[GH-ISSUE #1302] Autocreate and assign Groups from IDP #2179

New Issue

Originally created by @NiclasPe on GitHub (Nov 10, 2023).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/1302

Describe the problem
I wanna assign netbird users the same groups they have in authentik, so that i can manage them central. But when i tryed it, it didn´t work. It´s an fresh installed netbird on an vps with public IP and an authentik behind traefik. But it should configured right, because other OpenID/OAuth2 Apps work perfectly.

To Reproduce
Steps to reproduce the behavior:

Install Netbird with authentik like described here
After Installation you should be able to Login successful.
Now go to Settings -> Groups
Enable: user group propagation & JWT group sync
As JWT claim chose "groups" and save.
I also added groups as "scope" unter: "NETBIRD_AUTH_SUPPORTED_SCOPES" in setup.env

Expected behavior
I expected that when a new user logs in, his Authentik Groups will be created and assigned in Netbird.

Screenshots

Additional context
Iam using Authentik with LDAP Backand and other OPENID Applications can get the groups with the groups scope.

Originally created by @NiclasPe on GitHub (Nov 10, 2023). Original GitHub issue: https://github.com/netbirdio/netbird/issues/1302 **Describe the problem** I wanna assign netbird users the same groups they have in authentik, so that i can manage them central. But when i tryed it, it didn´t work. It´s an fresh installed netbird on an vps with public IP and an authentik behind traefik. But it should configured right, because other OpenID/OAuth2 Apps work perfectly. **To Reproduce** Steps to reproduce the behavior: 1. Install Netbird with authentik like described [here](https://docs.netbird.io/selfhosted/selfhosted-guide) 2. After Installation you should be able to Login successful. 3. Now go to Settings -> Groups 4. Enable: user group propagation & JWT group sync 5. As JWT claim chose "groups" and save. 6. I also added groups as "scope" unter: "NETBIRD_AUTH_SUPPORTED_SCOPES" in setup.env **Expected behavior** I expected that when a new user logs in, his Authentik Groups will be created and assigned in Netbird. **Screenshots** ![Bildschirmfoto 2023-11-10 um 12 11 38](https://github.com/netbirdio/netbird/assets/52936786/1591b7d6-68f0-4dce-ab96-bdfe7b09d191) ![Bildschirmfoto 2023-11-10 um 12 10 45](https://github.com/netbirdio/netbird/assets/52936786/e7ab29de-687f-4895-9976-ace3c43f4c81) ![Bildschirmfoto 2023-11-10 um 12 10 28](https://github.com/netbirdio/netbird/assets/52936786/de81acb8-7e07-4b18-8a4d-8323d22ecad5) **Additional context** Iam using Authentik with LDAP Backand and other OPENID Applications can get the groups with the groups scope.

saavagebueno added the idp config-idp authentik labels 2026-08-05 00:45:44 -04:00

saavagebueno closed this issue

saavagebueno commented

@NiclasPe commented on GitHub (Nov 22, 2023):

Any Updates on that topic?

@NiclasPe commented on GitHub (Nov 22, 2023): Any Updates on that topic?

saavagebueno commented

@mlsmaycon commented on GitHub (Dec 8, 2023):

@NiclasPe have you configured any Scope Mapping in authentik to ensure the groups are being sent as part of the JWT claims?

@mlsmaycon commented on GitHub (Dec 8, 2023): @NiclasPe have you configured any Scope Mapping in authentik to ensure the groups are being sent as part of the JWT claims?

saavagebueno commented

@NiclasPe commented on GitHub (Dec 8, 2023):

@mlsmaycon That was the clue!
Although I entered “groups” in each scope field, I forgot to set the option framed in the photo. Now it works as expected!
Thanks alot!

@NiclasPe commented on GitHub (Dec 8, 2023): @mlsmaycon That was the clue! Although I entered “groups” in each scope field, I forgot to set the option framed in the photo. Now it works as expected! Thanks alot! ![Bildschirmfoto 2023-12-08 um 12 40 50](https://github.com/netbirdio/netbird/assets/52936786/0d661286-226f-4f17-a48d-bb3e707ba8d9)

saavagebueno commented

@mlsmaycon commented on GitHub (Dec 8, 2023):

Thanks for the feedback. Would you share the steps here that will help us update the documentation for Authentik?

