Preflight Checklist
Problem Description
storage.Password has a Groups field, but the gRPC API cannot set it. The Password message in api/v2/api.proto has only email, hash, username, user_id, and server/apiserver/passwords.go copies just those four into storage.Password. UpdatePasswordReq is narrower still, new_hash and new_username only.
Groups for local passwords were added in #4456 and work through the config file. A user created over the API authenticates but has no groups, so any relying party that authorizes on the groups claim treats them as unprivileged. That leaves the config file as the only way to manage users with groups, which requires a restart to change.
Proposed Solution
Add repeated string groups to the proto Password, copy it in CreatePassword, and add new_groups to UpdatePasswordReq. The storage field already exists.
Alternatives Considered
No response
Additional Information
Willing to contribute the PR if feature request is accepted.
Preflight Checklist
Problem Description
storage.Password has a Groups field, but the gRPC API cannot set it. The Password message in api/v2/api.proto has only email, hash, username, user_id, and server/apiserver/passwords.go copies just those four into storage.Password. UpdatePasswordReq is narrower still, new_hash and new_username only.
Groups for local passwords were added in #4456 and work through the config file. A user created over the API authenticates but has no groups, so any relying party that authorizes on the groups claim treats them as unprivileged. That leaves the config file as the only way to manage users with groups, which requires a restart to change.
Proposed Solution
Add repeated string groups to the proto Password, copy it in CreatePassword, and add new_groups to UpdatePasswordReq. The storage field already exists.
Alternatives Considered
No response
Additional Information
Willing to contribute the PR if feature request is accepted.