Default group not working with OIDC security enabled on 0.25.0

[l4crito]

Hello, previously we got a default group set to reader together with Okta auth enabled, anonymous users were able to read topics without login , and they got further permissions once logged, but now that is not working anymore, it always ask you for login, we suspect that is something related with the default group, we are not sure what to do now, any advice on this?

[PLeS207]

Hello, can you share your config?

[l4crito]

Hello!!, here our config

micronaut:
  http:
    client:
      read-timeout: 20
      connect-timeout: 20
  jmx:
    add-to-factory: true
    register-endpoints: true
  metrics:
    enabled: true
  server:
    access-log: 
      enabled: true
      name: org.akhq.log.access
      format: '{"Date": "{}","Duration": "{}","Protocol": "{}","Url": "{}","Status": "{}","Ip": "{}","User": "{}"}'
    http-to-https-redirect: true
    host-resolution:
        host-header: Host
        protocol-header: X-Forwarded-Proto
  security:
    default-group: reader
    token:
      jwt:
        cookie:
          cookie-http-only: false
    enabled: true
    oauth2:
      enabled: true
      clients:
        okta:
          scopes:
            - openid
            - email
            - profile
            - groups
          client-id: {{ okta_client_id }}
          client-secret: {{ okta_client_secret }}
          openid:
            issuer: {{ okta_client_issuer }}
akhq:
    security:
      default-group: reader
      roles:
        topic-read:
          - resources: [ "TOPIC", "TOPIC_DATA" ]
            actions: [ "READ" ]
          - resources: [ "TOPIC" ]
            actions: [ "READ_CONFIG" ]
        topic-admin:
          - resources: [ "TOPIC", "TOPIC_DATA" ]
            actions: [ "READ", "CREATE", "DELETE" ,"UPDATE"]
          - resources: [ "TOPIC" ]
            actions: [  "READ_CONFIG", "ALTER_CONFIG" ]
        topic-data-admin:
          - resources: [ "TOPIC_DATA" ]
            actions: [ "READ", "CREATE", "DELETE", "UPDATE"]
        connect-read:
          - resources: [ "CONNECTOR" ]
            actions: [ "READ" ]
        connect-rw:
          - resources: [ "CONNECTOR" ]
            actions: [ "READ", "CREATE", "UPDATE_STATE" ]
        connect-admin:
          - resources: [ "CONNECTOR" ]
            actions: [ "READ", "CREATE", "UPDATE_STATE", "DELETE" ]
        registry-read:
          - resources: [ "SCHEMA" ]
            actions: [ "READ" ]
        registry-admin:
          - resources: [ "SCHEMA" ]
            actions: [ "READ", "CREATE", "UPDATE", "DELETE", "DELETE_VERSION" ]
        registry-read-create:
          - resources: [ "SCHEMA" ]
            actions: [ "READ", "CREATE"]
        group-read:
          - resources: [ "CONSUMER_GROUP" ]
            actions: [ "READ" ]
        group-admin:
          - resources: [ "CONSUMER_GROUP" ]
            actions: [ "READ","UPDATE_OFFSET","DELETE_OFFSET" ]
        connect-cluster-read:
          - resources: [ "CONNECT_CLUSTER" ]
            actions: [ "READ" ]
        acl-read:
          - resources: [ "ACL" ]
            actions: [ "READ" ]      

      groups:
        resource-admin:
          - role: connect-admin
          - role: connect-cluster-read
          - role: registry-admin
          - role: group-admin
          - role: acl-read
        resource-read:
          - role: connect-read
          - role: connect-cluster-read
          - role: registry-read
          - role: group-read
          - role: acl-read
        anonymous-user:
          - role: topic-read
          - role: group-read
          - role: acls-read
          - role: registry-read
          - role: connect-cluster-read
        peint-admin:
          - role: topic-admin
            patterns: 
              - "(?i)(peint.*)" 
        cim-admin:
          - role: topic-admin
            patterns:
              - "(?i)(cim.*|.*cim)"
          - role: topic-read
            patterns:
              - "(?i)(order.*|.*order)"

      oidc:
        enabled: true
        providers:
          okta:
            label: "Login with Okta"
            username-field: email
            groups-field: groups
            default-group: reader
            groups:
              - name: FED_APP_AKHQ_PEINT_ADMIN
                groups:
                  - admin
              - name: FED_APP_AKHQ_CIM_ADMIN
                groups:
                  - cim-admin
                  - resource-admin

[AlexisSouquiere]

I think that it's the same as #1786
I'm currently working on it to make sure unlogged users can still access AKHQ when basic/oidc/ldap auth is enabled if a default group is defined

[l4crito]

Thanks a lot for replying !!.