Handle situation when empty groups not come from the keycloak (and he…

…nce from mod_auth_openidc) Before the keycloak v22 it sends empty array as group claim when user not in a member of any group. After v22 it not put this claim at all. Look discussion: keycloak/keycloak#22340 Signed-off-by: Stanislav Melnichuk <[email protected]>
oVirt · Apr 26, 2024 · eb5e525 · eb5e525
1 parent 535a933
commit eb5e525
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/src/main/java/org/ovirt/engine/extension/aaa/misc/QueryExecutor.java b/src/main/java/org/ovirt/engine/extension/aaa/misc/QueryExecutor.java
@@ -93,8 +93,14 @@ public ExtMap buildPrincipalRecord(Map<String, String> headers, String nameArg,
     }
 
     public Collection<ExtMap> buildPrincipalRecordGroups(Map<String, String> headers, String groupsArg) {
+        List<String> groupNames;
+        if (headers.containsKey(groupsArg)) {
+            groupNames = Arrays.asList(headers.get(groupsArg).split(","));
+        } else {
+            return Collections.emptyList();
+        }
+
         LinkedList<ExtMap> groups = new LinkedList<>();
-        List<String> groupNames = Arrays.asList(headers.get(groupsArg).split(","));
         for (String groupName : groupNames) {
             groupName = groupName.replaceFirst("^/", "");
             ExtMap group = new ExtMap();