Ryan Malloy
da2878e8fb
Some checks failed
Tests / test (push) Has been cancelled
Authentik 2025.8 ships a default 'groups' scope that emits the user's ak_groups as the 'groups' claim automatically. Adding a custom scope mapping with the same scope_name causes Authentik to concatenate both emitters' output, producing duplicated group names in the users.groups column. Document the symptom and the fix, plus a sibling note that Keycloak needs the opposite (explicit mapper required to emit anything).