fix: add groups claim mapper to prod j26-auth keycloak client - #52
fix: add groups claim mapper to prod j26-auth keycloak client#52hakan-persson wants to merge 2 commits into
Conversation
The prod j26-auth client was missing the Group Memberships protocol mapper that dev has, so prod tokens carried no `groups` claim. Add the oidc-group-membership-mapper (full paths, multivalued) to the prod keycloak-config ConfigMap so config-cli materialises it on import. Verified live in prod: the mapper is present on the running j26-auth client (claim.name=groups, full.path=true, all token types). This commit makes it durable — otherwise the next git-sourced ArgoCD sync re-runs the config-cli hook Job and strips the manually-applied mapper. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR makes the production j26-auth Keycloak client configuration declarative by adding the missing Group Memberships OIDC protocol mapper so prod-issued tokens include a groups claim (as intended), preventing future ArgoCD/config-cli syncs from removing the mapper.
Changes:
- Adds an
oidc-group-membership-mapperprotocol mapper to the prodj26-authclient. - Configures the mapper to emit full group paths as a multivalued
groupsclaim into access/ID/userinfo and introspection tokens.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Emits a `groups` claim (full group paths, multivalued) into the | ||
| # access/ID/userinfo tokens. Present in dev; add here so prod matches. |
There was a problem hiding this comment.
Good catch — fixed in 8a9c609. The comment now lists all four token types (access / ID / userinfo / introspection) and drops the unverifiable "Present in dev" reference, stating the reason the mapper exists instead. (Dev's copy lives in the separate j26-keycloak-scoutid repo, so it can't be substantiated from here.)
Address Copilot review on #52: the comment listed only access/ID/userinfo but the mapper also targets introspection tokens, and the 'Present in dev' reference can't be substantiated from this repo. State all four token types and the reason the mapper exists instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Regenerate 45-keycloak-config-configmap.yaml from the j26-keycloak-scoutid source repo so it carries BOTH the j26-booking roles (this PR) AND the j26-auth groups-claim mapper (PR #52) — the source has both. Without this, merging this PR would drop the groups mapper that is live in prod. Diff vs the source-repo file is only the namespace (j26-prod). Supersedes PR #52, which can now close as absorbed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Regenerate 45-keycloak-config-configmap.yaml from the j26-keycloak-scoutid source repo so it carries BOTH the j26-booking roles (this PR) AND the j26-auth groups-claim mapper (PR #52) — the source has both. Without this, merging this PR would drop the groups mapper that is live in prod. Diff vs the source-repo file is only the namespace (j26-prod). Supersedes PR #52, which can now close as absorbed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Auto-closed when #55 merged ( |
The prod
j26-authKeycloak client was missing the Group Memberships protocol mapper that the dev environment has, so prod tokens carried nogroupsclaim (reported as missing mappers).Fix
Adds
oidc-group-membership-mapperto thej26-authclient in the prodkeycloak-configConfigMap — full group paths, multivalued, emitted into all token types (access / ID / userinfo / introspection), claim namegroups. On the next config-cli import this materialises on the client.Already verified live in prod
The mapper has been applied and confirmed on the running
j26-authclient viakcadm(claim.name=groups,full.path=true); the config-cli import ran clean (no errors). This PR makes the fix durable — without it in git, the next git-sourced ArgoCD sync re-runs the config-cli hook Job with the old config and strips the manually-applied mapper.Scope / safety
k8s/app-manifest-prod/j26-keycloak-scoutid/45-keycloak-config-configmap.yaml.namespace: j26-prodpreserved; dev is untouched.🤖 Generated with Claude Code