use docker compose to test keycloak

weed/iam/oidc/oidc_provider.go

@@ -156,6 +156,16 @@ func (p *OIDCProvider) Authenticate(ctx context.Context, token string) (*provide
 	displayName, _ := claims.GetClaimString("name")
 	groups, _ := claims.GetClaimStringSlice("groups")
 
+	// Debug: Log available claims
+	glog.V(3).Infof("Available claims: %+v", claims.Claims)
+	if rolesFromClaims, exists := claims.GetClaimStringSlice("roles"); exists {
+		glog.V(3).Infof("Roles claim found as string slice: %v", rolesFromClaims)
+	} else if roleFromClaims, exists := claims.GetClaimString("roles"); exists {
+		glog.V(3).Infof("Roles claim found as string: %s", roleFromClaims)
+	} else {
+		glog.V(3).Infof("No roles claim found in token")
+	}
+
 	// Map claims to roles using configured role mapping
 	roles := p.mapClaimsToRolesWithConfig(claims)
 
@@ -373,25 +383,36 @@ func (p *OIDCProvider) mapClaimsToRoles(claims *providers.TokenClaims) []string
 
 // mapClaimsToRolesWithConfig maps token claims to roles using configured role mapping
 func (p *OIDCProvider) mapClaimsToRolesWithConfig(claims *providers.TokenClaims) []string {
+	glog.V(3).Infof("mapClaimsToRolesWithConfig: RoleMapping is nil? %t", p.config.RoleMapping == nil)
+	
 	if p.config.RoleMapping == nil {
+		glog.V(2).Infof("No role mapping configured for provider %s, using legacy mapping", p.name)
 		// Fallback to legacy mapping if no role mapping configured
 		return p.mapClaimsToRoles(claims)
 	}
 
+	glog.V(3).Infof("Applying %d role mapping rules", len(p.config.RoleMapping.Rules))
 	roles := []string{}
 
 	// Apply role mapping rules
-	for _, rule := range p.config.RoleMapping.Rules {
+	for i, rule := range p.config.RoleMapping.Rules {
+		glog.V(3).Infof("Rule %d: claim=%s, value=%s, role=%s", i, rule.Claim, rule.Value, rule.Role)
+		
 		if rule.Matches(claims) {
+			glog.V(2).Infof("Rule %d matched! Adding role: %s", i, rule.Role)
 			roles = append(roles, rule.Role)
+		} else {
+			glog.V(3).Infof("Rule %d did not match", i)
 		}
 	}
 
 	// Use default role if no rules matched
 	if len(roles) == 0 && p.config.RoleMapping.DefaultRole != "" {
+		glog.V(2).Infof("No rules matched, using default role: %s", p.config.RoleMapping.DefaultRole)
 		roles = []string{p.config.RoleMapping.DefaultRole}
 	}
 
+	glog.V(2).Infof("Role mapping result: %v", roles)
 	return roles
 }
 

weed/iam/providers/provider.go

@@ -6,6 +6,8 @@ import (
 	"net/mail"
 	"path/filepath"
 	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
 )
 
 // IdentityProvider defines the interface for external identity providers
@@ -189,22 +191,30 @@ type MappingRule struct {
 // Matches checks if a rule matches the given claims
 func (r *MappingRule) Matches(claims *TokenClaims) bool {
 	if r.Claim == "" || r.Value == "" {
+		glog.V(3).Infof("Rule invalid: claim=%s, value=%s", r.Claim, r.Value)
 		return false
 	}
 
 	claimValue, exists := claims.GetClaimString(r.Claim)
 	if !exists {
+		glog.V(3).Infof("Claim '%s' not found as string, trying as string slice", r.Claim)
 		// Try as string slice
 		if claimSlice, sliceExists := claims.GetClaimStringSlice(r.Claim); sliceExists {
+			glog.V(3).Infof("Claim '%s' found as string slice: %v", r.Claim, claimSlice)
 			for _, val := range claimSlice {
+				glog.V(3).Infof("Checking if '%s' matches rule value '%s'", val, r.Value)
 				if r.matchValue(val) {
+					glog.V(3).Infof("Match found: '%s' matches '%s'", val, r.Value)
 					return true
 				}
 			}
+		} else {
+			glog.V(3).Infof("Claim '%s' not found in any format", r.Claim)
 		}
 		return false
 	}
 
+	glog.V(3).Infof("Claim '%s' found as string: '%s'", r.Claim, claimValue)
 	return r.matchValue(claimValue)
 }
 
@@ -212,7 +222,9 @@ func (r *MappingRule) Matches(claims *TokenClaims) bool {
 func (r *MappingRule) matchValue(value string) bool {
 	matched, err := filepath.Match(r.Value, value)
 	if err != nil {
+		glog.V(3).Infof("Error matching '%s' against pattern '%s': %v", value, r.Value, err)
 		return false
 	}
+	glog.V(3).Infof("Pattern match result: '%s' matches '%s' = %t", value, r.Value, matched)
 	return matched
 }