@mlsmaycon commented on GitHub (Dec 8, 2023): Thanks for the feedback. Would you share the steps here that will help us update the documentation for Authentik?

saavagebueno commented

@NiclasPe commented on GitHub (Dec 8, 2023):

Of course.

You have to do everything as described here: https://docs.netbird.io/selfhosted/identity-providers#authentik

The only changes are:

Set the Option "Include claims in id_token" in the Provider Configuration for Netbox in Authnentik (photo above)
When you set the properties in the setup.env file, you need to add groups to the NETBIRD_AUTH_SUPPORTED_SCOPES. It should look like this:
NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api groups"
After the first successful login into Netbird, go to the Settings tab. Under "Groups" activate: "Enable user group propagation" (if needed) and "Enable JWT group sync". The JWT claim must be set to "groups".

If you perform an relogin, the groups will be taken over from Authentik

Thanks for this great software!

@NiclasPe commented on GitHub (Dec 8, 2023): Of course. You have to do everything as described here: https://docs.netbird.io/selfhosted/identity-providers#authentik The only changes are: 1. Set the Option "Include claims in id_token" in the Provider Configuration for Netbox in Authnentik (photo above) 2. When you set the properties in the setup.env file, you need to add groups to the NETBIRD_AUTH_SUPPORTED_SCOPES. It should look like this: `NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api groups"` 3. After the first successful login into Netbird, go to the Settings tab. Under "Groups" activate: "Enable user group propagation" (if needed) and "Enable JWT group sync". The JWT claim must be set to "groups". If you perform an relogin, the groups will be taken over from Authentik Thanks for this great software!

saavagebueno commented

@mlsmaycon commented on GitHub (Dec 8, 2023):

Thank you @NiclasPe; appreciate it.

@mlsmaycon commented on GitHub (Dec 8, 2023): Thank you @NiclasPe; appreciate it.

saavagebueno commented

@HiFallMaple commented on GitHub (Dec 12, 2023):

Hi, I have followed the above steps to setup, but when I setup the jwt claim it says "please check the fields and try again".

What should I do?

@HiFallMaple commented on GitHub (Dec 12, 2023): Hi, I have followed the above steps to setup, but when I setup the jwt claim it says "please check the fields and try again". ![image](https://github.com/netbirdio/netbird/assets/48885618/3ffc3397-2ab8-410c-951d-689ef074fa03) What should I do?

saavagebueno commented

@mlsmaycon commented on GitHub (Dec 12, 2023):

@HiFallMaple, please update your dashboard image with the commands below; there was an issue fixed yesterday.

docker compose pull
docker compose up -d --force-recreate dashboard

@mlsmaycon commented on GitHub (Dec 12, 2023): @HiFallMaple, please update your dashboard image with the commands below; there was an issue fixed yesterday. ``` docker compose pull docker compose up -d --force-recreate dashboard ```

saavagebueno commented

@HiFallMaple commented on GitHub (Dec 12, 2023):

OK. I set it up to work!

It's awesome. Thank you so much!!!
I love Netbird!

@HiFallMaple commented on GitHub (Dec 12, 2023): OK. I set it up to work! It's awesome. Thank you so much!!! I love Netbird!

saavagebueno commented

@mlsmaycon commented on GitHub (Dec 12, 2023):

Awesome!!

thanks for the feedback @HiFallMaple

@mlsmaycon commented on GitHub (Dec 12, 2023): Awesome!! thanks for the feedback @HiFallMaple

saavagebueno commented

@MohammedNoureldin commented on GitHub (Feb 21, 2024):

Is it possible to configure these settings using the API? Or using any other automated-method?

@MohammedNoureldin commented on GitHub (Feb 21, 2024): Is it possible to configure these settings using the API? Or using any other automated-method? ![image](https://github.com/netbirdio/netbird/assets/14913147/c9f82b27-01ac-42ba-a16f-ebd257c549ac)

saavagebueno commented

@NiclasPe commented on GitHub (Feb 22, 2024):

Is it possible to configure these settings using the API? Or using any other automated-method?

@MohammedNoureldin, good Question, i think its not at the moment, why did you need that? Its an one time Operation per Instance. Do you have these many Instances?

