Group impersonation fails in Console with Direct Authentication: "Failed to load groups - Model does not exist"

[dronenb]

Summary

When Direct Authentication (structured authentication / external OIDC, aka "BYO" OIDC) is enabled on OpenShift, the built-in OAuth group.openshift.io model no longer exists. User impersonation continues to work fine — the masthead "Impersonate user" flow accepts a username and impersonates it as expected. The problem is scoped to the groups portion of that same modal: when attempting to add groups to an impersonation request, the UI tries to build a selectable list from all Group resources in the cluster. Because the Group model does not exist under Direct Authentication, the groups selector fails with:

Failed to load groups
Model does not exist

Group impersonation itself is still valid and useful in this mode — Kubernetes RBAC continues to honor impersonated groups (Impersonate-Group) regardless of whether the OpenShift group.openshift.io model exists. The problem is purely in the UI's assumption that a discoverable pool of Group resources exists to populate a selectable list.

Version

• OpenShift Container Platform: 4.22
• Console: shipped with OCP 4.22
• Auth mode: Direct Authentication (structured authentication / external OIDC)

Steps to reproduce

1. Configure a cluster to use Direct Authentication (structured authentication /
   external OIDC), so the built-in group.openshift.io model is gone.
2. In the Console masthead, open the user menu and choose Impersonate user.
3. Enter a username — user impersonation works as expected.
4. Attempt to add/select groups for the impersonation request.
5. Observe the failed to load groups - model does not exist error; the groups
   selector cannot load.

Current behavior

User impersonation works. Only the groups selector in the impersonation modal is broken: it attempts to enumerate group.openshift.io Group resources to populate a selectable groups list. Under Direct Authentication that model does not exist, so the request fails and group impersonation is unusable in the UI.

Expected behavior

Group impersonation must still work under Direct Authentication. The fix is in
the UI:

• Allow free-form entry of group names instead of enumerating cluster
  Group resources.
• Preserve multiple-group impersonation. The current GUI already supports
  selecting multiple groups, and kubectl supports it via a repeatable
  --as-group flag. Free-form entry must likewise accept one or more group
  names.
• Gracefully handle the absence of the group.openshift.io model — do not
  hard-fail with "model does not exist" when the model is unavailable.

In short: replace the enumerated/selectable group list with free-form entry of one or more group names, preserving the existing multi-group capability.

Non-goal

There is intentionally no authoritative pool of groups to list in this mode. The only way to synthesize one would be to extrapolate group names from RoleBinding / ClusterRoleBinding subjects, which is undesirable (incomplete, misleading, and not a real source of truth) and should not be done. Free-form entry of one or more group names is the correct fix.

Impact

As clusters move to Direct Authentication, the OpenShift group.openshift.io model is eliminated. User impersonation still works, but the Console's dependency on enumerating cluster Group resources makes group impersonation unusable in the UI under Direct Authentication — even though group impersonation remains valid and enforced by Kubernetes RBAC.

Frequency

Reproducible — occurs every time group impersonation is attempted while Direct Authentication is enabled.

Related

• Jira RFE: RFE-9146 (service account impersonation in the Console)
• Related PR: RFE-9146: Add service account impersonation support #17026 — adds first-class service account
  impersonation to the masthead modal (same modal that owns the group selector)
• Red Hat support case: 04520499