External Authentication REST module threw can only concatenate list (not "dict") to list

Using https://github.com/latenighttales/alcali/releases/tag/v3003.1.0

Attempting to do external_auth via rest, I get the following error:

2023-10-16 15:23:13,083 [salt.auth :149 ][DEBUG ][187] Authentication module threw can only concatenate list (not "dict") to list

https://github.com/saltstack/salt/blob/8505972418f071f6dddbb41bdee6f2980d7fcf37/salt/auth/rest.py#L101

Detailed logs:

==> /var/log/salt/api <==
2023-10-16 15:23:13,019 [salt.loaded.int.netapi.rest_cherrypy.app:750 ][INFO    ][46] [api_acl] Authentication not checked for user alcali from IP 10.224.0.4
2023-10-16 15:23:13,211 [salt.channel.client:359 ][DEBUG   ][46] Closing AsyncReqChannel instance
2023-10-16 15:23:13,211 [salt.loaded.int.netapi.rest_cherrypy.app:1916][DEBUG   ][46] Eauth permission list not found.
2023-10-16 15:23:13,212 [cherrypy.access.140465201672880:283 ][INFO    ][46] 10.224.0.4 - - [16/Oct/2023:15:23:13] "POST /login HTTP/1.1" 200 173 "" "Python-urllib/3.7"
2023-10-16 15:23:13,221 [salt.channel.client:359 ][DEBUG   ][46] Closing AsyncReqChannel instance
2023-10-16 15:23:13,222 [cherrypy.access.140465201672880:283 ][INFO    ][46] 10.224.0.4 - - [16/Oct/2023:15:23:13] "GET /events HTTP/1.1" 200 - "" "python-requests/2.24.0"
2023-10-16 15:23:13,222 [salt.utils.event :315 ][DEBUG   ][46] MasterEvent PUB socket URI: /var/run/salt/master/master_event_pub.ipc
2023-10-16 15:23:13,222 [salt.utils.event :316 ][DEBUG   ][46] MasterEvent PULL socket URI: /var/run/salt/master/master_event_pull.ipc
2023-10-16 15:23:13,226 [salt.channel.client:359 ][DEBUG   ][46] Closing AsyncReqChannel instance

