@@ -64,12 +64,12 @@ func NewKeycloakProvider(p *ProviderData) *KeycloakProvider {
6464// email and groups.
6565func (p *KeycloakProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {
6666 // Fallback to ValidateURL if ProfileURL not set for legacy compatibility
67− userinfoURL := p.ValidateURL.String()
68− if p.ProfileURL != nil {
69− userinfoURL = p.ProfileURL.String()
67+ profileURL := p.ValidateURL.String()
68+ if p.ProfileURL.String() != "" {
69+ profileURL = p.ProfileURL.String()
7070 }
7171
72− json, err := requests.New(userinfoURL).
72+ json, err := requests.New(profileURL).
7373 WithContext(ctx).
7474 SetHeader("Authorization", "Bearer "+s.AccessToken).
7575 Do().