From c13e9c7023efc9a8a96c7c32caf9fd026852ab6c Mon Sep 17 00:00:00 2001 From: Alex Seymour Date: Tue, 2 Dec 2025 14:01:41 +0100 Subject: [PATCH] Clarify JSON array format for OIDC groups and full_group_path claims Clarify JSON array format for OIDC groups and full_group_path claims, after a recent case where an issue occurred as a result of the groups claim formatted as a comma-separated string --- .../authentication-config/configure-generic-oidc.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md index ed3b5ed0b39..4b9685729d0 100644 --- a/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md +++ b/docs/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config/configure-generic-oidc.md @@ -35,6 +35,12 @@ In your IdP, create a new client with the settings below: In the new OIDC client, create mappers to expose the user's fields. +:::note + +The `groups` and `full_group_path` claims generated by the Groups and Group Path mappers, which you create within the OIDC client in your Identity Provider, should be JSON arrays, e.g. `"groups":["admins","devs","qa"]` and `"full_group_path":["/admins","/devs","/qa"]`. + +::: + 1. Create a new `Groups Mapper` with the settings below: Setting | Value @@ -153,4 +159,4 @@ In some cases, the "Invalid grant_type" error message may be misleading and is a ## Configuring OIDC Single Logout (SLO) - \ No newline at end of file +