There is 1 comment.
 
 
OpenId Connect / cid:jira-generated-image-avatar-3122031b-a2e3-4ba6-9d06-33dc0ad7ad23 OIDC-179 Open

Cannot login when the user is a member of too many groups

 
View issue   ยท   Add comment
 

1 comment

 
cid:jira-generated-image-avatar-ee3a2475-5680-4544-bf48-c9fbb64ec38e Daniel Beland on 07/Jun/24 16:18
 

No call is sent to KeyCloak that I can see (Keycloak on debug mode does not tell me a call was made at all).

From what I can understand of the code, the access token is retrieved here to make the call to get the user info token.

https://github.com/xwiki-contrib/oidc/blob/5117e91353a739f31b93dc0cf2dce0a4203c84e3/oidc-authenticator/src/main/java/org/xwiki/contrib/oidc/auth/internal/OIDCUserManager.java#L182

 

Anyway as I said if I remove the groups from the access token it works, so I think this proves the error is not from Keycloak...

In XWiki I add the scope "microprofile-jwt", login fails. I remove the scope, login works, I add the scope, login fails... No change in Keycloak... so something breaks on the XWiki side...