Skip to content

docs/polaris-access-control.md documents the wrong OIDC claim path #48

Description

@mgdenno

The doc states Polaris reads the groups claim directly (quarkus.oidc.roles.role-claim-path=groups), with examples matching /iceberg-catalog-admins (plural, path-prefixed). The actual shipped config (polaris/manifests/polaris-config.yaml.tpl) uses role-claim-path=realm_access/roles, matching singular iceberg-catalog-admin.

Impact: Not a live bug (real access works via Keycloak's groups→realmRoles composite mapping), but anyone following the doc's own "Adding a new access tier" instructions, or debugging a permissions issue by inspecting the groups claim as instructed, will be looking at the wrong thing.

Fix: Update the doc to describe the actual realm_access/roles claim path and the Keycloak composite-role mapping it depends on.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions