• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

hluk / waiverdb

Build:
Build:
LAST BUILD BRANCH: fix-oidc-groups
DEFAULT BRANCH: master
Repo Added 02 May 2022 06:52AM UTC
Token FGaogxfc451EsLs4fYqx2NtYxBARlHcMv regen
Build 254 Last
Files 48
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix-oidc-groups
branch: SELECT
CHANGE BRANCH
x
Sync Branches
  • No branch selected
  • add-image-expiration
  • auth-errors
  • avoid-updating-python-version
  • bump-base-image
  • dependabot/pip/cryptography-37.0.2
  • dependabot/pip/cryptography-37.0.4
  • dependabot/pip/cryptography-38.0.1
  • dependabot/pip/cryptography-38.0.3
  • dependabot/pip/flask-migrate-4.0.0
  • dependabot/pip/flask-migrate-4.0.3
  • dependabot/pip/mock-5.0.0
  • dependabot/pip/mock-5.0.1
  • dependabot/pip/pip-22.3.1
  • dependabot/pip/setuptools-67.0.0
  • dependabot/pip/sphinx-6.0.0
  • dependabot/pip/sphinx-6.1.2
  • dependabot/pip/sphinx-6.1.3
  • dependabot/pip/sphinxcontrib-httpdomain-1.8.1
  • dependabot/pip/sqlalchemy-1.4.37
  • dependabot/pip/sqlalchemy-1.4.39
  • dependabot/pip/sqlalchemy-1.4.40
  • dependabot/pip/sqlalchemy-1.4.41
  • dependabot/pip/sqlalchemy-1.4.42
  • dependabot/pip/sqlalchemy-1.4.44
  • dependabot/pip/sqlalchemy-1.4.45
  • dependabot/pip/sqlalchemy-1.4.46
  • dependabot/pip/stomp-py-8.1.0
  • dependabot/pip/werkzeug-lt-2.3
  • dependabot/pip/wheel-0.38.4
  • docker-compose-sync
  • drop-flask-restful
  • drop-waiverdb-cli
  • fix-about-version
  • fix-docs-build
  • fix-duplicate-session
  • fix-example-subject-type
  • fix-flaky-test
  • fix-lock-file-maintenance-schedule
  • fix-migrations
  • fix-new-sqlalchemy
  • fix-oidc-groups
  • fix-oidc-token
  • fix-stomp-version
  • fix-tests
  • fix-tox
  • fix-tracing
  • fix-werkzeug
  • hatch
  • kafka
  • keycloak
  • konflux
  • master
  • monthly-renovate
  • oidc-groups
  • oidc-login-form
  • onboard-konflux
  • pdm
  • permission-include-following
  • poetry
  • postgres-update
  • pydantic2
  • python-3.11
  • python-3.12-for-renovatebot
  • python-3.13
  • refactor-oidc-token
  • renovate
  • renovate-lock
  • revert-werkzeug
  • secure-cookies
  • show-permissions-warning
  • simplify-log-config
  • split-permission-users-groups
  • sync-with-greenwave
  • update
  • update-authlib
  • update-dependencies
  • update-dependencies-monthly
  • update-opentelemetry
  • update-otel
  • update-pydantic
  • update-readthedocs
  • uv
  • uv-3

02 Apr 2026 06:03AM UTC coverage: 83.601%. Remained the same
23886806496

push

github

hluk
Fall back to decoded access token for OIDC group extraction

When authenticating via the OIDC browser login, the ID token may not
include group claims (realm_access.roles) depending on the Keycloak
mapper configuration. Decode the access token JWT as a fallback source
for OIDC claims using authlib jwt.decode with JWKS verification.

- Skip other auth methods (e.g. Kerberos) when OIDC session is active
- Add decoded access token as a fallback in _oidc_session_sources()
- Use authlib jwt.decode with JWKS verification for access token decoding
- Request 'roles' OIDC scope for Keycloak compatibility
- Set id.token.claim=false in docker Keycloak to match production
- Add admin user to waiverdb-users role for functional tests
- Add Selenium functional test for browser-based OIDC group auth

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>
JIRA: RHELWF-13972

264 of 368 branches covered (71.74%)

Branch coverage included in aggregate %.

45 of 60 new or added lines in 3 files covered. (75.0%)

14 existing lines in 1 file now uncovered.

2081 of 2437 relevant lines covered (85.39%)

0.85 hits per line

Relevant lines Covered
Build:
Build:
2437 RELEVANT LINES 2081 COVERED LINES
0.85 HITS PER LINE
Source Files on master
  • Tree
  • List 48
  • Changed 1
  • Source Changed 0
  • Coverage Changed 1
Coverage ∆ File Lines Relevant Covered Missed Hits/Line Branch Hits Branch Misses

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
23886806496 fix-oidc-groups Fall back to decoded access token for OIDC group extraction When authenticating via the OIDC browser login, the ID token may not include group claims (realm_access.roles) depending on the Keycloak mapper configuration. Decode the access token JWT... push 02 Apr 2026 06:14AM UTC hluk github
83.6
23852426946 fix-oidc-groups Fall back to decoded access token for OIDC group extraction When authenticating via the OIDC browser login, the ID token may not include group claims (realm_access.roles) depending on the Keycloak mapper configuration. Decode the access token JWT... push 01 Apr 2026 01:59PM UTC Lukas Holecek github
83.6
23845723617 fix-oidc-groups Fall back to decoded access token for OIDC group extraction When authenticating via the OIDC browser login, the ID token may not include group claims (realm_access.roles) depending on the Keycloak mapper configuration. Decode the access token JWT... push 01 Apr 2026 11:13AM UTC Lukas Holecek github
83.65
23800653172 fix-oidc-groups Fall back to decoded access token for OIDC group extraction When authenticating via the OIDC browser login, the ID token may not include group claims (realm_access.roles) depending on the Keycloak mapper configuration. Decode the access token JWT... push 31 Mar 2026 01:47PM UTC hluk github
83.43
23799209579 fix-oidc-groups Fall back to session ID token for OIDC group extraction When authenticating via the OIDC browser login, the userinfo endpoint may not include provider-specific group claims. This change: - Requests the 'roles' OIDC scope so Keycloak includes rea... push 31 Mar 2026 01:15PM UTC Lukas Holecek github
83.39
23795864800 fix-oidc-groups Fall back to session ID token for OIDC group extraction When authenticating via the OIDC browser login, the userinfo endpoint may not include provider-specific group claims. Try the decoded ID token stored in the session as a fallback before atte... push 31 Mar 2026 11:54AM UTC hluk github
84.03
23751118189 oidc-groups Get groups from OIDC before falling back to LDAP JIRA: RHELWF-13972 Assisted-by: Claude Code push 30 Mar 2026 02:52PM UTC hluk github
83.72
23593766024 oidc-groups Get groups from OIDC before falling back to LDAP JIRA: RHELWF-13972 Assisted-by: Claude Code push 26 Mar 2026 12:17PM UTC hluk github
83.81
23593255390 oidc-groups Get groups from OIDC before falling back to LDAP JIRA: RHELWF-13972 Assisted-by: Claude Code push 26 Mar 2026 12:04PM UTC hluk github
83.74
23441416364 oidc-groups Get groups from OIDC before falling back to LDAP JIRA: RHELWF-13972 Assisted-by: Claude Code push 23 Mar 2026 02:07PM UTC hluk github
83.66
See All Builds (141)

Badge your Repo: waiverdb

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.

Could not find badge in README.

Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh
  • Settings
  • Repo on GitHub
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc