{"record":{"id":"b3794296ab9d168b","repo":"argoproj/argo-workflows","slug":"no-claim-found-for-key-v","errorCode":null,"errorMessage":"no claim found for key: %v","messagePattern":"no claim found for key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/types/claims.go","lineNumber":69,"sourceCode":"\terr = json.Unmarshal(data, &localClaim.RawClaim)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif localClaim.RawClaim[\"email_verified\"] == true || localClaim.RawClaim[\"email_verified\"] == \"true\" {\n\t\tlocalClaim.EmailVerified = true\n\t}\n\n\t*c = Claims(localClaim)\n\treturn nil\n}\n\n// GetCustomGroup is responsible for extracting groups based on the\n// provided custom claim key\nfunc (c *Claims) GetCustomGroup(customKeyName string) ([]string, error) {\n\tgroups, ok := c.RawClaim[customKeyName]\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"no claim found for key: %v\", customKeyName)\n\t}\n\n\tsliceInterface, ok := groups.([]any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"expected an array, got %v\", groups)\n\t}\n\n\tnewSlice := []string{}\n\tfor _, a := range sliceInterface {\n\t\tval, ok := a.(string)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"group name %v was not a string\", a)\n\t\t}\n\t\tnewSlice = append(newSlice, val)\n\t}\n\n\treturn newSlice, nil\n}","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/types/claims.go#L51-L87","documentation":"Claims.GetCustomGroup looks up the configured custom group claim key in RawClaim; when the key is absent from the token claims it returns this error. It surfaces during SSO callback when `customGroupClaimName` doesn't match any claim the IdP actually sent.","triggerScenarios":"HandleCallback processes a login where the OIDC token has no claim with the key configured as `sso.customGroupClaimName` (typo in config, IdP not sending the claim, or the scope that includes it wasn't requested).","commonSituations":"Configuring `customGroupClaimName: groups` but the IdP names it `memberOf` or nests it; missing `groups`/`profile` scope in `sso.scopes`; provider omits claim for some users (no group memberships).","solutions":["Set customGroupClaimName to the exact claim key present in the ID token (decode the token to inspect claims)","Add the required scope (e.g. `groups`) to `sso.scopes` so the provider emits the claim","Fix the claim mapping in the IdP (e.g. Dex connectors) to emit groups under the expected key","Handle the error gracefully in UI/rbac mapping so users without the claim still get a default outcome if desired"],"exampleFix":"// before\nsso:\n  customGroupClaimName: groups   # IdP sends \"memberOf\"\n// after\nsso:\n  customGroupClaimName: memberOf","handlingStrategy":"type-guard","validationCode":"if _, ok := claims.RawClaim[customGroupClaimName]; !ok {\n    // claim absent: skip group mapping or use default role\n}","typeGuard":"func hasClaim(c *types.Claims, key string) bool {\n    _, ok := c.RawClaim[key]\n    return ok\n}","tryCatchPattern":"groups, err := claims.GetCustomGroup(key)\nif err != nil {\n    log.Warnf(\"custom group claim %q missing: %v\", key, err)\n    groups = nil\n}","preventionTips":["Decode a real ID token and confirm the exact claim key before configuring","Request the scope that includes groups (e.g. `groups`)","Handle users with no groups gracefully","Keep customGroupClaimName in sync with IdP config"],"tags":["sso","claims","oidc","configuration"],"backgroundTag":"missing-claim","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}