oidc: distinguish between username and preferred_username claims
#789
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Owner
|
thanks for the contribution, I tried to do everything based on the oidc spec I was reading online and preferred_username appeared to be the standard. but giving options definitely makes sense, merging! |
Contributor
Author
|
Appreciate the quick response! For the completeness, I've only now seen that I forgot to add the Similarly for the wiki page. |
Owner
|
Right good catch, I can clean that up in a dev branch. I always overwrite the full config wiki every release |
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Check list
According to the contributing guide, A PR should contain:
Description
First of all, thanks for implementing the OIDC feature in the fork!
In current setup, when you want to obtain user's name from the OIDC claims, the
preferred_usernameclaim is used.This is problematic, because depending on the OIDC provider username can be stored in either
usernameorpreferred_usernameclaim, most providers even provide both claims.This PR allows you to decide which claim you want to use to obtain username.
Tested with Hashicorp Vault based OIDC provider.
Additional Details
This change is BREAKING, as it changes the
usernamebehaviour, moving the old implementation topreferred_usernameswitch.On a side note,
preferred_usernameseems to be more fragile, as in most implementations it's mutable and can be changed by the user after account creation.