Merge Roles from SSO not working in open source version of RC?

Description:

We are trying to set up RC for use with our website. For this purpose, we wrote a custom OAuth2 server and authorization through it worked. But the assignment of roles does not work.

Steps to reproduce:

1. Setup custom OAuth with merging Roles from SSO
2. The new user clicks the "Sign in with custom OAuth" button.
3. After logging in and accepting access for the client, the user does not enter the chat, again goes to the login page.
4. On the second click of the "Login with Custom OAuth" button, the user is logged into the chat, but does not have roles assigned by SSO.

Expected behavior:

Create a user account with assigned roles and enter the chat

Actual behavior:

The user logs in on the second try with the generic role "user"

Server Setup Information:

• Version of Rocket.Chat Server: 4.3.1
• Operating System: Debian 10.11
• Deployment Method: tar
• Number of Running Instances: 1
• DB Replicaset Oplog: +
• NodeJS Version: 12.22.9
• MongoDB Version:5.0.5 / wiredTiger

Client Setup Information

• Desktop App or Browser Version: does not matter
• Operating System: does not matter

Additional context

I see error on server log "Exception while invoking method login errorClass [Error]: User has no roles [error-user-has-no-roles]"

User data sent via OAuth:

{
  "aud": "bwP1DHvwbvm\/TdAY43AbHFUp5twF5fw66PuBC9IdcGi05qMN",
  "jti": "532411f6f6e93d018088fe68bd540cc3b53d52bbda3508ecf089c5a70135cf515712fdf774beef53",
  "iat": 1648183803,
  "nbf": 1648183803,
  "exp": 1648187401,
  "sub": "2",
  "scopes": "basic rocket-chat",
  "login": "test",
  "fullname": "Test Test Test",
  "avatar": "http:\/\/172.26.131.101\/api\/oauth\/avatar",
  "email": "web@xxx.xx",
  "roles": [
    "user",
    "admin"
  ]
}

How can I see in the server source code my settings are correct:

But the line confuses me:

onLicense('oauth-enterprise', () => {

Do I understand correctly that this functionality is available only to owners of a paid license? Otherwise, please explain why the assignment of roles does not work.

Thank you in advance!

Relevant logs:

