🐞 Bug Summary

Generic OIDC providers (Authentik in my case) cannot promote users to platform admin via SSO group mapping. The Keycloak and Entra paths work because they have dedicated bootstrap and admin-check wiring — the generic path is missing equivalent support in three places along the same code flow.

Tested on v1.0.0-RC-3 (a02a04b) with Authentik as the IdP. Groups are correctly emitted by the IdP and correctly extracted by the gateway (the RC3 fix in #3597/#3719 works). The problem is what happens after extraction.

🧩 Affected Component

• mcpgateway - API
• mcpgateway - UI (admin panel)

🔁 Steps to Reproduce

1. Configure Generic OIDC (SSO_GENERIC_ENABLED=true, SSO_GENERIC_PROVIDER_ID=authentik, standard endpoints).
2. IdP emits groups: ["cf-platform-admin"] in the token.
3. Log in via SSO.
4. Result: user lands with platform_viewer + team_admin on personal team. No platform_admin. Admin UI sections don't work.

Expected Behavior

A user whose IdP group maps to platform_admin via role_mappings should get full admin access — same as Keycloak/Entra users do today.

📓 What breaks (single code flow, three gaps)

1. Bootstrap: provider_metadata is always {}

sso_bootstrap.py lines 290-312 — the generic OIDC block never sets provider_metadata. Keycloak (lines 268-282) and Entra (lines 228-234) both populate groups_claim, role_mappings, default_role. Generic writes {}, so _map_groups_to_roles() exits early with "No role mappings configured" even when the IdP sends the right groups.

2. Admin flag: _should_user_be_admin has no generic path

sso_service.py lines 2093-2132 — checks GitHub orgs, Google domains, Entra admin groups, but nothing for generic providers. Always returns False for Authentik. Even after manually fixing gap 1 so that platform_admin is correctly assigned in user_roles, the legacy is_admin flag on email_users stays false.

3. UI: admin rendering gates on legacy is_admin, not RBAC role

admin.py lines 2830, 3544, 3571 — the UI reads is_admin from the user/session, not from user_roles. A user with platform_admin RBAC role but is_admin = false sees the admin sidebar but clicking anything (Users, Maintenance, System Config) just shows the Overview page.

🧠 Environment Info

🧩 Additional Context

Suggested fix direction:

• Add SSO_GENERIC_GROUPS_CLAIM, SSO_GENERIC_ROLE_MAPPINGS (JSON), SSO_GENERIC_DEFAULT_ROLE env vars and wire them into provider_metadata during bootstrap (parity with Keycloak/Entra).
• In _should_user_be_admin, after the provider-specific checks, consult provider_metadata.role_mappings — if any of the user's groups maps to platform_admin, return True. Or sync is_admin after _map_groups_to_roles when platform_admin is in the result.

Current workaround (two manual DB statements after each fresh deployment):

UPDATE sso_providers SET provider_metadata = '{"groups_claim":"groups","default_role":"platform_viewer","role_mappings":{"cf-platform-admin":"platform_admin"}}' WHERE id = 'authentik';
UPDATE email_users SET is_admin = true, admin_origin = 'manual' WHERE email = 'user@example.com';