weaviate/weaviate · error

invalid groups type: %v

Error message

invalid groups type: %v

What it means

For the groups domain, a permission may target groups, but only OIDC group type is supported. policy() rejects the permission when Groups is present but GroupType is anything other than models.GroupTypeOidc ("oidc").

Source

Thrown at usecases/auth/authorization/conv/casbin_types.go:338

	if permission.Action == nil {
		return &authorization.Policy{Resource: InternalPlaceHolder}, nil
	}

	verb, domain, err := extractFromExtAction(*permission.Action)
	if err != nil {
		return nil, err
	}

	var resource string
	switch domain {
	case authorization.GroupsDomain:
		group := "*"
		if permission.Groups != nil {
			if permission.Groups.Group != nil {
				group = *permission.Groups.Group
			}
			if permission.Groups.GroupType != models.GroupTypeOidc {
				return nil, fmt.Errorf("invalid groups type: %v", permission.Groups.GroupType)
			}
		} else {
			return nil, fmt.Errorf("invalid permission: %v", permission)
		}
		resource = CasbinGroups(group, string(models.GroupTypeOidc))
	case authorization.UsersDomain:
		user := "*"
		if permission.Users != nil && permission.Users.Users != nil {
			user = *permission.Users.Users
		}
		resource = CasbinUsers(user)
	case authorization.RolesDomain:
		role := "*"
		// default verb for role to handle cases where role is nil
		origVerb := verb
		verb = authorization.VerbWithScope(verb, authorization.ROLE_SCOPE_MATCH)
		if permission.Roles != nil && permission.Roles.Role != nil {
			role = *permission.Roles.Role

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Set groupsType to "oidc" in the groups permission object.
2. If your IdP is not OIDC, manage access at the IdP level instead of weaviate group permissions.
3. Remove the groups permission if group-based RBAC does not apply to your auth setup.

Example fix

// before
{"action": "manage_groups", "groups": {"groupsType": "ldap", "group": "devs"}}
// after
{"action": "manage_groups", "groups": {"groupsType": "oidc", "group": "devs"}}

if perm.Groups != nil && perm.Groups.GroupsType != "oidc" {
  return fmt.Errorf("groupsType must be \"oidc\", got %q", perm.Groups.GroupsType)
}

func isOidcGroupPermission(g *models.GroupsPermission) bool {
  return g != nil && g.GroupsType != nil && *g.GroupsType == models.GroupTypeOidc
}

_, err := rolesCreator.WithPermissions(perm).Do(ctx)
if err != nil && strings.Contains(err.Error(), "invalid groups type") {
  return fmt.Errorf("weaviate RBAC only supports oidc group type")
}

When it happens

Trigger: POST /v1/roles (or role assignment) with a groups permission whose groupsType is set to something other than "oidc", e.g. "ldap" or an empty/wrong string.

Common situations: Configuring RBAC groups for non-OIDC identity providers (LDAP, SAML) that weaviate's group permission model does not support; typos in the group type field.

Related errors

• unauthorized: namespaced OIDC principal cannot be granted th
• permission: %w
• invalid action: %s
• invalid verb: %s
• invalid permission: %v

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/7034fa0a8fbe8662. Report an issue: GitHub.