Mar 25 12:29:57 rc-server rocketchat[3304]: {"level":20,"time":"2022-03-25T05:29:57.882Z","pid":3304,"hostname":"rc-server","name":"CustomOAuth","msg":"Identity response","data":{"aud":"pPNIiK7dOmSSvFi9xKSFZ58mdsd4YPRgcgV3FIa0KE8HY7vS","jti":"bb76d8d76db3d9b5b6aac093525c83b8a5f4c7c016d717b14f8ca311ef3656304e090418821f6953","iat":1648186196,"nbf":1648186196,"exp":1648189795,"sub":"2","scopes":"basic rocket-chat","login":"test","fullname":"TestTestTest","avatar":"http://172.26.131.101/api/oauth/avatar","email":"web@xxx.xx","roles":["user","admin"]}}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":35,"time":"2022-03-25T05:30:00.022Z","pid":3304,"hostname":"rc-server","name":"API","method":"GET","url":"/api/apps/languages","userId":"null","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36","host":"chat.domain","referer":"https://chat.domain/home","remoteIP":"172.26.131.101","status":200,"responseTime":0}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":35,"time":"2022-03-25T05:30:00.023Z","pid":3304,"hostname":"rc-server","name":"API","method":"GET","url":"/api/apps/actionButtons","userId":"null","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36","host":"chat.domain","referer":"https://chat.domain/home","remoteIP":"172.26.131.101","status":200,"responseTime":0}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":20,"time":"2022-03-25T05:30:00.030Z","pid":3304,"hostname":"rc-server","name":"Callbacks","msg":"Executing callback with id dolphin for hook beforeCreateUser"}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":20,"time":"2022-03-25T05:30:00.031Z","pid":3304,"hostname":"rc-server","name":"Callbacks","msg":"Executing callback with id check-max-user-seats for hook onCreateUser"}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":30,"time":"2022-03-25T05:30:00.216Z","pid":3304,"hostname":"rc-server","name":"SyncedCron","msg":"Starting \"Generate download files for user data\"."}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":30,"time":"2022-03-25T05:30:00.217Z","pid":3304,"hostname":"rc-server","name":"SyncedCron","msg":"Finished \"Generate download files for user data\"."}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":35,"time":"2022-03-25T05:30:00.221Z","pid":3304,"hostname":"rc-server","name":"Meteor","method":"joinDefaultChannels","userId":"PdzfJr9MTQ7dkxKiq","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36","referer":"https://chat.domain/home","remoteIP":"172.26.131.101","instanceId":"cKAGq2ntsrorbxLbf"}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":20,"time":"2022-03-25T05:30:00.266Z","pid":3304,"hostname":"rc-server","name":"Callbacks","msg":"Executing callback with id handle-max-seats-banners for hook afterActivateUser"}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":20,"time":"2022-03-25T05:30:00.268Z","pid":3304,"hostname":"rc-server","name":"Callbacks","msg":"Executing callback with id integrations-userCreated for hook afterCreateUser"}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":20,"time":"2022-03-25T05:30:00.268Z","pid":3304,"hostname":"rc-server","name":"Integrations","section":"Outgoing WebHook","msg":"Execute Trigger:","arg":"userCreated"}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":20,"time":"2022-03-25T05:30:00.268Z","pid":3304,"hostname":"rc-server","name":"Integrations","section":"Outgoing WebHook","msg":"Got the event arguments for the event: userCreated","argObject":{"event":"userCreated","user":{"_id":"PdzfJr9MTQ7dkxKiq","createdAt":"2022-03-25T05:30:00.030Z","services":{"test":{"_OAuthCustom":true,"serverURL":"http://172.26.131.101","accessToken":"~~hidden~~","expiresAt":1648189797883,"refreshToken":"~~hidden~~","aud":"pPNIiK7dOmSSvFi9xKSFZ58mdsd4YPRgcgV3FIa0KE8HY7vS","jti":"bb76d8d76db3d9b5b6aac093525c83b8a5f4c7c016d717b14f8ca311ef3656304e090418821f6953","iat":1648186196,"nbf":1648186196,"exp":1648189795,"sub":"2","scopes":"basic rocket-chat","login":"test","fullname":"TestTestTest","avatar":"http://172.26.131.101/api/oauth/avatar","email":"web@xxx.xx","roles":["user","admin"]},"id":"2","username":"test","avatarUrl":"http://172.26.131.101/api/oauth/avatar","name":"TestTestTest"}},"type":"user","status":"offline","active":true,"name":"TestTestTest","emails":[{"address":"web@xxx.xx","verified":true}],"username":"test","email":"web@xxx.xx","_updatedAt":"2022-03-25T05:30:00.031Z"}}}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":20,"time":"2022-03-25T05:30:00.268Z","pid":3304,"hostname":"rc-server","name":"Integrations","section":"Outgoing WebHook","msg":"Starting search for triggers for the room: __any"}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":20,"time":"2022-03-25T05:30:00.269Z","pid":3304,"hostname":"rc-server","name":"Integrations","section":"Outgoing WebHook","msg":"Found 0 to iterate over and see if the match the event."}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":35,"time":"2022-03-25T05:30:00.386Z","pid":3304,"hostname":"rc-server","name":"Meteor","publication":null,"userId":null,"userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36","remoteIP":"172.26.131.101","instanceId":"cKAGq2ntsrorbxLbf"}
Mar 25 12:30:00 rc-server rocketchat[3304]: {"level":30,"time":"2022-03-25T05:30:00.432Z","pid":3304,"hostname":"rc-server","name":"System","msg":"Failed login detected - Username[unknown] ClientAddress[172.26.131.101] ForwardedFor[-] XRealIp[-] UserAgent[-]"}
Mar 25 12:30:00 rc-server rocketchat[3304]: Exception while invoking method login errorClass [Error]: User has no roles [error-user-has-no-roles]
Mar 25 12:30:00 rc-server rocketchat[3304]:     at app/authentication/server/startup/index.js:339:9
Mar 25 12:30:00 rc-server rocketchat[3304]:     at packages/callback-hook/hook.js:131:22
Mar 25 12:30:00 rc-server rocketchat[3304]:     at packages/accounts-base/accounts_server.js:191:15
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Hook.each (packages/callback-hook/hook.js:109:15)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at AccountsServer._validateLogin (packages/accounts-base/accounts_server.js:188:29)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at AccountsServer._attemptLogin (packages/accounts-base/accounts_server.js:377:10)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at MethodInvocation.methods.login (packages/accounts-base/accounts_server.js:559:23)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at maybeAuditArgumentChecks (packages/ddp-server/livedata_server.js:1771:12)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at packages/ddp-server/livedata_server.js:1689:15
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at packages/ddp-server/livedata_server.js:1687:36
Mar 25 12:30:00 rc-server rocketchat[3304]:     at new Promise (<anonymous>)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Server.applyAsync (packages/ddp-server/livedata_server.js:1686:12)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Server.apply (packages/ddp-server/livedata_server.js:1625:26)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Server.call (packages/ddp-server/livedata_server.js:1607:17)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Object.post (app/api/server/v1/misc.js:416:26)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at app/api/server/api.js:407:96
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Object._internalRouteActionHandler [as action] (app/api/server/api.js:407:39)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at packages/nimble_restivus/lib/route.coffee:59:33
Mar 25 12:30:00 rc-server rocketchat[3304]:     at packages/simple_json-routes.js:98:9
Mar 25 12:30:00 rc-server rocketchat[3304]:  => awaited here:
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Promise.await (/opt/Rocket.Chat/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/promise_server.js:60:12)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Server.apply (packages/ddp-server/livedata_server.js:1638:22)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Server.call (packages/ddp-server/livedata_server.js:1607:17)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Object.post (app/api/server/v1/misc.js:416:26)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at app/api/server/api.js:407:96
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Object._internalRouteActionHandler [as action] (app/api/server/api.js:407:39)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32)
Mar 25 12:30:00 rc-server rocketchat[3304]:     at packages/nimble_restivus/lib/route.coffee:59:33
Mar 25 12:30:00 rc-server rocketchat[3304]:     at packages/simple_json-routes.js:98:9 {
Mar 25 12:30:00 rc-server rocketchat[3304]:   isClientSafe: true,
Mar 25 12:30:00 rc-server rocketchat[3304]:   error: 'error-user-has-no-roles',
Mar 25 12:30:00 rc-server rocketchat[3304]:   reason: 'User has no roles',
Mar 25 12:30:00 rc-server rocketchat[3304]:   details: { function: 'Accounts.validateLoginAttempt' },
Mar 25 12:30:00 rc-server rocketchat[3304]:   errorType: 'Meteor.Error'
Mar 25 12:30:00 rc-server rocketchat[3304]: }

Start at app/authentication/server/startup/index.js:339, where the reported "User has no roles" error is raised, and trace the custom OAuth login flow using the supplied reproduction steps and identity response. Verify how the roles array is handled on the first and second login attempts; done means a new user enters the chat on the first attempt with the SSO-provided roles.