Skip to content

Conversation

othman-essabir
Copy link

@othman-essabir othman-essabir commented Oct 16, 2025

The current implementation lacks support for parsing and handling array structures in OIDC claims, which severely limits SSO integration with OIDC providers like Keycloak. Previously, array values in OIDC claims were raising "converting claim" errors. The parsing failed to properly map user roles from array-based claims.

Description

  • Added type case for []interface{} that marshals arrays to JSON string format.
  • Enables proper processing of multi-value OIDC claims such as roles.
  • Maintains backward compatibility while extending support for array structures.

Testing & Reproduction Steps

Before fix

Trying to map the roles claim results in a 500 error:

http: request failed: method=POST path=/v1/acl/oidc/complete-auth \
error="error converting claim 'roles' to string from unknown type []interface {}" code=500

After fix

  • The same configuration now properly processes array claims.
  • Array values are serialized to JSON strings for consistent handling.
  • User roles are correctly mapped from the OIDC provider.

Example of the processed claim:

internal_claims = {
  "roles": "[\"role1\",\"role2\",\"roleN\"]"
}

Changes to Security Controls

Yes, this PR includes changes to security controls:
Access Controls: Enables proper role mapping from OIDC providers, ensuring users receive correct authorization levels

Implement handling of []interface{} types by serializing them to
JSON string format. This allows arrays like ["role1", "role2"] to
be converted to string representations for further processing.
Copy link

hashicorp-cla-app bot commented Oct 16, 2025

CLA assistant check
All committers have signed the CLA.

@othman-essabir othman-essabir marked this pull request as ready for review October 16, 2025 18:50
@othman-essabir othman-essabir requested review from a team as code owners October 16, 2025 18:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Development

Successfully merging this pull request may close these issues.

1 participant