---
title: "Manage groups"
description: "When using OIDC for authentication, you can leverage user groups defined in your identity provider (like Keycloak, Okta, or Auth0) to manage permissions in Weaviate. The user's group memberships are passed to Weaviate in the OIDC token."
url: https://docs.weaviate.io/weaviate/configuration/rbac/manage-groups
---

# Manage groups

> [!NOTE]
>
> **Added in `v1.33`**

When using [OIDC](https://docs.weaviate.io/deploy/configuration/oidc) for authentication, you can leverage user groups defined in your identity provider (like Keycloak, Okta, or Auth0) to manage permissions in Weaviate. The user's group memberships are passed to Weaviate in the OIDC token.

You can then assign Weaviate roles directly to these **OIDC groups**. Any user who is a member of that group will automatically inherit the permissions of the assigned roles. This is a powerful way to manage access for large teams without assigning roles to each user individually.

On this page, you will find examples of how to programmatically **manage OIDC groups** and their associated roles.

## Group management

### Create a group

Weaviate has no API to create a group, and groups are not stored in Weaviate. You create and populate a group in your identity provider, which then sends the user's group memberships to Weaviate in the OIDC token.

Weaviate becomes aware of a group the first time you [assign a role to it](https://docs.weaviate.io/weaviate/configuration/rbac/manage-groups#assign-roles-to-an-oidc-group). Until then the group name is unknown to Weaviate, even if your identity provider already uses it.

### Assign roles to an OIDC group

You can assign one or more Weaviate roles to an OIDC group. Any user belonging to this group will inherit the roles' permissions.

This example assigns the `testRole` and `viewer` roles to the `/admin-group`.

**Python**

```py
admin_client.groups.oidc.assign_roles(
    group_id="/admin-group", role_names=["testRole", "viewer"]
)
```

**JavaScript/TypeScript**

```ts
await adminClient.groups.oidc.assignRoles(
    "/admin-group", ["testRole", "viewer"]
);
```

**Go (v6)**

```go
err := client.Groups.AssignRoles(ctx, rbac.AssignRolesOptions{
  ID:    "/admin-group",
  Roles: []string{"testRole", "viewer"},
})
if err != nil {
  // handle error
  panic(err)
}
```

**Java**

```java
client.groups.assignRoles(testGroup, testRole, "viewer");
```

**C#**

```csharp
await client.Groups.Oidc.AssignRoles(testGroup, new[] { testRole, "viewer" });
```

### Revoke roles from an OIDC group

You can revoke one or more roles from a specific OIDC group.

This example removes the `testRole` and `viewer` roles from the `/admin-group`.

**Python**

```py
admin_client.groups.oidc.revoke_roles(
    group_id="/admin-group", role_names=["testRole", "viewer"]
)
```

**JavaScript/TypeScript**

```ts
await adminClient.groups.oidc.revokeRoles(
    "/admin-group", ["testRole", "viewer"]
);
```

**Go (v6)**

```go
err := client.Groups.RevokeRoles(ctx, rbac.RevokeRolesOptions{
  ID:    "/admin-group",
  Roles: []string{"testRole"},
})
if err != nil {
  // handle error
  panic(err)
}
```

**Java**

```java
client.groups.revokeRoles(testGroup, testRole, "viewer");
```

**C#**

```csharp
await client.Groups.Oidc.RevokeRoles(testGroup, new[] { testRole, "viewer" });
```

### List roles assigned to an OIDC group

Retrieve a list of all roles that have been assigned to a specific OIDC group.

