mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
kevinveenbirkenbachandClaude Opus 5.5
68c9aa5b3a
Main run 42235551402 (5d78f3ae7d), job 128223280276 Jenkins#0: the OIDC redirect ended at /securityRealm/finishLogin?error=invalid_scope. With a wellKnown server configuration and no scopesOverride, oic-auth requests every entry of the discovery document's scopes_supported (OicServerWellKnownConfiguration). Keycloak rejects the whole request when one scope is not a default or optional scope of the client. The requested list minus the scopes of the infinito.nexus client leaves exactly kc-admin-api, a Keycloak built-in assigned only to admin-cli and security-admin-console.
casc.yaml.j2 now pins scopesOverride to 'openid profile email'; groups keeps arriving as a default client scope. The new unit test renders casc.yaml.j2 and the shared client template default.json.j2 and asserts every requested scope is one the client carries; without the override both tests fail.
🎯 Fix: 91 %
💥 Break: 7 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: ~100 %
🏆 Score: 85
🚦 Gate: ⛔ break 7 % > 5
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>