hluk / waiverdb / 23845723617

84%

master: %

Build Type

push

github

Committed by Lukas Holecek

Commit Message

Fall back to decoded access token for OIDC group extraction

When authenticating via the OIDC browser login, the ID token may not
include group claims (realm_access.roles) depending on the Keycloak
mapper configuration. Decode the access token JWT as a fallback source
for OIDC claims using authlib jwt.decode with JWKS verification.

- Add decoded access token as a fallback in _oidc_session_sources()
- Use authlib jwt.decode with JWKS verification for access token decoding
- Request 'roles' OIDC scope for Keycloak compatibility
- Set id.token.claim=false in docker Keycloak to match production
- Add admin user to waiverdb-users role for functional tests
- Add Selenium functional test for browser-based OIDC group auth

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
JIRA: RHELWF-13972

Coverage Stats

263 of 366 branches covered (71.86%)

Branch coverage included in aggregate %.

43 of 57 new or added lines in 3 files covered. (75.44%)

12 existing lines in 1 file now uncovered.

2080 of 2435 relevant lines covered (85.42%)

0.85 hits per line