Bug 2020625

Description of problem:
User fails to login from web console with keycloak OpenID IDP after enable group membership sync feature

Version-Release number of selected component (if applicable):
4.10.0-0.nightly-2021-11-03-181048

How reproducible:
Always

Steps to Reproduce:
1. Follow https://polarion.engineering.redhat.com/polarion/#/project/OSE/workitem?id=OCP-41149 Setup section to setup keycloak server
2. In keycloak server, add group called mygroup and put the user to be used to login into this group
3. In keycloak server, choose myclient, add new Mapper called groupmapper, set Mapper Type as "Group Membership" and Token Claim Name with "groups"
4. Run OCP-41149 the first 4 test steps to configure oauth with keycloak server but need to add groups as below in step3
oc edit oauth cluster
...
spec:
  identityProviders:
  ...
  - mappingMethod: claim
    name: keycloak-oidc
    openID:
      ca:
        name: keycloak-oidc-ca
      claims:
        groups:
        - groups
        email:
        - email
        name:
        - name
      clientID: myclient
      clientSecret:
        name: keycloak-oidc-secret
      extraScopes: []
      issuer: $KEYCLOAK_HOST/auth/realms/master
    type: OpenID

5. login with the user added into the group from web console

Actual results:
Login in step5 fails with "An authentication error occurred. " Though, 'oc get user` can show the user is created, but 'oc get group' shows nothing.

Expected results:
Login in step5 should be successful

Additional info:
The id_token extracted shows:
  "groups": [
    "/group1"
  ],
But Check the oauth-openshift pod logs with logLevel TraceAll, there is: ProviderGroups:[]string{"", "/group1"}, as below:
I1105 09:37:40.634591       1 request.go:1181] Response Body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Group.user.openshift.io \"\" is invalid: metadata.name: Required value: name or generateName is required","reason":"Invalid","details":{"group":"user.openshift.io","kind":"Group","causes":[{"reason":"FieldValueRequired","message":"Required value: name or generateName is required","field":"metadata.name"}]},"code":422}
I1105 09:37:40.634869       1 handler.go:199] Error creating or updating mapping for: &api.DefaultUserIdentityInfo{ProviderName:"keycloak-oidc", ProviderUserName:"b64:eHhpYTphdHRyMS92YWx1ZQ", ProviderGroups:[]string{"", "/group1"}, Extra:map[string]string{"name":"li yao"}} due to Group.user.openshift.io "" is invalid: metadata.name: Required value: name or generateName is required
E1105 09:37:40.634890       1 errorpage.go:28] AuthenticationError: Group.user.openshift.io "" is invalid: metadata.name: Required value: name or generateName is required