Rundeck 6.0.1 - JDBC JAAS authentication succeeds but database roles are not added to JAAS Subject #10423

Describe the bug

After upgrading Rundeck from 5.20.0 to 6.0.1, JDBC/JAAS authentication succeeds, but the user's roles/groups stored in the database are not added to the JAAS Subject.

The user can successfully log in to Rundeck, but Rundeck displays:

"You have no authorized access to projects."

The same JDBC users and roles work correctly on Rundeck 5.20.0.

This appears similar to #10288 / PR #10308, where LDAP/AD authentication succeeds but roles are not added to the JAAS Subject after upgrading to Rundeck 6.0.x.

However, our authentication backend is JDBC rather than LDAP.

Rundeck version

6.0.1

Previous working version:
5.20.0

Deployment

Docker / AWS ECS

Base image:
rundeck/rundeck:6.0.1

Database:
MariaDB

JAAS configuration

We migrated the JDBC login module for the Jetty 12/Rundeck 6 upgrade.

Current configuration:
RDjdbclogin {
org.eclipse.jetty.security.jaas.spi.JDBCLoginModule
required
debug="true"
dbUrl=""
dbUserName=""
dbPassword=""
dbDriver="org.mariadb.jdbc.Driver"
userTable="users"
userField="username"
credentialField="password"
userRoleTable="roles"
userRoleUserField="username"
userRoleRoleField="role";
};

The Rundeck JVM is started with:
-Dloginmodule.conf.name=jaas-loginmodule.conf
-Dloginmodule.name=RDjdbclogin
-Drundeck.jaaslogin=true

Database roles

The user has multiple roles in the roles table.

Example:
SELECT username, role
FROM roles
WHERE username = 'sharmari';

Result:
sharmari admin
sharmari data
sharmari dataadmin
sharmari lng
sharmari lngadmin
sharmari tools
sharmari users
sharmari webadmin

Table structure:
CREATE TABLE roles (
username varchar(255) NOT NULL,
role varchar(255) NOT NULL,
PRIMARY KEY (username,role)
);

Actual behaviour

Authentication succeeds, but the authorization log contains a Subject with only the username:

subjectUsername:sharmari

There are no Group entries.

Example:
WARN authorization.LoggingAuthorization - Evaluating Decision for:
res<name:DataQualityTest, type:project>
subjectUsername:sharmari
action<app_admin>
envrundeck:auth:env:application:rundeck
authorized: false:
No context matches subject or environment =>
REJECTED_NO_SUBJECT_OR_ENV_FOUND

Rundeck UI subsequently displays:
"You have no authorized access to projects."

Expected behaviour

The authenticated Subject should contain the roles retrieved from the JDBC roles table, as it did in Rundeck 5.20.0.
For comparison, on the working Rundeck 5.20.0 environment the authorization Subject contains entries such as:

subject<
Username:
Group:lng
Group:data
Group:dataadmin
Group:tools
Group:users
Group:lngadmin

The ACL policies can then evaluate the user's groups correctly.

Troubleshooting performed

1. Verified that authentication succeeds.
2. Verified that the user exists in the users table.
3. Verified that the user's roles exist in the roles table.
4. Verified the roles table schema.
5. Migrated JDBCLoginModule from the old Jetty package to the Jetty 12 package.
6. Tested explicitly querying the roles table using roleQuery, but this caused authentication to fail, so the configuration was reverted.
7. Restored userRoleTable/userRoleUserField/userRoleRoleField configuration.
8. Authentication works again, but the authenticated JAAS Subject still contains no Group principals.

Possible relation to existing Rundeck 6 issue

This appears very similar to:
#10288 - JAAS multiauth not working in 6.0.0 #10288
and:
#10308 - Fix LDAP roles not added to JAAS Subject after commit()

PR #10308 appears to address LDAP/AD role propagation.

Could the same Rundeck 6 / Jetty 12 JAAS regression also affect roles returned by:
org.eclipse.jetty.security.jaas.spi.JDBCLoginModule

?

If #10308 does not cover JDBCLoginModule, is an equivalent change required for JDBC JAAS role principals to be propagated to the Rundeck Subject?