An OpenShift cluster uses an external identity provider (IdP). A user named 'alex@example.com' has successfully logged in via the web console. You need to verify which groups this user belongs to from the command line as an administrator. Which command provides this information?
Trap 1: oc auth can-i --list --user=alex@example.com
This command lists permissions for the user, not their group memberships.
Trap 2: oc get groups --user=alex@example.com
The 'oc get groups' command does not support a '--user' filter flag directly.
Trap 3: oc get identity alex@example.com
An identity resource maps the external provider identifier to the internal user object, but does not list group memberships.
- A
oc auth can-i --list --user=alex@example.com
Why it fails: This command lists permissions for the user, not their group memberships.
- B
oc get groups --user=alex@example.com
Why it fails: The 'oc get groups' command does not support a '--user' filter flag directly.
- C
oc get identity alex@example.com
Why it fails: An identity resource maps the external provider identifier to the internal user object, but does not list group memberships.
- D
oc describe user alex@example.com
`oc describe user` reads the User object's annotations, where OpenShift records the group memberships asserted by the external IdP at login. Since alex@example.com authenticated successfully, those groups are already synced, satisfying the requirement to verify memberships from the command line without querying the IdP directly.