When you use groups in the Plugin Configuration and the receiving access_token is not a JWT the login fails, see logs and screenshot.
2023-09-17T21:05:17.307320691Z I, [2023-09-17T21:05:17.307178 #1] INFO -- : Completed 500 Internal Server Error in 554ms (ActiveRecord: 6.9ms | Allocations: 4660)
2023-09-17T21:05:17.308166091Z F, [2023-09-17T21:05:17.308094 #1] FATAL -- :
2023-09-17T21:05:17.308183781Z NoMethodError (undefined method `unpack1' for nil:NilClass
2023-09-17T21:05:17.308189501Z
2023-09-17T21:05:17.308194071Z str.unpack1("m")
2023-09-17T21:05:17.308198681Z ^^^^^^^^):
2023-09-17T21:05:17.308202961Z
2023-09-17T21:05:17.308207061Z plugins/redmine_openid_connect/app/models/oic_session.rb:178:in `user'
2023-09-17T21:05:17.308211231Z plugins/redmine_openid_connect/app/models/oic_session.rb:163:in `admin?'
2023-09-17T21:05:17.308215311Z plugins/redmine_openid_connect/lib/redmine_openid_connect/account_controller_patch.rb:143:in `oic_local_login'
When you don't use the groups, everything works.
I think the reason is written here: oic_session.rb
Here will be tried to decode the access_token when it exists.
This only works when the access_token is a JWT like in Keycloak, but the format of the access_token is not defined in the RFC and can be everything also a random alphanumeric string and then it fails.
When I remove the special code for Keycloak, it works like expected
Normally I don't work with Ruby, so perhaps I didn't understand the code correct and the real reason is on another location, but for me it looks very logical.
When you use groups in the Plugin Configuration and the receiving access_token is not a JWT the login fails, see logs and screenshot.
When you don't use the groups, everything works.
I think the reason is written here: oic_session.rb
Here will be tried to decode the access_token when it exists.
This only works when the access_token is a JWT like in Keycloak, but the format of the access_token is not defined in the RFC and can be everything also a random alphanumeric string and then it fails.
When I remove the special code for Keycloak, it works like expected
Normally I don't work with Ruby, so perhaps I didn't understand the code correct and the real reason is on another location, but for me it looks very logical.