Client returns array of roles on auth

server/auth/handlers/handle_oauth2.go

@@ -502,8 +502,9 @@ func (h AuthHandlers) oauth2PublicKeys(w http.ResponseWriter, r *http.Request) {
 func SubSplit(ti oauth2def.TokenInfo, data map[string]interface{}) {
 	userIdWithRoles := strings.SplitN(ti.GetUserID(), " ", 2)
 	data["sub"] = userIdWithRoles[0]
+
 	if len(userIdWithRoles) > 1 {
-		data["roles"] = userIdWithRoles[1]
+		data["roles"] = strings.Split(userIdWithRoles[1], " ")
 	}
 }
 

server/auth/handlers/handle_oauth2_test.go

@@ -146,3 +146,35 @@ func Test_generateIdToken(t *testing.T) {
 	req.NoError(err)
 	req.NotEmpty(signed)
 }
+
+func Test_SubSplitRoles(t *testing.T) {
+	type (
+		exp struct {
+			id string
+			i  string
+			ii []string
+		}
+	)
+	var (
+		req = require.New(t)
+		ti  = &oauth2models.Token{}
+		d   = make(map[string]interface{})
+
+		tii = []exp{
+			{id: "1", i: "1", ii: []string{}},
+			{id: "1 2", i: "1", ii: []string{"2"}},
+			{id: "1 2 33 444", i: "1", ii: []string{"2", "33", "444"}},
+		}
+	)
+
+	for _, v := range tii {
+		ti.SetUserID(v.id)
+		SubSplit(ti, d)
+
+		req.Equal(v.i, d["sub"])
+
+		if _, is := d["roles"]; is {
+			req.Equal(v.ii, d["roles"])
+		}
+	}
+}