[SOLVED] Possible to auto sync groups from OIDC on login; specifically remove groups from a user?

N

NextPancake401

Member
Dec 17, 2021
26
2
23
Ohio
I set up OIDC and it works great but I'm having a groups removal issue. If a user is in the 'info-tech' group in our IdP and they log into PVE, they're assigned to that group in Proxmox but if I were to remove that same user from the 'info-tech' group on the IdP side, they continue to have 'info-tech' group in Proxmox.

This is dangerous especially if we need to remove someone's access if they're being terminated.

We have LDAP configured so we can always just fallback on that and only use that but I'd prefer to keep everything consistent if possible for our staff.
 
Nevermind, I figured it out.

To anyone who is running into this problem, check the 'Override Groups' box. This allows removal from groups assigned previously in PVE.
 
Great!
You may tag this thread "Solved" by editing the first post and selecting the corresponding prefix for the title.
 
You must log in or register to reply here.
Top Bottom
Back