- add OIDC_CLAIM_ROLES to the requested scope in order for it to be filled in the token userinfo

backend/decorators/auth.py

@@ -10,6 +10,7 @@ from starlette.authentication import requires
 from starlette.config import Config
 
 from config import (
+    OIDC_CLAIM_ROLES,
     OIDC_CLIENT_ID,
     OIDC_CLIENT_SECRET,
     OIDC_ENABLED,
@@ -58,7 +59,7 @@ oauth.register(
         config.get("OIDC_SERVER_APPLICATION_URL"), external=True
     ),
     client_kwargs={
-        "scope": "openid profile email",
+        "scope": "openid profile email" + ((" " + OIDC_CLAIM_ROLES) if OIDC_CLAIM_ROLES else ""),
         "verify": OIDC_TLS_CACERTFILE,
     },
 )