Bethuel Mmbaga cd777395f2 [management] Skip JWT group evaluation for embedded-IdP local users (#6422) ...

When JWT group sync is enabled with a restrictive JWTAllowGroups list, the local owner of an embedded-IdP (Dex) deployment can get locked out. The allow-groups check runs account-wide but local password users do not receive
external IdP group claims, so they can't satisfy the allowed list.

This skips JWT group evaluation for local Dex users so the restriction and JWT group sync continue to apply to external-IdP users as intended.

2026-06-15 12:01:54 +03:00

5.7 KiB

Raw Blame History

View Raw