mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
The tenant kube-apiserver auto-applies `claims.?email_verified.orValue(true) == true` when username.claim is email, so a Keycloak user with `emailVerified: false` fails login with `oidc: email not verified` even though token issuance succeeds. Document the requirement in the operator guide alongside the other System-mode failure modes. Signed-off-by: Ivan Okhotnikov <ivan.okhotnikov@aenix.io>