fix(auth): restore get_roles() for Okta — API key creation broken under AUTH_TYPE=OKTA#6254
Merged
shahargl merged 1 commit intoApr 16, 2026
Conversation
OktaIdentityManager.get_roles() was overriding the base class with return [] — causing the role dropdown in Settings → API Keys to render "No options" and blocking API key creation entirely under AUTH_TYPE=OKTA. Predefined roles (admin, noc, webhook, workflowrunner) are defined locally in rbac.py and require no Okta API call, so the base class implementation is correct as-is. Remove the stub override so it falls through to BaseIdentityManager.get_roles(). Also fix DEFAULT_ROLE_NAME in OktaAuthVerifier: "user" is not a valid role in rbac.py and causes a 403 for tokens without an explicit role claim. Change to "noc" (least-privileged predefined role).
dosubot
Bot
added
size:XS
Contributor
|
🌟 Fantastic work @ahbeigi! Your very first PR to keep has been merged! 🎉🥳 You've just taken your first step into open-source, and we couldn't be happier to have you onboard. 🙌 For any support, feel free to reach out on the community: https://slack.keephq.dev. Happy coding! 👩💻👨💻 |
wsimon1982
pushed a commit
to wsimon1982/keep
that referenced
this pull request
May 12, 2026
…er AUTH_TYPE=OKTA (keephq#6254) Co-authored-by: Ali Hassan-Beigi <ali.hassan-beigi@cloudimperiumgames.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OktaIdentityManager.get_roles() was overriding the base class with return [] — causing the role dropdown in Settings → API Keys to render "No options" and blocking API key creation entirely under AUTH_TYPE=OKTA.
Predefined roles (admin, noc, webhook, workflowrunner) are defined locally in rbac.py and require no Okta API call, so the base class implementation is correct as-is. Remove the stub override so it falls through to BaseIdentityManager.get_roles().
Also fix DEFAULT_ROLE_NAME in OktaAuthVerifier: "user" is not a valid role in rbac.py and causes a 403 for tokens without an explicit role claim. Change to "noc" (least-privileged predefined role).
Closes #6253
📑 Description
get_roles()override inOktaIdentityManager— falls through toBaseIdentityManager.get_roles()which correctly returns predefined roles fromrbac.pyDEFAULT_ROLE_NAMEinOktaAuthVerifierfrom"user"to"noc"✅ Checks
ℹ Additional Information
The same stub pattern may be present in other SSO identity managers (
KEYCLOAK,AZUREAD,ONELOGIN) — worth a follow-up audit of theirget_roles()overrides.