@@ -569,6 +569,20 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
569569return
570570}
571571
572+ // Log all of the field names returned in the ID token claims, and the
573+ // userinfo returned from the provider.
574+ {
575+ fields := make ([]string ,0 ,len (claims ))
576+ for f := range claims {
577+ fields = append (fields ,f )
578+ }
579+
580+ api .Logger .Debug (ctx ,"got oidc claims" ,
581+ slog .F ("user_info" ,userInfo ),
582+ slog .F ("claim_fields" ,fields ),
583+ )
584+ }
585+
572586usernameRaw ,ok := claims [api .OIDCConfig .UsernameField ]
573587var username string
574588if ok {
@@ -624,6 +638,11 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
624638// Convert the []interface{} we get to a []string.
625639groupsInterface ,ok := groupsRaw .([]interface {})
626640if ok {
641+ api .Logger .Debug (ctx ,"groups returned in oidc claims" ,
642+ slog .F ("len" ,len (groupsInterface )),
643+ slog .F ("groups" ,groupsInterface ),
644+ )
645+
627646for _ ,groupInterface := range groupsInterface {
628647group ,ok := groupInterface .(string )
629648if ! ok {
@@ -634,6 +653,10 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
634653}
635654groups = append (groups ,group )
636655}
656+ }else {
657+ api .Logger .Debug (ctx ,"groups field was an unknown type" ,
658+ slog .F ("type" ,fmt .Sprintf ("%T" ,groupsRaw )),
659+ )
637660}
638661}
639662}