goauthentik / goauthentik/authentik

Object-level permissions for (OAuth2/OpenID) Providers have no effect

Open
#18,233 5 comments 1 reaction 2 assignees Claimed by @gergosimonyi View on GitHub
bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
659

Description

### Describe the bug

When assigning object-level permissions (view, change, delete) on an individual **OAuth2/OpenID Provider** to a user, the user still cannot see or access that provider in the Admin interface.

The provider becomes visible only when assigning the global “Can view provider” permission, which grants access to all providers.

Once the global “Can view provider” permission is assigned and the provider becomes visible, the **object-level edit and delete permissions *do* work correctly**.
So the issue affects *visibility only*, not the enforcement of change/delete permissions.

### How to reproduce

1. Create or select an **OAuth2/OpenID Provider**.
2. Under **User Object Permissions**, grant a user:

* `Can view provider`
* `Can change provider`
* `Can delete provider`
3. Log in as the user.
4. Try to view or access the provider.

### Expected behavior

The user should be able to see and access **only the provider** for which they were granted object-level permissions.

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2025.10.1

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.