mirror of
https://github.com/ClusterCockpit/cc-backend
synced 2026-08-31 00:47:15 +02:00
moebiusbandandClaude Opus 4.8
3474690adc
OIDC roles were translated by a hardcoded switch that only recognised the literal names user/admin/manager/support (dropping api) and required the IdP to emit exactly those names. Add an optional auth.oidc.role-mapping (OIDC role/group claim value -> CC role) so operators can map their own realm/client role names, including api. The mapping is the sole source of roles: only mapped names are honored, unmapped token roles are ignored, and users without any mapped role receive the base "user" role. Mapping targets are validated once at startup. Role assignment stays authoritative on every login as before. Note: deployments relying on the IdP emitting literal CC role names must now map them explicitly (e.g. "admin": "admin"). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Entire-Checkpoint: 66451678484b