rusackas commented on PR #38092:
URL: https://github.com/apache/superset/pull/38092#issuecomment-4910133052
Thanks @albundy83, this is a useful page... we don't have a good Keycloak
example, and PKCE plus group mapping is exactly what people ask about. Couple
of accuracy things worth fixing so folks don't hit a wall following it:
The `OIDC_ISSUER` still has `/auth` in the path, which Keycloak dropped in
17+... on any current Keycloak that URL 404s the discovery metadata. Worth
switching to `.../realms/MYREALM` with a note that older versions need the
`/auth` prefix.
And the group mapping: Keycloak doesn't emit a `groups` claim by default,
and once you add the mapper it comes back as a full path with a leading slash
(`/my_group`) unless you turn that off. As written, `groups =
data.get('groups', [])` would come back empty and the user gets no roles...
which is the thing the page is trying to solve. A sentence on adding the Group
Membership mapper (full path off) or stripping the leading `/` would close that
gap.
Happy to stamp it once those are in. Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
