docs(sso): correct three Entra ID group resolution claims - #498
Merged
Conversation
Verified against a live tenant on Fess 15.8.0-SNAPSHOT. **The "could not be fully loaded" message is not shown when the Graph permission is missing.** The troubleshooting section states that a user who holds their direct groups but not their parent groups gets that message too. `toMemberGroupIds` treats `Authorization_RequestDenied` as an answer meaning the group has no parents rather than as a failure, so resolution counts as successful and nothing appears on the search screen. That is the most likely cause of missing parent groups -- the `GroupMember.Read.All` the previous bullet tells the reader to check -- so the one case the text was written for is the one it gets wrong. Signing in with only `User.Read` consented dropped a user from six matching documents to three with no message at all; the only sign was the `Not allowed to read the parent groups of ...` warning in the log. **`entraid.use.ds` also removes a user-level permission.** The table describes only the group and role effect. The local part of the signed-in user's user principal name is derived the same way, so `false` removes that permission too. **Nested groups are not walked recursively.** The parent group lookup uses Microsoft Graph's `getMemberGroups`, which resolves transitively: one call per directly assigned group returns every group above it, whatever the depth. A three-level nest resolved completely with a single call and no recursion, so "recursively" and "up to a certain number of levels" describe machinery that does not engage while Graph is answering. Also states that `entraid.permission.fields` can only name a field whose value is a string -- `securityEnabled` and `groupTypes` come back as a boolean and a list and cannot become permission values. All seven languages.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Verified against a live Entra ID tenant on Fess 15.8.0-SNAPSHOT (master
127f30b0a). All seven languages.1. The "could not be fully loaded" message is not shown when the Graph permission is missing
The troubleshooting section says the message appears for "a user who holds their direct groups but not their parent groups".
toMemberGroupIdstreatsAuthorization_RequestDeniedas an answer meaning the group has no parents rather than as a failure, so resolution counts as successful and nothing appears on the search screen.That is the most likely cause of missing parent groups — the
GroupMember.Read.Allthe previous bullet tells the reader to check — so the one case the text was written for is the one it gets wrong.Measured: with only
User.Readconsented, a user went from six matching documents to three. No banner. The only sign wasNot allowed to read the parent groups of ...in the log.2.
entraid.use.dsalso removes a user-level permissionThe table describes only the group and role effect. The local part of the signed-in user's user principal name is derived the same way, so
falseremoves that permission too.Measured:
use.ds=falseremoved both2FessTestM365(the group mail local part) and1fess-test1(the UPN local part).3. Nested groups are not walked recursively
The parent group lookup uses Microsoft Graph's
getMemberGroups, which resolves transitively: one call per directly assigned group returns every group above it, whatever the depth.Measured: a three-level nest resolved completely, and the log showed
depth: 0only — a singlegetMemberGroupsresponse carried both the parent and the grandparent. "Recursively" and "up to a certain number of levels" describe machinery that does not engage while Graph is answering.Also
entraid.permission.fieldscan only name a field whose value is a string.securityEnabledcomes back as a boolean andgroupTypesas a list, and neither can become a permission value. Naming one currently breaks group resolution outright; codelibs/fess#3296 makes it ignore the field with a warning instead.Verification
Every file was parsed with docutils before and after: no new errors or warnings, and the new literals and emphasis parse as the intended nodes in all seven languages.