@NiclasPe commented on GitHub (Feb 22, 2024): > Is it possible to configure these settings using the API? Or using any other automated-method? > > ![image](https://private-user-images.githubusercontent.com/14913147/306811047-c9f82b27-01ac-42ba-a16f-ebd257c549ac.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MDg1ODUzNjMsIm5iZiI6MTcwODU4NTA2MywicGF0aCI6Ii8xNDkxMzE0Ny8zMDY4MTEwNDctYzlmODJiMjctMDFhYy00MmJhLWExNmYtZWJkMjU3YzU0OWFjLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDAyMjIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwMjIyVDA2NTc0M1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTI0YjQzOWRlODFlNjgxOGJhMzEwZDI5MTRjOTVlODg2NDdlNmViOWQxMGFkN2U0NGEyODgwNWJkZDhiY2IwNmMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.rm79Q7iSJvv2BpObhG5QFZkMfSJSwbrA80Itjv1ANIE) @MohammedNoureldin, good Question, i think its not at the moment, why did you need that? Its an one time Operation per Instance. Do you have these many Instances?

saavagebueno commented

@mlsmaycon commented on GitHub (Feb 22, 2024):

@MohammedNoureldin you can use the accounts API: https://docs.netbird.io/api/resources/accounts#update-an-account

@mlsmaycon commented on GitHub (Feb 22, 2024): @MohammedNoureldin you can use the accounts API: https://docs.netbird.io/api/resources/accounts#update-an-account

saavagebueno commented

@MohammedNoureldin commented on GitHub (Feb 22, 2024):

Hi @mlsmaycon, thank you, yes I figured it out and tested it. I posted that also on Slack. IMO, it is kind of unconventional API design, that is why I was a bit unsure in the beginning. I mean to edit an array with a single element that will then be applied for all other users/accounts.

@MohammedNoureldin commented on GitHub (Feb 22, 2024): Hi @mlsmaycon, thank you, yes I figured it out and tested it. I posted that also on Slack. IMO, it is kind of unconventional API design, that is why I was a bit unsure in the beginning. I mean to edit an array with a single element that will then be applied for all other users/accounts.

saavagebueno commented

@1ndef1n1te commented on GitHub (Jul 24, 2024):

@NiclasPe @HiFallMaple
Hello, faced with issue when deleting user from group in IdP (Zitadel) doesn`t affect netbird groups, user in netbird still member of group. Does in reproduce in your setup too or yours IdP sync groups with netbird correctly?

@1ndef1n1te commented on GitHub (Jul 24, 2024): @NiclasPe @HiFallMaple Hello, faced with issue when deleting user from group in IdP (Zitadel) doesn`t affect netbird groups, user in netbird still member of group. Does in reproduce in your setup too or yours IdP sync groups with netbird correctly?

saavagebueno commented

@NiclasPe commented on GitHub (Jul 24, 2024):

@1ndef1n1te
I use Netbird in Combination with Authentik for testing and there everything works fine.
After a Refresh or Re-Login the Groups will be updated.

Witch Netbird Version do you use? Anything in the Logs?

@NiclasPe commented on GitHub (Jul 24, 2024): @1ndef1n1te I use Netbird in Combination with Authentik for testing and there everything works fine. After a Refresh or Re-Login the Groups will be updated. Witch Netbird Version do you use? Anything in the Logs?

saavagebueno commented

@1ndef1n1te commented on GitHub (Jul 24, 2024):

@NiclasPe

Now I am using the following setup:

netbirdio/dashboard:v2.4.1
netbirdio/management:0.28.6
netbirdio/signal:0.28.6
coturn/coturn:latest

The problem is very annoying because even after re-login user still in the group in Netbird dashboard while in IdP no.
All logs seems fine

@1ndef1n1te commented on GitHub (Jul 24, 2024): @NiclasPe Now I am using the following setup: ``` netbirdio/dashboard:v2.4.1 netbirdio/management:0.28.6 netbirdio/signal:0.28.6 coturn/coturn:latest ``` The problem is very annoying because even after re-login user still in the group in Netbird dashboard while in IdP no. All logs seems fine

saavagebueno commented

@NiclasPe commented on GitHub (Jul 24, 2024):

As mentioned, I don´t know / understood Zitadel well. The provided Netbird versions are up to date an the same as mine. I would suggest to check your Configuration against the Documentation and check your log files on both sides.
Otherwise we can only guess what the problem could be.
Also the configuration(-files) of your Infrastructure would be needful to get a idea of possible Reasons.

I also understood that that Problem is maybe annoying, but please keep in mind that this is a opensource Project. So if you need priority, fast or individual Support feel free to contact the developing Company.

