diff --git a/app/models/oic_session.rb b/app/models/oic_session.rb
index 8a62c09..9bf538f 100644
--- a/app/models/oic_session.rb
+++ b/app/models/oic_session.rb
@@ -162,7 +162,7 @@ def user
     if id_token?
       @user = JSON::parse(Base64::decode64(id_token.split('.')[1]))
     else  # keycloak way...
-      @user = JSON::parse(Base64::decode64(access_token.split('.')[1]))
+      @user = JSON::parse(Base64::urlsafe_decode64(access_token.split('.')[1]))
     end
     return @user
   end