class="lang-json prettyprint-override"><code> &quot;name&quot;: &quot;Test Uset&quot;,
  &quot;groups&quot;: [
    &quot;KubernetesAdmins&quot;
  ],
  &quot;preferred_username&quot;: &quot;test-user&quot;,
  &quot;given_name&quot;: &quot;Test&quot;,
  &quot;family_name&quot;: &quot;Uset&quot;,
  &quot;email&quot;: &quot;testuser@test.com&quot;
</code></pre>
<p>And i have created the following cluster role binding:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: oidc-admin-group
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: oidcgroup:KubernetesAdmins
</code></pre>
<p>But I still get forbidden error as follows:</p>
<pre><code>Error from server (Forbidden): pods is forbidden: User &quot;'oidcuser:'ecc4d1ac-68d7-4158-8a58-40b469776c07&quot; cannot list resource &quot;pods&quot; in API group &quot;&quot; in the namespace &quot;default&quot;

</code></pre>
<p>Any ideas on how to solve this issue ??</p>
<p>Thanks in advance,,</p>

N05h3ll
<p>I figured it out.
Removing the single quotes from the user and group prefix to be like:</p>
<pre class="lang-yaml prettyprint-override"><code>&quot;--oidc-username-prefix=oidcuser:&quot;
--oidc-groups-prefix=oidcgroup:&quot;
</code></pre>
<p>This solved the issue.</p>