Please also check if you checked the first option in Netbird here:

@NiclasPe commented on GitHub (Jul 24, 2024): As mentioned, I don´t know / understood Zitadel well. The provided Netbird versions are up to date an the same as mine. I would suggest to check your Configuration against the Documentation and check your log files on both sides. Otherwise we can only guess what the problem could be. Also the configuration(-files) of your Infrastructure would be needful to get a idea of possible Reasons. I also understood that that Problem is maybe annoying, but please keep in mind that this is a opensource Project. So if you need priority, fast or individual Support feel free to contact the developing Company. Please also check if you checked the first option in Netbird here: ![Bildschirmfoto 2024-07-24 um 20 10 56](https://github.com/user-attachments/assets/af058024-4bb1-45f8-a3b2-69e076d93c20)

saavagebueno commented

@YapWC commented on GitHub (Mar 19, 2025):

Anyone knows if the JWT Group sync work out of the box with NetBird installed via Quickstart Guide or I have to use the Advance Guide to install NetBird so that it would support the JWT Group sync?

I tried to configure the JWT Group Sync but to no avail maybe because I installed NetBird installed via Quickstart Guide? The following is my configuration on both Zitadel and NetBird.

I have tried to search for more information on the usage and configuration for NetBird and Zitadel JWT or perhaps a guide but can't find much. Therefore I decided to post it here as it is the most relevant discussion. Would appreciate if someone could show the right configuration.

@YapWC commented on GitHub (Mar 19, 2025): Anyone knows if the JWT Group sync work out of the box with NetBird installed via Quickstart Guide or I have to use the Advance Guide to install NetBird so that it would support the JWT Group sync? I tried to configure the JWT Group Sync but to no avail maybe because I installed NetBird installed via Quickstart Guide? The following is my configuration on both Zitadel and NetBird. <img width="421" alt="Image" src="https://github.com/user-attachments/assets/7afc2343-5bca-4ab4-aaee-04a1863f1233" /> <img width="1072" alt="Image" src="https://github.com/user-attachments/assets/201b67c0-966f-436e-ab37-90a9fe11720a" /> <img width="400" alt="Image" src="https://github.com/user-attachments/assets/cbe583fe-d54a-4fb3-b13c-5097b423f183" /> I have tried to search for more information on the usage and configuration for NetBird and Zitadel JWT or perhaps a guide but can't find much. Therefore I decided to post it here as it is the most relevant discussion. Would appreciate if someone could show the right configuration.

saavagebueno commented

@xpufx commented on GitHub (Apr 23, 2026):

Is it normal for netbird to pull ALL groups from authentik and not only the ones listed in "JWT Allow Group" ? It doesn't break anything but it lists unnecessary groups in the User list.

@xpufx commented on GitHub (Apr 23, 2026): Is it normal for netbird to pull ALL groups from authentik and not only the ones listed in "JWT Allow Group" ? It doesn't break anything but it lists unnecessary groups in the User list.

saavagebueno commented

@luckylinux commented on GitHub (Jun 3, 2026):

Seems like I am also affected:

If I used the default groups, it auto-created ALL groups that my User is assigned in Authentik.

If I instead use a netbird_entitlements JWT Claim, nothing seems to be happening, even though the JWT Payload in Authentik Previous for netbird Provider shows it correctly configured:

{
...
"netbird_entitlements": [
        "admins"
    ],
...
}

For reference the Default groups is also a List/Array, so there shouldn't be any Issues there.

I see absolutely nothing in Netbird Logs 😕.

@luckylinux commented on GitHub (Jun 3, 2026): Seems like I am also affected: <img width="869" height="833" alt="Image" src="https://github.com/user-attachments/assets/aed47758-f514-473f-870f-e660c23137a0" /> If I used the default `groups`, it auto-created ALL groups that my User is assigned in Authentik. If I instead use a `netbird_entitlements` JWT Claim, nothing seems to be happening, even though the JWT Payload in Authentik Previous for `netbird` Provider shows it correctly configured: ``` { ... "netbird_entitlements": [ "admins" ], ... } ``` For reference the Default `groups` is also a List/Array, so there shouldn't be any Issues there. I see absolutely nothing in Netbird Logs 😕.

saavagebueno commented

@BOAScripts commented on GitHub (Jun 8, 2026):

@luckylinux, have the same issue as you described (but I use the claim name "entitlements") as per the authentik documentation

Changing in the yaml server config the log level to debug let me see that the netbird does not receive the claim. Altought I see it in the preview in the authentik provider.

server:
  logLevel: "debug"

[netbird-server] 08.06.2026 18:39:13 2026-06-08T18:39:13.317+02:00 DEBG shared/auth/jwt/extractor.go:165: JWT claim "entitlements" is missing

I'll come back if I find more info on "why" netbird does not receive the claim.

