fix: extract groups from id_token for generic OIDC providers#3597
Merged
crivetimihai merged 3 commits intoIBM:mainfrom Mar 23, 2026
Merged
fix: extract groups from id_token for generic OIDC providers#3597crivetimihai merged 3 commits intoIBM:mainfrom
crivetimihai merged 3 commits intoIBM:mainfrom
Conversation
77e1eb4 to
21e2ef6
Compare
shayro21
approved these changes
Mar 11, 2026
Member
|
Thanks @SharonDiskin — generic OIDC group extraction from id_token is needed for proper team/role mapping. Targeting 1.0.0. |
This was referenced Mar 20, 2026
…iders Okta and IBM Verify providers had no groups extraction in their _normalize_user_info handlers, and were excluded from the generic OIDC id_token groups merge in _get_user_info. This meant _apply_team_mapping always received an empty groups list for these providers, making SSO-based team assignment non-functional. Changes: - Add groups/roles extraction to Okta and IBM Verify _normalize_user_info handlers (configurable groups_claim via provider_metadata, roles merged into groups, non-string elements filtered — same pattern as Entra ID) - Include Okta and IBM Verify in the generic OIDC id_token groups merge path (previously excluded), with support for both configurable groups_claim and roles claims - Add roles claim merging to the generic OIDC _normalize_user_info path (previously only Entra ID merged roles) - Add sso_okta_scope and okta_group_mapping config settings for configurable Okta OIDC scopes and team mapping via environment - Update bootstrap to use configurable Okta scope, parse team mapping from JSON env var, and preserve DB scope/team_mapping on restart - Deduplicate groups across all generic/Okta/IBM Verify normalization Based on PR IBM#3597 by SharonDiskin. Closes IBM#3597 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
- Fix bootstrap scope preservation: only preserve DB scope when env provides the default value; a non-default env scope now correctly overrides a custom DB scope on restart - Handle single-string roles claims in Okta, IBM Verify, and generic OIDC normalization (previously only list values were merged) - Validate OKTA_GROUP_MAPPING is a JSON object after parsing; non-dict values (arrays, strings, numbers) now warn and fall back to empty - Add SSO_OKTA_SCOPE and OKTA_GROUP_MAPPING to .env.example Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
…hema Update configuration.md table, docs/config.schema.json, and docs/docs/config.schema.json with the two new Okta settings. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
b5abac8 to
0a902f8
Compare
Member
|
Rebased onto current main and expanded the implementation. Here's what changed: Core fixes:
Hardening (from review):
Docs:
Tests: 41 new tests, 265 total SSO tests passing. |
crivetimihai
approved these changes
Mar 23, 2026
Member
crivetimihai
left a comment
There was a problem hiding this comment.
Rebased, expanded, reviewed, and hardened. All 265 SSO tests pass. LGTM.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Generic OIDC providers like Okta include group/role claims in the id_token but
not in the /userinfo response. The existing code handles this for Entra ID and
Keycloak with provider-specific extraction, but the generic OIDC code path drops
groups entirely.
This PR adds two fixes:
_get_user_info: Extract groups and roles claims from the verified id_token
for generic OIDC providers (any provider not explicitly handled: Entra, Keycloak,
GitHub, Google). Only copies claims missing from the userinfo response to avoid
overwriting.
_normalize_user_info: Include groups in the normalized return dict for the
generic OIDC path. Supports a configurable groups_claim key via provider_metadata,
defaulting to groups. Also merges roles into the groups list, matching the Entra ID
behavior.
Without this fix, _apply_team_mapping always receives an empty groups list for
generic OIDC providers, so SSO-based team assignment never works.
Type of Change
Verification
Tested with Okta SSO on a live deployment:
Okta requirement: The groups claim must be configured on the ID Token (and
optionally Access Token) in the Okta Authorization Server Claims settings, with a
groups filter (e.g. Matches regex .*).
Checklist
Notes
that use a non-standard claim name
of groups for RBAC
the userinfo endpoint" --jq '.html_url'