Set restricted or admin is performed after the second user login via OIDC auth #13728

New Issue

GiteaMirror · 2025-11-02T10:51:33-06:00

GiteaMirror commented

2025-11-02 10:51:33 -06:00

Originally created by @evgnblkn on GitHub (Nov 19, 2024).

Description

The parameters "Group Claim value for administrator users" (admin-group) and "Group Claim value for restricted users" (restricted-group) work only when the user logs in for the second time. When a user logs in for the first time after registration, the user parameters "Is Administrator" and "Is Restricted" are not set, but are set when the user logs out and logs in again.
The behavior is a little similar to #26415, but it concerns the assignment to organizational teams.
I'm checking on v1.22.3 from the gitea/gitea:latest-rootless docker image and KeyCloak v26.0.5 as an OIDC provider.

Gitea Version

1.22.3

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

https://gist.github.com/evgnblkn/ed964e56a5c9531e5b7200647cb3c064

Screenshots

from Gitea Authentication Source:

In the Keycloak settings "Client scopes" I added a dedicated mapper with the type "User Realm Role"

Created realm roles

...and added these roles to the user

Git Version

No response

Operating System

No response

How are you running Gitea?

I'm checking on v1.22.3 from the gitea/gitea:latest-rootless docker image.

Database

PostgreSQL

Originally created by @evgnblkn on GitHub (Nov 19, 2024). ### Description The parameters "Group Claim value for administrator users" (admin-group) and "Group Claim value for restricted users" (restricted-group) work only when the user logs in for the second time. When a user logs in for the first time after registration, the user parameters "Is Administrator" and "Is Restricted" are not set, but are set when the user logs out and logs in again. The behavior is a little similar to #26415, but it concerns the assignment to organizational teams. I'm checking on v1.22.3 from the gitea/gitea:latest-rootless docker image and KeyCloak v26.0.5 as an OIDC provider. ### Gitea Version 1.22.3 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist https://gist.github.com/evgnblkn/ed964e56a5c9531e5b7200647cb3c064 ### Screenshots from Gitea Authentication Source: ![изображение](https://github.com/user-attachments/assets/f4bfd738-1594-4fc8-a346-e93fe45f014e) In the Keycloak settings "Client scopes" I added a dedicated mapper with the type "User Realm Role" ![изображение](https://github.com/user-attachments/assets/4ce755cb-76b3-4e88-8bf3-801f8ce7deb2) Created realm roles ![изображение](https://github.com/user-attachments/assets/0e856b4d-b853-4ae3-a70e-c61b953d74c9) ...and added these roles to the user ![изображение](https://github.com/user-attachments/assets/f02d082b-a330-4640-b71a-0ae266bcb2c5) ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? I'm checking on v1.22.3 from the gitea/gitea:latest-rootless docker image. ### Database PostgreSQL

GiteaMirror added the topic/authentication type/bug labels 2025-11-02 10:51:33 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#13728