{"version":"2.1.314","anchor":"gateway-refresh-logs-missing-groups-claim","canonical_anchor":"gateway-refresh-logs-missing-groups-claim","heading":"Gateway now logs a hint when a refreshed login is missing groups","tier":"notice","area":"Gateway Proxy","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314\/e\/gateway-refresh-logs-missing-groups-claim","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314","markdown":"### Gateway now logs a hint when a refreshed login is missing groups\n\nThe gateway logs an info message suggesting `oidc.userinfo_fallback: true` when a refreshed login carries no groups but some upstreams need them\n\n**What**\n\nThe gateway can sign people in through an identity provider (IdP), the service that confirms who someone is. When a login is refreshed, the IdP may leave out the list of groups the person belongs to. If some upstreams need those groups, the gateway now logs an info message instead of silently leaving the groups empty. Upstreams are the services the gateway forwards requests to.\n\nThe message suggests setting `oidc.userinfo_fallback: true` if your IdP leaves groups out of the refreshed id_token. An id_token is the signed record of who the person is.\n\n**Why**\n\nGateway admins get a clue when an upstream stops being served after a login refresh, and can fix it without guessing.\n\n- Area: Gateway Proxy\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: org\n- Heads-up: no"}