hluk / waiverdb / 23800653172

84%

master: %

Build Type

push

github

Committed by hluk

Commit Message

Fall back to decoded access token for OIDC group extraction

When authenticating via the OIDC browser login, the ID token may not
include group claims (realm_access.roles) depending on the Keycloak
mapper configuration. Decode the access token JWT as a fallback source
for OIDC claims using authlib utilities.

- Add decoded access token as a fallback in _oidc_session_sources()
- Use authlib extract_segment/json_loads instead of custom JWT parsing
- Request 'roles' OIDC scope for Keycloak compatibility
- Set id.token.claim=false in docker Keycloak to match production
- Add admin user to waiverdb-users role for functional tests
- Add Selenium functional test for browser-based OIDC group auth

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
JIRA: RHELWF-13972

Coverage Stats

263 of 368 branches covered (71.47%)

Branch coverage included in aggregate %.

47 of 67 new or added lines in 4 files covered. (70.15%)

13 existing lines in 1 file now uncovered.

2083 of 2444 relevant lines covered (85.23%)

0.85 hits per line