OIDC Azure provider - There are no any groups in response

[vutkin]

Expected Behavior

If some user in Azure AD has 150+ groups in response (included subgroups) there will be no any groups, and Azure expects that application will do a second separate request to GraphQL request for groups only.

Like dex do for ex. https://dexidp.io/docs/connectors/microsoft/

Actual Behaviour

Works well when number of Azure AD groups for user is less than JWT/SAML limit

Steps To Reproduce

Ref: https://docs.microsoft.com/en-gb/azure/active-directory/hybrid/how-to-connect-fed-group-claims

Example:

DEBUG in application: Body: {"providerType":"OIDC","providerName":"azuread","username":"[email protected]"}

Environment Information

JDK: openjdk-11
OS: registry.access.redhat.com/ubi8/openjdk-11:1.13

Example Application

https://github.com/tchiotludo/akhq

Version

0.21.0

[vutkin]

Any update?

[sdelamo]

@vutkin I think you are going to need to provide a replacement and do this extra request.

[vutkin]

Switched to DEX IDP.