The doc states Polaris reads the groups claim directly (quarkus.oidc.roles.role-claim-path=groups), with examples matching /iceberg-catalog-admins (plural, path-prefixed). The actual shipped config (polaris/manifests/polaris-config.yaml.tpl) uses role-claim-path=realm_access/roles, matching singular iceberg-catalog-admin.
Impact: Not a live bug (real access works via Keycloak's groups→realmRoles composite mapping), but anyone following the doc's own "Adding a new access tier" instructions, or debugging a permissions issue by inspecting the groups claim as instructed, will be looking at the wrong thing.
Fix: Update the doc to describe the actual realm_access/roles claim path and the Keycloak composite-role mapping it depends on.
The doc states Polaris reads the groups claim directly (quarkus.oidc.roles.role-claim-path=groups), with examples matching /iceberg-catalog-admins (plural, path-prefixed). The actual shipped config (polaris/manifests/polaris-config.yaml.tpl) uses role-claim-path=realm_access/roles, matching singular iceberg-catalog-admin.
Impact: Not a live bug (real access works via Keycloak's groups→realmRoles composite mapping), but anyone following the doc's own "Adding a new access tier" instructions, or debugging a permissions issue by inspecting the groups claim as instructed, will be looking at the wrong thing.
Fix: Update the doc to describe the actual realm_access/roles claim path and the Keycloak composite-role mapping it depends on.