hluk / waiverdb / 23886806496

84%

master: %

Build Type

push

github

Committed by hluk

Commit Message

Fall back to decoded access token for OIDC group extraction

When authenticating via the OIDC browser login, the ID token may not
include group claims (realm_access.roles) depending on the Keycloak
mapper configuration. Decode the access token JWT as a fallback source
for OIDC claims using authlib jwt.decode with JWKS verification.

- Skip other auth methods (e.g. Kerberos) when OIDC session is active
- Add decoded access token as a fallback in _oidc_session_sources()
- Use authlib jwt.decode with JWKS verification for access token decoding
- Request 'roles' OIDC scope for Keycloak compatibility
- Set id.token.claim=false in docker Keycloak to match production
- Add admin user to waiverdb-users role for functional tests
- Add Selenium functional test for browser-based OIDC group auth

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
JIRA: RHELWF-13972

Coverage Stats

264 of 368 branches covered (71.74%)

Branch coverage included in aggregate %.

45 of 60 new or added lines in 3 files covered. (75.0%)

14 existing lines in 1 file now uncovered.

2081 of 2437 relevant lines covered (85.39%)

0.85 hits per line