the last part might be fixed pretty soon in spring-projects/spring-security#14539, so we might want to put this on hold.

There was spring security 6.3.3 released
And issue was done
spring-projects/spring-security#4490
So, could be updates of this issue?

@Haarolean Hi, do I understand correctly that to support RBAC for AD you need to add an implementation of the LdapAuthoritiesPopulator interface based on DefaultActiveDirectoryAuthoritiesPopulator for the Active Directory user?

If yes, I am ready to work on this task.

@wernerdv not quite. Since we've already upgraded to a newer spring boot/security with the DefaultActiveDirectoryAuthoritiesPopulator I implemented, we most likely don't have to do anything else here.

Can anyone with AD verify this works on main tag?

@Haarolean I've tested with this configuration and RBAC with AD works as expected:

auth:
  type: LDAP
spring:
  ldap:
    urls: ldap://host:port
oauth2:
  ldap:
    activeDirectory: true
    activeDirectory.domain: <domain>  

rbac:
  roles:
    - name: "<AD group>"
       clusters:
         - LOCAL
       subjects:
         - provider: ldap_ad
           # type: group <-- works without it
           # value: <AD group> <-- works without it
       permissions:
         - resourse: topic
           value: ".*"
           actions: [ ... ]

But it only works if rbac.roles.name is group from AD.
If not, then /api/authorization returns empty permissions
https://github.com/kafbat/kafka-ui/blob/main/api/src/main/java/io/kafbat/ui/controller/AccessController.java#L37

And one more thing - you can do without subjects.value and subjects.type
it was a surprise to me at first :)

And one more thing - you can do without subjects.value and subjects.type

that's... not intended. Let's fix this within #716.

But it only works if rbac.roles.name is group from AD.

What makes you think so? In RbacLdapAuthoritiesExtractor.java#L41 we match RBAC subjects with your AD groups and collect RBAC roles if there's a match.

https://github.com/kafbat/kafka-ui/blob/main/api/src/main/java/io/kafbat/ui/service/rbac/extractor/RbacLdapAuthoritiesExtractor.java#L39

It seems you need to handle the filtering for Provider.LDAP_AD.

@wernerdv yeah I was wondering the same, how could it work for you