Michael Schröder can you check if ingress solution that you are using is defining this header policy ?
For example, nginx there this: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#cookie-affinity But by default if there is no session-cookie-samesite defined.
Made tests using lasted chart helm version, and XWiki version 17.4.4, and the latest extension version. Here are the OIDC preferences that are used on KC with UCS:
customConfigs: xwiki.properties: oidc.clientid: "client-id" oidc.secret: s3cr3t oidc.endpoint.authorization: "https://domain/realms/master/protocol/openid-connect/auth" oidc.endpoint.token: "https://domain/realms/master/protocol/openid-connect/token" oidc.endpoint.userinfo: "https://domain/realms/master/protocol/openid-connect/userinfo" oidc.endpoint.logout: "https://domain/realms/master/protocol/openid-connect/logout" oidc.scope: "openid,profile,email" oidc.user.nameFormater: "${oidc.user.preferredUsername._clean}" oidc.user.subjectFormater: "${oidc.user.preferredUsername._clean}" oidc.idtokenclaims: "id_token" oidc.userinfoclaims: "secretary,organisation,mobileTelephoneNumber,employeeType" oidc.userinforefreshrate: "21600000"
