{"record":{"id":"126b449912bd08e3","repo":"weaviate/weaviate","slug":"assigning-roles-to-groups-is-not-allowed","errorCode":null,"errorMessage":"assigning roles to groups is not allowed","messagePattern":"assigning roles to groups is not allowed","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"adapters/handlers/rest/authz/handlers_authz.go","lineNumber":877,"sourceCode":"\t\t}\n\t}\n\n\th.logger.WithFields(logrus.Fields{\n\t\t\"action\":                  \"assign_roles\",\n\t\t\"component\":               authorization.ComponentName,\n\t\t\"user\":                    principal.Username,\n\t\t\"user_to_assign_roles_to\": internalID,\n\t\t\"roles\":                   roleNames,\n\t}).Info(\"roles assigned to user\")\n\n\treturn authz.NewAssignRoleToUserOK()\n}\n\nfunc (h *authZHandlers) assignRoleToGroup(params authz.AssignRoleToGroupParams, principal *models.Principal) middleware.Responder {\n\tctx := params.HTTPRequest.Context()\n\n\tif rolevisibility.CallerConfined(h.namespacesEnabled, principal) {\n\t\treturn authz.NewAssignRoleToGroupForbidden().WithPayload(cerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf(\"assigning roles to groups is not allowed\")))\n\t}\n\n\tfor _, role := range params.Body.Roles {\n\t\tif strings.TrimSpace(role) == \"\" {\n\t\t\treturn authz.NewAssignRoleToGroupBadRequest().WithPayload(cerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf(\"one or more of the roles you want to assign is empty\")))\n\t\t}\n\n\t\tif err := validateEnvVarRoles(role); err != nil {\n\t\t\treturn authz.NewAssignRoleToGroupForbidden().WithPayload(cerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf(\"assigning: %w\", err)))\n\t\t}\n\t}\n\n\tif len(params.Body.Roles) == 0 {\n\t\treturn authz.NewAssignRoleToGroupBadRequest().WithPayload(cerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf(\"roles can not be empty\")))\n\t}\n\n\tgroupType, err := validateUserTypeInput(string(params.Body.GroupType))\n\tif err != nil || groupType != authentication.AuthTypeOIDC {","sourceCodeStart":859,"sourceCodeEnd":895,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/adapters/handlers/rest/authz/handlers_authz.go#L859-L895","documentation":"Policy error in assignRoleToGroup: role-to-group assignment is not permitted in this cluster configuration (the feature is gated off). The handler refuses the request after its early confinement/validity checks rather than forwarding it to the controller.","triggerScenarios":"Thrown at adapters/handlers/rest/authz/handlers_authz.go:877 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Assign roles to users instead of groups","Enable group-based RBAC if the deployment requires it"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}