Generic OAuth - How to access user info?

Grafana
1

I have the OAuth configured (for self hosted GitLab) and Role attribute path configured to assign role by groups from id_token.

contains(groups_direct[*], 'devops') && 'GrafanaAdmin' || 'Viewer'

And now I need to block access for users, which have external: true in the user info json. (from read_user from gitlab). How do I access the data. Neither of these works:

external == 'true' && 'None' || 'Viewer'
info.external == 'true' && 'None' || 'Viewer'
user_info.external == 'true' && 'None' || 'Viewer'
userinfo.external == 'true' && 'None' || 'Viewer'
read_user.external == 'true' && 'None' || 'Viewer'

How can I find out what variables are available for the role_attribute_path? I can see the jsons in debug logs, but there is no naming for them.

2

JMESPath expression to use for Grafana role lookup. Grafana will first evaluate the expression using the OAuth2 ID token. If no role is found, the expression will be evaluated using the user information obtained from the UserInfo endpoint.

So make sure that all required details are in the id token or in the userinfo. You can’t combine both.