S Santhosh Nagaraj

@batbattur From the response that you have received from the Kubernetes API server (403 Response) looks like you might be missing the Cluster Role binding. Please refer this [link](https://github.com/headlamp-k8s/headlamp/blob/main/docs/installation/keycloak/keycloak-minikube.md#configuring-a-clusterrole-binding-for-the-oidc-user) for...

Yes `system:anonymous` means the Kubernetes API server couldn't identify the user from the token. From the details that you have already shared the decoded token has the group details in...

Headlamp just initiates the login flow, the actual verification of the token is done by the Kubernetes API server, This is a bit weird because the token has the group...

@batbattur For testing user claims make sure the token contains user specific information like userID and setup the ClusterRoleBinding for that specific userID. So that we can get an idea...

Hey @AndrewSav When you say it doesn't let me log in is it not showing the Sign In page or It doesn't work after completing the signin flow.

@joaquimrocha Should the plugin settings be made available in incluster mode also? In that case ill have to hide the delete plugin button.

> @yolossn . But making the routes available does mean users will see the "disable" button, and I think disabling plugins shouldn't work unless in the app mode. A check...

Nope this issue isn't solved by #1636. From the comments raised looks like the frontend is not picking up the token from the redirect in the first try. Ill take...

@bobbled Does this issue occur every time you try to log in, or does it happen randomly? Could you please let me know which browser you are using? I've tested...

Happy to raise a PR if you think it is useful.