From 459469adf8f3daa70c97f0524046eb7515bd080c Mon Sep 17 00:00:00 2001 From: Tobias Korf Date: Wed, 8 Jul 2026 08:27:55 +0200 Subject: [PATCH] Add useUIDAsGroupName option to Azure provider Adds an optional boolean field to the Azure provider that, when enabled, uses the Azure group object ID (UID) as the name of the synchronized OpenShift group instead of the display name. Group filtering (filter, groups, whitelist/blacklist) continues to match against the display name. --- README.md | 1 + api/v1alpha1/groupsync_types.go | 5 +++++ config/crd/bases/redhatcop.redhat.io_groupsyncs.yaml | 3 +++ .../bases/group-sync-operator.clusterserviceversion.yaml | 8 ++++++++ pkg/syncer/azure.go | 7 ++++++- 5 files changed, 23 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 4f1c959c..18335d45 100644 --- a/README.md +++ b/README.md @@ -81,6 +81,7 @@ Groups contained within Azure Active Directory can be synchronized into OpenShif | `filter` | Graph API filter | | No | | `groups` | List of groups to filter against | | No | | `userNameAttributes` | Fields on a user record to use as the User Name | `userPrincipalName` | No | +| `useUIDAsGroupName` | Use the Azure group object ID (UID) instead of the display name as the name of the OpenShift group | `false` | No | | `prune` | Prune Whether to prune groups that are no longer in Azure | `false` | No | The following is an example of a minimal configuration that can be applied to integrate with a Azure provider: diff --git a/api/v1alpha1/groupsync_types.go b/api/v1alpha1/groupsync_types.go index a655b11c..7af00987 100644 --- a/api/v1alpha1/groupsync_types.go +++ b/api/v1alpha1/groupsync_types.go @@ -423,6 +423,11 @@ type AzureProvider struct { // +kubebuilder:validation:Optional UserNameAttributes *[]string `json:"userNameAttributes,omitempty"` + // UseUIDAsGroupName determines whether the Azure group object ID (UID) is used as the name of the OpenShift group instead of the display name. Default is false + // +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Use UID as Group Name",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"} + // +kubebuilder:validation:Optional + UseUIDAsGroupName bool `json:"useUIDAsGroupName,omitempty"` + // Prune Whether to prune groups that are no longer in Azure. Default is false // +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Prune",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"} // +kubebuilder:validation:Optional diff --git a/config/crd/bases/redhatcop.redhat.io_groupsyncs.yaml b/config/crd/bases/redhatcop.redhat.io_groupsyncs.yaml index 6ad9936c..de997e14 100644 --- a/config/crd/bases/redhatcop.redhat.io_groupsyncs.yaml +++ b/config/crd/bases/redhatcop.redhat.io_groupsyncs.yaml @@ -133,6 +133,9 @@ spec: prune: description: Prune Whether to prune groups that are no longer in Azure. Default is false type: boolean + useUIDAsGroupName: + description: UseUIDAsGroupName determines whether the Azure group object ID (UID) is used as the name of the OpenShift group instead of the display name. Default is false + type: boolean userNameAttributes: description: UserNameAttributes are the fields to consider on the User object containing the username items: diff --git a/config/manifests/bases/group-sync-operator.clusterserviceversion.yaml b/config/manifests/bases/group-sync-operator.clusterserviceversion.yaml index 6447dcf1..87223b75 100644 --- a/config/manifests/bases/group-sync-operator.clusterserviceversion.yaml +++ b/config/manifests/bases/group-sync-operator.clusterserviceversion.yaml @@ -167,6 +167,13 @@ spec: path: providers[0].azure.userNameAttributes x-descriptors: - urn:alm:descriptor:com.tectonic.ui:text + - description: UseUIDAsGroupName determines whether the Azure group object ID + (UID) is used as the name of the OpenShift group instead of the display + name. Default is false + displayName: Use UID as Group Name + path: providers[0].azure.useUIDAsGroupName + x-descriptors: + - urn:alm:descriptor:com.tectonic.ui:booleanSwitch - description: GitHub represents the GitHub provider displayName: GitHub Provider path: providers[0].github @@ -783,6 +790,7 @@ spec: | `filter` | Graph API filter | | No | | `groups` | List of groups to filter against | | No | | `userNameAttributes` | Fields on a user record to use as the User Name | `userPrincipalName` | No | + | `useUIDAsGroupName` | Use the Azure group object ID (UID) instead of the display name as the name of the OpenShift group | `false` | No | | `prune` | Prune Whether to prune groups that are no longer in Azure | `false` | No | The following is an example of a minimal configuration that can be applied to integrate with a Azure provider: diff --git a/pkg/syncer/azure.go b/pkg/syncer/azure.go index ebc5a7a4..c8c6b236 100644 --- a/pkg/syncer/azure.go +++ b/pkg/syncer/azure.go @@ -342,13 +342,18 @@ func (a *AzureSyncer) Sync() ([]userv1.Group, error) { continue } + ocpGroupName := *groupName + if a.Provider.UseUIDAsGroupName { + ocpGroupName = *group.DirectoryObject.GetId() + } + ocpGroup := userv1.Group{ TypeMeta: v1.TypeMeta{ Kind: "Group", APIVersion: userv1.GroupVersion.String(), }, ObjectMeta: v1.ObjectMeta{ - Name: *groupName, + Name: ocpGroupName, Annotations: map[string]string{}, Labels: map[string]string{}, },