Re: [PR] docs(auth): add Keycloak PKCE, logout and group-mapping example [superset]

["rusackas (via GitHub)" <gi...@apache.org>]

rusackas commented on PR #38092:
URL: https://github.com/apache/superset/pull/38092#issuecomment-4910133052

   Thanks @albundy83, this is a useful page... we don't have a good Keycloak example, and PKCE plus group mapping is exactly what people ask about. Couple of accuracy things worth fixing so folks don't hit a wall following it:
   
   The `OIDC_ISSUER` still has `/auth` in the path, which Keycloak dropped in 17+... on any current Keycloak that URL 404s the discovery metadata. Worth switching to `.../realms/MYREALM` with a note that older versions need the `/auth` prefix.
   
   And the group mapping: Keycloak doesn't emit a `groups` claim by default, and once you add the mapper it comes back as a full path with a leading slash (`/my_group`) unless you turn that off. As written, `groups = data.get('groups', [])` would come back empty and the user gets no roles... which is the thing the page is trying to solve. A sentence on adding the Group Membership mapper (full path off) or stripping the leading `/` would close that gap.
   
   Happy to stamp it once those are in. Thanks!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org