hluk / waiverdb / 23799209579

84%

master: %

Build Type

push

github

Committed by Lukas Holecek

Commit Message

Fall back to session ID token for OIDC group extraction

When authenticating via the OIDC browser login, the userinfo endpoint
may not include provider-specific group claims. This change:

- Requests the 'roles' OIDC scope so Keycloak includes realm_access
  in the ID token
- Configures the Keycloak realm roles mapper with id.token.claim=true
- Adds decoded access token JWT as a fallback source for OIDC claims
- Adds the admin user to the waiverdb-users role for functional tests
- Adds a Selenium functional test for browser-based OIDC group auth

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
JIRA: RHELWF-13972

Coverage Stats

263 of 368 branches covered (71.47%)

Branch coverage included in aggregate %.

45 of 66 new or added lines in 4 files covered. (68.18%)

10 existing lines in 1 file now uncovered.

2081 of 2443 relevant lines covered (85.18%)

0.85 hits per line