**Python**

```py
group_roles = oidc_admin_client.groups.oidc.get_assigned_roles(
    group_id="/admin-group", include_permissions=True
)
print(f"Roles assigned to '/admin-group': {list(group_roles.keys())}")
```

**JavaScript/TypeScript**

```ts
const groupRoles = await oidcAdminClient.groups.oidc.getAssignedRoles(
    "/admin-group", true
);
console.log(`Roles assigned to '/admin-group': ${Object.keys(groupRoles)}`);
```

**Go (v6)**

```go
roles, err := client.Groups.AssignedRoles(ctx, rbac.AssignedRolesOptions{
  ID:                 "/admin-group",
  IncludePermissions: true,
})
if err != nil {
  // handle error
  panic(err)
}
for _, role := range roles {
  fmt.Printf("%s\n", role.ID)
}
```

**Java**

```java
List<Role> groupRoles = client.groups.assignedRoles(testGroup,
    g -> g.includePermissions(true));
for (Role role : groupRoles) {
  System.out.println(role.name());
}
```

**C#**

```csharp
var groupRoles = await client.Groups.Oidc.GetRoles(testGroup, includeFullRoles: true);
foreach (var role in groupRoles)
{
    Console.WriteLine(role.Name);
}
```

**Example results**

```text
Roles assigned to '/admin-group': ['testRole', 'viewer']
```

### List all known OIDC groups

This example shows how to get a list of all OIDC groups that Weaviate is aware of. Weaviate learns about a group when a role is first assigned to it.

**Python**

```py
known_groups = admin_client.groups.oidc.get_known_group_names()
print(f"Known OIDC groups ({len(known_groups)}): {known_groups}")
```

**JavaScript/TypeScript**

```ts
const knownGroups = await adminClient.groups.oidc.getKnownGroupNames();
console.log(`Known OIDC groups (${knownGroups.length}): ${knownGroups}`);
```

**Go (v6)**

```go
// Coming soon
```

**Java**

```java
List<String> knownGroups = client.groups.knownGroupNames();
System.out.println("Known OIDC groups (" + knownGroups.size() + "): " + knownGroups);
```

**C#**

```csharp
var knownGroups = await client.Groups.Oidc.GetKnownGroupNames();
Console.WriteLine($"Known OIDC groups ({knownGroups.Count()}): {string.Join(", ", knownGroups)}");
```

**Example results**

```text
Known OIDC groups (3): ['/viewer-group', '/admin-group', '/my-test-group']
```

### List groups assigned to a role

Retrieve a list of all groups that have been assigned a specific role.

This example shows which groups have the `testRole` assigned to them.

**Python**

```py
group_assignments = admin_client.roles.get_group_assignments(role_name="testRole")
print(f"Groups assigned to role 'testRole':")
for group in group_assignments:
    print(f"  - Group ID: {group.group_id}, Type: {group.group_type}")
```

**JavaScript/TypeScript**

```ts
const groupAssignments = await adminClient.roles.getGroupAssignments("testRole");
console.log("Groups assigned to role 'testRole':");
for (const group of groupAssignments) {
    console.log(`  - Group ID: ${group.groupID}, Type: ${group.groupType}`);
}
```

**Go (v6)**

```go
groups, err := client.Roles.GroupAssignments(ctx, "testRole")
if err != nil {
  // handle error
  panic(err)
}
for _, g := range groups {
  fmt.Printf("group ID: %s, type: %s\n", g.ID, g.Type)
}
```

**Java**

```java
List<GroupAssignment> groupAssignments = client.roles.groupAssignments(testRole);
System.out.println("Groups assigned to role '" + testRole + "':");
for (GroupAssignment assignment : groupAssignments) {
  System.out.println("  - Group ID: " + assignment.groupId() + ", Type: "
      + assignment.groupType());
}
```

**C#**

```csharp
var groupAssignments = await client.Roles.GetGroupAssignments(testRole);
Console.WriteLine($"Groups assigned to role '{testRole}':");
foreach (var assignment in groupAssignments)
{
    Console.WriteLine($"  - Group ID: {assignment.GroupId}, Type: {assignment.GroupType}");
}
```

**Example results**

```text
Groups assigned to role 'testRole':
  - Group ID: /admin-group, Type: oidc
```

## Further resources

- [RBAC: Overview](https://docs.weaviate.io/weaviate/configuration/rbac)
- [RBAC: Configuration](https://docs.weaviate.io/deploy/configuration/configuring-rbac)
- [RBAC: Manage roles](https://docs.weaviate.io/weaviate/configuration/rbac/manage-roles)
- [RBAC: Manage users](https://docs.weaviate.io/weaviate/configuration/rbac/manage-users)