Fall back to decoded access token for OIDC group extraction#379
Merged
hluk merged 1 commit intorelease-engineering:masterfrom Apr 7, 2026
Merged
Fall back to decoded access token for OIDC group extraction#379hluk merged 1 commit intorelease-engineering:masterfrom
hluk merged 1 commit intorelease-engineering:masterfrom
Conversation
hluk
force-pushed
the
fix-oidc-groups
branch
3 times, most recently
from
c8b58e2 to
f9d058a
Compare
hluk
changed the title
Member
Author
|
Tested in dev. |
When authenticating via the OIDC browser login, the ID token may not include group claims (realm_access.roles) depending on the Keycloak mapper configuration. Decode the access token JWT as a fallback source for OIDC claims using authlib jwt.decode with JWKS verification. - Skip other auth methods (e.g. Kerberos) when OIDC session is active - Add decoded access token as a fallback in _oidc_session_sources() - Use authlib jwt.decode with JWKS verification for access token decoding - Request 'roles' OIDC scope for Keycloak compatibility - Set id.token.claim=false in docker Keycloak to match production - Add admin user to waiverdb-users role for functional tests - Add Selenium functional test for browser-based OIDC group auth Assisted-by: Claude Opus 4.6 <noreply@anthropic.com> JIRA: RHELWF-13972
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When authenticating via the OIDC browser login, the ID token may not
include group claims (realm_access.roles) depending on the Keycloak
mapper configuration. Decode the access token JWT as a fallback source
for OIDC claims using authlib jwt.decode with JWKS verification.
Assisted-by: Claude Opus 4.6 noreply@anthropic.com
JIRA: RHELWF-13972