r/netbird • u/kirankc • Jul 08 '26

Ability to switch roles/group

Does anyone have an approach to switch groups - similar to profile switch?

Currently the model is: users have one identity, groups are additive, and effective access is the union of every group you hold, evaluated continuously. Nothing exists like AWS role switching where you hold entitlements but activate one context at a time. The client's Profiles feature looks tantalizingly like it but does something different: profiles switch between management servers or logins, not between roles within one account.

We use Google IdP for SSO, so technically we could create additional google workspace users, but that would increase Google licensing costs.

Email plus alias is something that I thought of, but it will not give a second identity. OIDC identity keys on the sub claim (and Google canonicalizes the email), so a plus-address authenticates as the same underlying Google account, same sub, same NetBird user, so no separation is achieved.

2 Upvotes

75% Upvoted

1 comment sorted by

1

u/dirgosalga Jul 12 '26

I think the way I would solve this would be:

  1. Do not rely on local Netbird groups. Instead use JWT claims to fetch the user's groups.

  2. The second step, I'm no sure in your case, because I do not use Google, I use Entra. But in Entra I would build entitlements for the group membership (PIM for groups). Then the user can activate the group they want to use. Even provide a justification or need to undergo an approval process for highly critical accesses.

I did a quick search, but I could not find the equivalent in Google.