goauthentik / goauthentik/authentik
Object-level permissions for (OAuth2/OpenID) Providers have no effect
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 659
Description
### Describe the bug
When assigning object-level permissions (view, change, delete) on an individual **OAuth2/OpenID Provider** to a user, the user still cannot see or access that provider in the Admin interface.
The provider becomes visible only when assigning the global “Can view provider” permission, which grants access to all providers.
Once the global “Can view provider” permission is assigned and the provider becomes visible, the **object-level edit and delete permissions *do* work correctly**.
So the issue affects *visibility only*, not the enforcement of change/delete permissions.
### How to reproduce
1. Create or select an **OAuth2/OpenID Provider**.
2. Under **User Object Permissions**, grant a user:
* `Can view provider`
* `Can change provider`
* `Can delete provider`
3. Log in as the user.
4. Try to view or access the provider.
### Expected behavior
The user should be able to see and access **only the provider** for which they were granted object-level permissions.
### Screenshots
_No response_
### Additional context
_No response_
### Deployment Method
Docker
### Version
2025.10.1
### Relevant log output
```shell
```
Contributor guide
Assessment
This issue has not been assessed yet.