stephen-bracken opened a new pull request, #71093: URL: https://github.com/apache/airflow/pull/71093
related #61771 Remove groups claim from access tokens in Keycloak clients from the KeycloakAuthManager cli --- With the KeycloakAuthManager the groups mapper in Keycloak is only used for evaluating RBAC policy enforcements on the server side, not the client side. In large organisations users can be members of hundreds or thousands of Keycloak groups, which significantly increases the size of the Keycloak `access_token` JWT, which risks going over the browser's 4KB cookie size limit. In the keycloak provider cli, we should set these group claims to be excluded from user refresh tokens _and_ access tokens to avoid overloading the browser cookies. ##### Was generative AI tooling used to co-author this PR? - [ ] Yes (please specify the tool below) - [X] No --- -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
