starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: Groupclaim doesn't support nested JSON keys #3126

New Issue
Open
opened 2026-04-25 00:13:47 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:13:47 +02:00
Owner
Copy Link
Copy Source

Originally created by @imgios on GitHub (Nov 28, 2025).

What happened?

I am trying to configure Keycloak and ABS integration with the groupClaim to enable ABS to also fetch the user group from the userinfo. Keycloak returns the roles in the user info with the following structure:

{
    "sub": "<some-uuid>",
+   "resource_access": {
+       "abs": {
+           "roles": [
+               "admin"
+           ]
+       },
        "account": {
            "roles": [
                "manage-account",
                "manage-account-links",
                "view-profile"
            ]
        }
    },
    "email_verified": true,
    "name": "Giosuè",
    "preferred_username": "imgios",
    "given_name": "Giosuè",
    "email": "imgios@homelab.local"
}

This means that the correct group claim should be resource_access.{clientId}.roles, but ABS does not support it:

Image

As a workaround, a custom client scope (e.g., abs_roles) with a custom mapper must be created in Keycloak. This can then be used as the groupClaim in the ABS configuration.

What did you expect to happen?

To properly configure it with Keycloak, I'd expect ABS to support nested JSON keys (resource_access.{clientId}.roles).

Steps to reproduce the issue

  1. Create a dedicated ABS client (e.g., abs) in Keycloak
  2. Configure the authentication in ABS and use resource_access.{clientId}.roles as Group Claim

Audiobookshelf version

v2.30.0

How are you running audiobookshelf?

Other (list in "Additional Notes" box)

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

Chrome

Logs

Group claim: Invalid claim name

Additional Notes

AudioBookShelf is deployed in a (Talos) Kubernetes Cluster using the TrueCharts Helm Chart. The issue can be seen using any browser.

Originally created by @imgios on GitHub (Nov 28, 2025). ### What happened? I am trying to configure Keycloak and ABS integration with the `groupClaim` to enable ABS to also fetch the user group from the `userinfo`. Keycloak returns the roles in the user info with the following structure: ```diff { "sub": "<some-uuid>", + "resource_access": { + "abs": { + "roles": [ + "admin" + ] + }, "account": { "roles": [ "manage-account", "manage-account-links", "view-profile" ] } }, "email_verified": true, "name": "Giosuè", "preferred_username": "imgios", "given_name": "Giosuè", "email": "imgios@homelab.local" } ``` This means that the correct group claim should be `resource_access.{clientId}.roles`, but ABS does not support it: <img width="800" height="337" alt="Image" src="https://github.com/user-attachments/assets/23f43c28-205e-498f-afbf-1000a4f9b039" /> As a workaround, a custom client scope (e.g., `abs_roles`) with a custom mapper must be created in Keycloak. This can then be used as the `groupClaim` in the ABS configuration. ### What did you expect to happen? To properly configure it with Keycloak, I'd expect ABS to support nested JSON keys (`resource_access.{clientId}.roles`). ### Steps to reproduce the issue 1. Create a dedicated ABS client (e.g., `abs`) in Keycloak 2. Configure the authentication in ABS and use `resource_access.{clientId}.roles` as Group Claim ### Audiobookshelf version v2.30.0 ### How are you running audiobookshelf? Other (list in "Additional Notes" box) ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? Chrome ### Logs ```shell Group claim: Invalid claim name ``` ### Additional Notes AudioBookShelf is deployed in a (Talos) Kubernetes Cluster using the TrueCharts Helm Chart. The issue can be seen using any browser.
adam added the bug label 2026-04-25 00:13:47 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3126
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?