Groups gets deleted on multi-IdP setup

We are currently hitting a very subtle bug regarding a multi-IdP Setup (Keycloak, LDAP):

When a user logs in via Keycloak all non-existing groups are created due to group-claims. Now if the same user logs in via LDAP after the first login (same account, mappingMethod: add) all groups that where created by the keycloak IdP are deleted if the user is the only user in that group.

I identified this section:
https://github.com/openshift/oauth-server/blob/f892602b822782e0080abc70c6cd1d178f11e684/pkg/groupmapper/groupmapper.go#L136-L143

The group cleanup check is above the IdP annotation check, most likely leading to this problem.

I know that this is an edge-case but can hit quite randomly and forces us to work around it. My customers and I would really appreciate a fix.

How to reproduce:

• add an OAuth and a LDAP IdP to Openshift (both are binding to the same Openshift User with mappingMethod: add)
• add automated group propagation using claims to the OAuth IdP
• login with an user that has at least one group using the OAuth IdP
  • groups is created as expected
• logout and login with the same user using the LDAP IdP
• now the group is deleted

Notes:

• If another user is added to the group (for whatever reason) it is not deleted
• If the group is created manually or via ldap sync this does not happen
• If 2 OAuth IdPs are used and both IdP Tokens contain the same groups, there should be no problem
• This behavior points to a bug rather than a security feature.
• Simply swapping the order of the checks should fix this edge-case.

Start in pkg/groupmapper/groupmapper.go around lines 136-143, where group cleanup is checked relative to the IdP annotation. Reproduce the Keycloak and LDAP login sequence with mappingMethod: add, then verify that groups created from Keycloak claims remain after the LDAP login. Done means the described multi-IdP flow no longer deletes a group when its only member is the shared user.