UserInfoFetcher (OPA) does not collect all available Entra-Groups for policy checks

[AndiS500]

Affected Stackable version

Release 26.3

Affected OpenPolicyAgent version

policyagent/opa:1.12.2

Current and expected behavior

The Entra backend of the OPA user-info-fetcher currently requests
/v1.0/users/{id}/memberOf and deserializes only the first response page.
The response model does not handle @odata.nextLink. Users with many Entra
group memberships can therefore receive incomplete group lists.

Possible solution

pub fn group_info(&self, user: &str) -> Url {
let mut user_info_url = self.user_info_endpoint_url.clone();

// Nur Gruppen abrufen, nicht alle directoryObjects.
user_info_url.set_path(&format!(
    "/v1.0/users/{user}/memberOf/microsoft.graph.group"
));

// Weniger Payload, größere Seiten.
// Wichtig: Paging trotzdem weiter auswerten, da $top keine Vollständigkeit garantiert.
user_info_url.set_query(Some("$select=displayName&$top=999"));

user_info_url

}

Please update the Entra backend to follow @odata.nextLink until exhausted.

Optionally restrict the request to:
/v1.0/users/{id}/memberOf/microsoft.graph.group?$select=displayName&$top=999

Additional context

No response

Environment

No response

Would you like to work on fixing this bug?

None

[lfrancke]

Thanks for raising this. That is a bug and we're working on a fix. We consider it important so we want to get it into our SDP 26.7 release which is due to be out ~next week.

[AndiS500]

Thanks! Please let me know if we shall test a possible fix in our environement.

[lfrancke]

Release Notes

Entra: complete group memberships for policy checks

Previously, the OPA user-info-fetcher's Microsoft Entra backend read only the first page of a user's group memberships, so users belonging to many groups received an incomplete group list. With this release, the Entra backend follows the result pages until every page has been retrieved (bounded to 100 pages as a safeguard).

user-info-fetcher: outbound request timeouts

Previously, the user-info-fetcher's outbound HTTP requests (to Microsoft Entra, Keycloak, and the XFSC AAS) had no timeout, so a slow or unresponsive backend could make a request hang indefinitely and stall user-info lookups. With this release, every outbound request has a 60-second overall timeout and a 15-second connection timeout.