Allow admin users to work without group claim

OasisLMF · Sep 19, 2024 · 59e39f5 · 59e39f5
1 parent 8a0b1cb
commit 59e39f5
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/src/server/oasisapi/oidc/keycloak_auth.py b/src/server/oasisapi/oidc/keycloak_auth.py
@@ -158,9 +158,13 @@ def update_groups(self, user, claims):
         Persist Keycloak groups as local Django groups.
         """
         keycloak_groups = claims.get('groups', None)
+
         if keycloak_groups is None:
-            msg = 'No group found in claim / user_info'
-            raise SuspiciousOperation(msg)
+            if (user.is_superuser or user.is_staff):
+                keycloak_groups = []
+            else:
+                msg = 'No group found in claim / user_info'
+                raise SuspiciousOperation(msg)
 
         for i, keycloak_group in enumerate(keycloak_groups):
             if keycloak_group.startswith('/'):