Upgrade problems with authentication and Teams


We were using Concourse 3.14.1, deployed on GKE using the official stable helm chart. Today I decided to upgrade to the latest version, 4.2.1, but I’m having some issues.

I seem to have added all users successfully to Concourse, I can see them in the database inside teams as being inside the group main, with auth {"groups":["github:[organization]","github:[organization:team]"],"users":["github:[user]","local:test"]}

I replaced the user, organization and team here just to show that the format seems to be the correct one.

When I was using 3.14.1 I had a few pipelines, which seem to now belong to the main group, so I figured it was best to have the users in my organization be inside the main group (since as far as I know there is no tool to migrate the pipelines to a new team). Now on 4.2.1, whenever I log in as a user inside that organization, I can’t see anything.

I am logging to the main team using fly --target ci login --team-name main --concourse-url https://ci.url.com but with fly -t ci teams -d I can’t see anyone. I don’t want to do the allow all users option, because as far as I could tell from here https://github.com/concourse/concourse/issues/2721, this option will be removed soon, right?

Can anyone point me to the right way?

Also, one potential issue. Altho I’m getting error: forbidden on fly on most team operations, I seem to be able to see the workers with fly -t ci workers. Is this intended?


For some reason, after logging in the CLI with the test local user (which was correctly detected as being the main user), then adding the github user, organization and team using fly, It started working again. Not sure of what happened.

Update 2

Now Concourse has again failed to show me and my team as a users from Main. Not sure what to do anymore =(


I got error: forbidden when doing fly set-pipeline in concourse 4.2.1 even though team was created. The solution for me was to logout and login again through web. Need to, each time setup a new team.