Add support for RBAC group role assignment

[adam-bloom]

This behavior was not well documented, but there is an RBAC concept of group membership (both for DB Users and via OIDC). Groups can be mapped to roles via a not documented API. Can support for this API be added to the python client?

https://github.com/weaviate/weaviate/blob/8b0aa633651b072ff8ea712d5b2fd6c7e2fa3596/openapi-specs/schema.json#L4935-L5068

[dirkkul]

Hey - support for groups will probably happen during the 1.33 cycle. The feature is not quite finished and that's why it is not properly documented

Btw, there are no DB User groups. We might also add that

[adam-bloom]

Well, that explains why it felt half-baked! I’m pretty new to using weaviate, so I don’t have my maturity baseline calculated. Feel free to close if this is tracked elsewhere.

On a related note, are there already OIDC improvements planned, or should I open additional issues? Going to bounce what I’m trying to do off of a team member first, but I think it’s sensible…and not supported. (Using multiple clients with client credentials grants - I.e. multiple service accounts, one per service accessing weaviate.)

[dirkkul]

Well, that explains why it felt half-baked! I’m pretty new to using weaviate, so I don’t have my maturity baseline calculated. Feel free to close if this is tracked elsewhere.

I'll leave this open to track the group feature in the client!

On a related note, are there already OIDC improvements planned, or should I open additional issues? Going to bounce what I’m trying to do off of a team member first, but I think it’s sensible…and not supported.

Only group features during the next cycle. Feel free to make feature requests in the main weaviate repo. To manage expectations: these enterprise features are usually added for paying customers.

Using multiple clients with client credentials grants - I.e. multiple service accounts, one per service accessing weaviate

That should work already, you can use different client credentials for different clients

[dirkkul]

Hey @adam-bloom - if you want to test the group features the python and weaviate PRs are ready!