{"record":{"id":"7034fa0a8fbe8662","repo":"weaviate/weaviate","slug":"invalid-groups-type-v","errorCode":null,"errorMessage":"invalid groups type: %v","messagePattern":"invalid groups type: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"usecases/auth/authorization/conv/casbin_types.go","lineNumber":338,"sourceCode":"\tif permission.Action == nil {\n\t\treturn &authorization.Policy{Resource: InternalPlaceHolder}, nil\n\t}\n\n\tverb, domain, err := extractFromExtAction(*permission.Action)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar resource string\n\tswitch domain {\n\tcase authorization.GroupsDomain:\n\t\tgroup := \"*\"\n\t\tif permission.Groups != nil {\n\t\t\tif permission.Groups.Group != nil {\n\t\t\t\tgroup = *permission.Groups.Group\n\t\t\t}\n\t\t\tif permission.Groups.GroupType != models.GroupTypeOidc {\n\t\t\t\treturn nil, fmt.Errorf(\"invalid groups type: %v\", permission.Groups.GroupType)\n\t\t\t}\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"invalid permission: %v\", permission)\n\t\t}\n\t\tresource = CasbinGroups(group, string(models.GroupTypeOidc))\n\tcase authorization.UsersDomain:\n\t\tuser := \"*\"\n\t\tif permission.Users != nil && permission.Users.Users != nil {\n\t\t\tuser = *permission.Users.Users\n\t\t}\n\t\tresource = CasbinUsers(user)\n\tcase authorization.RolesDomain:\n\t\trole := \"*\"\n\t\t// default verb for role to handle cases where role is nil\n\t\torigVerb := verb\n\t\tverb = authorization.VerbWithScope(verb, authorization.ROLE_SCOPE_MATCH)\n\t\tif permission.Roles != nil && permission.Roles.Role != nil {\n\t\t\trole = *permission.Roles.Role","sourceCodeStart":320,"sourceCodeEnd":356,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/usecases/auth/authorization/conv/casbin_types.go#L320-L356","documentation":"For the groups domain, a permission may target groups, but only OIDC group type is supported. policy() rejects the permission when Groups is present but GroupType is anything other than models.GroupTypeOidc (\"oidc\").","triggerScenarios":"POST /v1/roles (or role assignment) with a groups permission whose groupsType is set to something other than \"oidc\", e.g. \"ldap\" or an empty/wrong string.","commonSituations":"Configuring RBAC groups for non-OIDC identity providers (LDAP, SAML) that weaviate's group permission model does not support; typos in the group type field.","solutions":["Set groupsType to \"oidc\" in the groups permission object.","If your IdP is not OIDC, manage access at the IdP level instead of weaviate group permissions.","Remove the groups permission if group-based RBAC does not apply to your auth setup."],"exampleFix":"// before\n{\"action\": \"manage_groups\", \"groups\": {\"groupsType\": \"ldap\", \"group\": \"devs\"}}\n// after\n{\"action\": \"manage_groups\", \"groups\": {\"groupsType\": \"oidc\", \"group\": \"devs\"}}","handlingStrategy":"validation","validationCode":"if perm.Groups != nil && perm.Groups.GroupsType != \"oidc\" {\n  return fmt.Errorf(\"groupsType must be \\\"oidc\\\", got %q\", perm.Groups.GroupsType)\n}","typeGuard":"func isOidcGroupPermission(g *models.GroupsPermission) bool {\n  return g != nil && g.GroupsType != nil && *g.GroupsType == models.GroupTypeOidc\n}","tryCatchPattern":"_, err := rolesCreator.WithPermissions(perm).Do(ctx)\nif err != nil && strings.Contains(err.Error(), \"invalid groups type\") {\n  return fmt.Errorf(\"weaviate RBAC only supports oidc group type\")\n}","preventionTips":["Only configure group permissions when your IdP is OIDC.","Handle LDAP/SAML group mapping at the IdP, not in weaviate RBAC.","Always set groupsType explicitly; never rely on defaults."],"tags":["rbac","authorization","oidc","go"],"backgroundTag":"invalid-rbac-group-type","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}