release-engineering / waiverdb / 24064920134

85%

Build Type

push

github

Committed by web-flow

Commit Message

Fall back to decoded access token for OIDC group extraction (#379)

When authenticating via the OIDC browser login, the ID token may not
include group claims (realm_access.roles) depending on the Keycloak
mapper configuration. Decode the access token JWT as a fallback source
for OIDC claims using authlib jwt.decode with JWKS verification.

- Skip other auth methods (e.g. Kerberos) when OIDC session is active
- Add decoded access token as a fallback in _oidc_session_sources()
- Use authlib jwt.decode with JWKS verification for access token decoding
- Request 'roles' OIDC scope for Keycloak compatibility
- Set id.token.claim=false in docker Keycloak to match production
- Add admin user to waiverdb-users role for functional tests
- Add Selenium functional test for browser-based OIDC group auth

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
JIRA: RHELWF-13972

Co-authored-by: Lukas Holecek <lholecek@redhat.com>

Coverage Stats

264 of 368 branches covered (71.74%)

Branch coverage included in aggregate %.

45 of 60 new or added lines in 3 files covered. (75.0%)

2 existing lines in 1 file now uncovered.

2081 of 2437 relevant lines covered (85.39%)

0.85 hits per line