[2024.06.0] Cannot create groups with the same name

[marcportabellaclotet-mt]

Description:

In the latest version of Authentik IDP (2024.06.0), attempting to create multiple groups with the same name results in an error message stating that the field must be unique. This behavior differs from version 2024.04.0, where it was possible to create multiple groups with the same name without any issues.

Steps to Reproduce:

1. Navigate to the groups creation page in the Authentik IDP UI.
2. Create a group with a specific name (e.g., "TestGroup").
3. Attempt to create another group with the same name ("TestGroup").
4. Observe the error message: "The field must be unique."

Expected Behavior:
It should be possible to create multiple groups with the same name, as was the case in version 2024.04.0.

Actual Behavior:
The UI returns an error message indicating that the group name must be unique, preventing the creation of multiple groups with the same name.

Screenshots:

Environment:

• Authentik IDP version: 2024.06.0
• Browser: [ Firefox]
• OS: [Linux]

Additional Context:
This change in behavior might be related to recent updates in version 2024.06.0. It would be helpful to understand whether this is an intended change or a bug. If it's an intended change, documentation or release notes highlighting this new constraint would be appreciated.

---

[BeryJu]

This is intended, we'll need to add this as a "breaking" change to the release notes @rissson @tanberry

[marcportabellaclotet-mt]

Thanks for clarifying @BeryJu .
I still think that having groups with the same name could be useful in some scenarios, for example using nested groups.
Is there any technical or design reason which cause the removal of this feature?
Without this feature, nesting groups may be less useful, and users will end up using a flat group setup..

This feature is also beneficial for mapping groups to Apps. For instance, OIDC apps obtain group names via claims. If group names are unique, OIDC applications may end up with unnatural group names, such as /org/division/administrators instead of simply administrators. While this issue can be resolved through policies, it requires additional effort.

[BeryJu]

@marcportabellaclotet-mt the main reason fir this is compatibility with external systems (it was changed as part of adding GWS support), as with a lot of external systems that are also identity providers (like google workspace and entra), group names are unique. Also with how groups are currently returned in scopes and in the API it can be quite difficult to differentiate two different groups with the same name (when not using the UUID). This might be something we'll revisit in the future or make configurable in the future

[marcportabellaclotet-mt]

That makes a lot of sense.
Making this configurable could be useful for different scenarios.
Thanks for the explanation @BeryJu .