Repository navigation
ShinyProxy is Unable to Parse String roles-claim #595
Description
The documentation on Group-based authorization claims that:
The value of the group claim should ideally be a JSON array, although ShinyProxy is more flexible on the format.
However, when the IdP actually send over a userinfo JSON (which happens to be the same as the decoded version of the ID Token JWT) that includes only a string instead of an array, ShinyProxy parsed the roles claim as an empty array (see logging below):
memberOf -> QS1-InnoTrans-ShinyProxy-Admin
2026-07-07T13:16:31.788Z DEBUG 1 --- [ XNIO-1 task-4] e.o.c.a.i.OpenIDAuthenticationBackend : Matching claim found in user info: memberOf -> QS1-InnoTrans-ShinyProxy-Admin (class java.lang.String)
2026-07-07T13:16:31.788Z DEBUG 1 --- [ XNIO-1 task-4] e.o.c.a.i.OpenIDAuthenticationBackend : Parsed roles claim as JSON: memberOf -> [] (class java.util.ArrayList)
As a result, it doesn't actually recognize the role/group value. For example, the admin-groups doesn't work, and trying to query in an app's pod with echo $SHINYPROXY_USERGROUPS returns nothing.
Here is my config, in case it's relevant:
admin-groups: QS1-InnoTrans-ShinyProxy-Admin
authentication: openid
openid:
auth-url: 'https://fedauthtst.pg.com/as/authorization.oauth2'
token-url: 'https://fedauthtst.pg.com/as/token.oauth2'
jwks-url: 'https://fedauthtst.pg.com/pf/JWKS'
userinfo-url: 'https://fedauthtst.pg.com/idp/userinfo.openid' # optional
client-id: 'ShinyProxy DMT (TEST)'
client-authentication-method: none
with-pkce: true
username-attribute: sub
roles-claim: memberOf
Activity
peter1357908 commentedon Jul 15, 2026
I asked GPT-5.4 to inspect the relevant code in
openanalytics/containerproxy, and it found that this behavior matches the current upstream implementation.In
OpenIDAuthenticationBackend.parseRolesClaim(...), the roles claim is handled as follows:but it only accepts the result if that JSON parses to a list/array. That means a plain scalar string such as:
QS1-InnoTrans-ShinyProxy-Adminis not treated as a single valid group. Instead, it goes through the string/JSON parsing branch and ends up as an empty list unless the value is array-like, e.g.:
["QS1-InnoTrans-ShinyProxy-Admin"]This matches the debug output in this issue:
GPT-5.4 also checked the current tests in containerproxy and found coverage for:
but not for the case where the claim is a plain scalar string that should be interpreted as a single group.
LEDfan commentedon Jul 27, 2026
Hi, thanks for opening this issue! This will be fixed in the next release :)