If you get a validation loop, check that the jwt cookie could be set:
- Look for a
no jwt
message, - Check the Set-Cookie LassoCookie,
- in particular, Domain should be set, if not set it in the config
If you get an error 'no username in jwt', make sure that the open id provider gave an email in the response to /userinfo In Hydra, it is returned in the id_token by the consent endpoint. For reference, check okta