@BOAScripts commented on GitHub (Jun 8, 2026): @luckylinux, have the same issue as you described (but I use the claim name "entitlements") as per the authentik [ documentation](https://integrations.goauthentik.io/networking/netbird/) Changing in the yaml server config the log level to debug let me see that the netbird does not receive the claim. Altought I see it in the preview in the authentik provider. ```yaml server: logLevel: "debug" ``` ```log [netbird-server] 08.06.2026 18:39:13 2026-06-08T18:39:13.317+02:00 DEBG shared/auth/jwt/extractor.go:165: JWT claim "entitlements" is missing ``` I'll come back if I find more info on "why" netbird does not receive the claim.

saavagebueno commented

@luckylinux commented on GitHub (Jun 8, 2026):

@BOAScripts:

From what I learned from another Experience with Authentik on Forgejo (not Netbird), there are a few Things that come to Mind. I was using a custom Group forgejo_admins instead of Entitlements, but I believe the same Principles apply here.

I didn't re-test these on Netbird since, so take them for what they are worth it:

Netbird is not requesting the Claim. In Forgejo I had to set Additional scopes to email profile groups forgejo_groups, Netbird needs to be configured similarly
In Authentik go to Customization -> Property Mappings and setup your Scope Mapping

Make sure that you do NOT use OAuth Source Property Mapping as Type, I was mislead once !

Make sure that you request the Value that you set to Scope Name whereas, from my Understanding, the Dictionary returned can have a different Field Name or possibly several Fields:

# Return Roles in Dictionary Form
return {
    "forgejo_groups": roles,
    "additional_claims": {
      "forgejo_groups": roles
    }
}

Concerning Netbird Entitlements, I have this currently defined, not sure if it helps much though:

@luckylinux commented on GitHub (Jun 8, 2026): @BOAScripts: From what I learned from another Experience with Authentik on Forgejo (not Netbird), there are a few Things that come to Mind. I was using a custom Group `forgejo_admins` instead of Entitlements, but I believe the same Principles apply here. I didn't re-test these on Netbird since, so take them for what they are worth it: - Netbird is not requesting the Claim. In Forgejo I had to set **Additional scopes** to `email profile groups forgejo_groups`, Netbird needs to be configured similarly - In Authentik go to `Customization` -> `Property Mappings` and setup your Scope Mapping <img width="1215" height="868" alt="Image" src="https://github.com/user-attachments/assets/a8485fe3-2ee3-4842-bc00-646eb18a05a3" /> Make sure that you do **NOT** use `OAuth Source Property Mapping` as Type, I was mislead once ! Make sure that you request the Value that you set to `Scope Name` whereas, from my Understanding, the Dictionary returned can have a different Field Name or possibly several Fields: ``` # Return Roles in Dictionary Form return { "forgejo_groups": roles, "additional_claims": { "forgejo_groups": roles } } ``` Concerning Netbird Entitlements, I have this currently defined, not sure if it helps much though: <img width="1210" height="764" alt="Image" src="https://github.com/user-attachments/assets/ba48ba75-077f-4e1d-98df-a4d71eff6a0d" />

saavagebueno commented

@BOAScripts commented on GitHub (Jun 8, 2026):

@luckylinux , I didn't go that route but your context helped thx.
Basically, I hijacked the groups claim and put the entitlements instead in that claim.

I had to remove the default 'profile' claim, as the default one adds the authentik groups, and we only want the app entitlments.

And revert the JWT claim to groups in netbird

@BOAScripts commented on GitHub (Jun 8, 2026): @luckylinux , I didn't go that route but your context helped thx. Basically, I hijacked the `groups` claim and put the entitlements instead in that claim. <img width="1139" height="666" alt="Image" src="https://github.com/user-attachments/assets/e233fd4a-1793-4adc-b08d-113a5ba14ef9" /> <img width="1081" height="245" alt="Image" src="https://github.com/user-attachments/assets/48415c1b-cf32-48ef-a9ad-bb037c1dddf5" /> I had to remove the default 'profile' claim, as the default one adds the authentik groups, and we only want the app entitlments. And revert the JWT claim to `groups` in netbird

saavagebueno commented