ShinyProxy is Unable to Parse String `roles-claim`

[peter1357908]

The documentation on Group-based authorization claims that:

The value of the group claim should ideally be a JSON array, although ShinyProxy is more flexible on the format.

However, when the IdP actually send over a userinfo JSON (which happens to be the same as the decoded version of the ID Token JWT) that includes only a string instead of an array, ShinyProxy parsed the roles claim as an empty array (see logging below):

memberOf -> QS1-InnoTrans-ShinyProxy-Admin
2026-07-07T13:16:31.788Z DEBUG 1 --- [  XNIO-1 task-4] e.o.c.a.i.OpenIDAuthenticationBackend    : Matching claim found in user info: memberOf -> QS1-InnoTrans-ShinyProxy-Admin (class java.lang.String)
2026-07-07T13:16:31.788Z DEBUG 1 --- [  XNIO-1 task-4] e.o.c.a.i.OpenIDAuthenticationBackend    : Parsed roles claim as JSON: memberOf -> [] (class java.util.ArrayList)

As a result, it doesn't actually recognize the role/group value. For example, the admin-groups doesn't work, and trying to query in an app's pod with echo $SHINYPROXY_USERGROUPS returns nothing.

Here is my config, in case it's relevant:

    admin-groups: QS1-InnoTrans-ShinyProxy-Admin
    authentication: openid
    openid:
      auth-url: 'https://fedauthtst.pg.com/as/authorization.oauth2'
      token-url: 'https://fedauthtst.pg.com/as/token.oauth2'
      jwks-url: 'https://fedauthtst.pg.com/pf/JWKS'
      userinfo-url: 'https://fedauthtst.pg.com/idp/userinfo.openid'  # optional
      
      client-id: 'ShinyProxy DMT (TEST)'

      client-authentication-method: none
      with-pkce: true
      
      username-attribute: sub
      roles-claim: memberOf

[peter1357908]

I asked GPT-5.4 to inspect the relevant code in openanalytics/containerproxy, and it found that this behavior matches the current upstream implementation.

In OpenIDAuthenticationBackend.parseRolesClaim(...), the roles claim is handled as follows:

• if the claim value is a Collection, it is converted to a list of roles
• if the claim value is a String, the code tries to parse it as JSON

but it only accepts the result if that JSON parses to a list/array. That means a plain scalar string such as:

QS1-InnoTrans-ShinyProxy-Admin

is not treated as a single valid group. Instead, it goes through the string/JSON parsing branch and ends up as an empty list unless the value is array-like, e.g.:

["QS1-InnoTrans-ShinyProxy-Admin"]

This matches the debug output in this issue:

Matching claim found in user info: memberOf -> QS1-InnoTrans-ShinyProxy-Admin (class java.lang.String)
Parsed roles claim as JSON: memberOf -> []

GPT-5.4 also checked the current tests in containerproxy and found coverage for:

• Java collections
• proper JSON array strings
• non-standard array-like strings
  but not for the case where the claim is a plain scalar string that should be interpreted as a single group.

[LEDfan]

Hi, thanks for opening this issue! This will be fixed in the next release :)