OIDC group mappings don't apply at registration

[garymoon]

Description

When a new user signs in/registers via OIDC, team mappings as declared in the authentation source don't take effect on the initial login. They do apply from the second login onward.

I would speculate that it's not a race issue since I can also repro it with email validation enabled.

Using OKTA as the idp.

Gitea Version

main branch

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

make watch

Database

PostgreSQL

[kdumontnu]

Can you please include a brief overview of the steps to follow to reproduce this and include the gitea version number that includes the commit sha?

Also, for traceability, this functionality was first implemented in #21441

[KN4CK3R]

I can't reproduce the problem. I used a Keycloak test instance with an additional "groups" mapper.

Keycloak:

Gitea:

Then I opened <gitea>/user/login and used "Sign in with keycloak". This redirects to Keycloak. After the login Gitea presents the "this is your username and password" screen. After that I'm logged in into Gitea and the user has the group membership.

26415.mp4

[garymoon]

My apologies, I am not able to reproduce this locally myself :(