==> /var/log/salt/master <==
2023-10-16 15:23:13,021 [salt.loader.lazy :977 ][DEBUG   ][187] The functions from module 'rest' are being loaded by dir() on the loaded module
2023-10-16 15:23:13,021 [salt.utils.lazy  :99  ][DEBUG   ][187] LazyLoaded rest.auth
2023-10-16 15:23:13,022 [salt.config      :2139][DEBUG   ][187] Missing configuration file: /etc/salt/minion
2023-10-16 15:23:13,022 [salt.config      :3627][DEBUG   ][187] Guessing ID. The id can be explicitly set in /etc/salt/minion
2023-10-16 15:23:13,025 [salt.config      :3653][DEBUG   ][187] Found minion id from generate_minion_id(): salt-master-0.salt-master.security.svc.cluster.local
2023-10-16 15:23:13,026 [salt.utils.http  :264 ][DEBUG   ][187] Requesting URL http://salt-alcali:8080/api/token/verify/ using POST method
2023-10-16 15:23:13,026 [salt.utils.http  :265 ][DEBUG   ][187] Using backend: tornado
2023-10-16 15:23:13,069 [salt.utils.http  :684 ][DEBUG   ][187] Response Status Code: 200
2023-10-16 15:23:13,069 [salt.loaded.int.auth.rest:62  ][DEBUG   ][187] eauth REST call returned 200: {'body': '{"alcali":null}', 'status': 200, 'dict': {'alcali': None}}
2023-10-16 15:23:13,069 [salt.loaded.int.auth.rest:83  ][DEBUG   ][187] eauth REST call Ok: {'alcali': None}
2023-10-16 15:23:13,070 [salt.loaded.int.auth.rest:92  ][DEBUG   ][187] acl from salt for user alcali: ['.*', '@runner', '@wheel', '@jobs']
2023-10-16 15:23:13,070 [salt.config      :2139][DEBUG   ][187] Missing configuration file: /etc/salt/minion
2023-10-16 15:23:13,071 [salt.config      :3627][DEBUG   ][187] Guessing ID. The id can be explicitly set in /etc/salt/minion
2023-10-16 15:23:13,074 [salt.config      :3653][DEBUG   ][187] Found minion id from generate_minion_id(): salt-master-0.salt-master.security.svc.cluster.local
2023-10-16 15:23:13,075 [salt.utils.http  :264 ][DEBUG   ][187] Requesting URL http://salt-alcali:8080/api/token/verify/ using POST method
2023-10-16 15:23:13,075 [salt.utils.http  :265 ][DEBUG   ][187] Using backend: tornado
2023-10-16 15:23:13,082 [salt.utils.http  :684 ][DEBUG   ][187] Response Status Code: 200
2023-10-16 15:23:13,083 [salt.loaded.int.auth.rest:62  ][DEBUG   ][187] eauth REST call returned 200: {'body': '{"alcali":null}', 'status': 200, 'dict': {'alcali': None}}
2023-10-16 15:23:13,083 [salt.loaded.int.auth.rest:99  ][DEBUG   ][187] acl from rest for user alcali: {'alcali': None}
2023-10-16 15:23:13,083 [salt.auth        :149 ][DEBUG   ][187] Authentication module threw can only concatenate list (not "dict") to list
2023-10-16 15:23:13,083 [salt.loader.lazy :977 ][DEBUG   ][187] The functions from module 'auto' are being loaded by dir() on the loaded module
2023-10-16 15:23:13,086 [salt.loader.lazy :977 ][DEBUG   ][187] The functions from module 'file' are being loaded by dir() on the loaded module
2023-10-16 15:23:13,087 [salt.loader.lazy :977 ][DEBUG   ][187] The functions from module 'keystone' are being loaded by dir() on the loaded module
2023-10-16 15:23:13,088 [salt.loader.lazy :977 ][DEBUG   ][187] The functions from module 'ldap' are being loaded by dir() on the loaded module
2023-10-16 15:23:13,206 [salt.loader.lazy :977 ][DEBUG   ][187] The functions from module 'pki' are being loaded by dir() on the loaded module
2023-10-16 15:23:13,207 [salt.loader.lazy :977 ][DEBUG   ][187] The functions from module 'sharedsecret' are being loaded by dir() on the loaded module
2023-10-16 15:23:13,208 [salt.loader.lazy :977 ][DEBUG   ][187] The functions from module 'yubico' are being loaded by dir() on the loaded module
2023-10-16 15:23:13,209 [salt.utils.lazy  :102 ][DEBUG   ][187] Could not LazyLoad rest.groups: 'rest.groups' is not available.
2023-10-16 15:23:13,210 [salt.loader.lazy :977 ][DEBUG   ][187] The functions from module 'localfs' are being loaded by dir() on the loaded module
2023-10-16 15:23:13,210 [salt.utils.lazy  :99  ][DEBUG   ][187] LazyLoaded localfs.mk_token
2023-10-16 15:23:13,220 [salt.loader.lazy :977 ][DEBUG   ][196] The functions from module 'localfs' are being loaded by dir() on the loaded module
2023-10-16 15:23:13,220 [salt.utils.lazy  :99  ][DEBUG   ][196] LazyLoaded localfs.get_token
2023-10-16 15:23:42,857 [salt.master      :481 ][DEBUG   ][200] Performing fileserver updates for items with an update interval of 60
2023-10-16 15:23:42,857 [salt.master      :463 ][DEBUG   ][200] Updating roots fileserver cache
2023-10-16 15:23:42,859 [salt.master      :486 ][DEBUG   ][200] Completed fileserver updates for items with an update interval of 60, waiting 60 seconds

Start in salt/auth/rest.py at the linked code around line 101 and trace the external_auth REST response shown in the logs. Reproduce the authentication request using the reported response shape, then verify that the REST authentication path no longer raises the list/dict concatenation error and returns the expected access result.