git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #1920 from mdreem/do-not-remove-emails-claim

Fill empty UserIDClaim before assigning it to other values

commit13202fd5ea94be3f3d29cb4aca8af7d8c3ae666a authorJoel Speed <Joel.speed@hotmail.co.uk> dateMon 6 Feb 2023, 09:16 (4 years ago) parent2d674955577cf0
3 files changed+54−3
compare with master
unifiedsplit
CHANGELOG.md+1 providers/providers.go+4−3 providers/providers_test.go+49
CHANGELOG.md+1
@@ -14,6 +14,7 @@
1414- [#1906](https://github.com/oauth2-proxy/oauth2-proxy/pull/1906) Fix PKCE code verifier generation to never use UTF-8 characters
1515- [#1839](https://github.com/oauth2-proxy/oauth2-proxy/pull/1839) Add readiness checks for deeper health checks (@kobim)
1616- [#1927](https://github.com/oauth2-proxy/oauth2-proxy/pull/1927) Fix default scope settings for none oidc providers
17+- [#1920](https://github.com/oauth2-proxy/oauth2-proxy/pull/1920) Make sure emailClaim is not overriden if userIDClaim is not set
1718
1819
1920# V7.4.0
providers/providers.go+4−3
@@ -145,6 +145,10 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,
145145 logger.Printf("Warning: Your provider supports PKCE methods %+q, but you have not enabled one with --code-challenge-method", p.SupportedCodeChallengeMethods)
146146 }
147147
148+ if providerConfig.OIDCConfig.UserIDClaim == "" {
149+ providerConfig.OIDCConfig.UserIDClaim = "email"
150+ }
151+
148152 // TODO (@NickMeves) - Remove This
149153 // Backwards Compatibility for Deprecated UserIDClaim option
150154 if providerConfig.OIDCConfig.EmailClaim == options.OIDCEmailClaim &&
@@ -159,9 +163,6 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,
159163 p.Scope += " groups"
160164 }
161165 }
162− if providerConfig.OIDCConfig.UserIDClaim == "" {
163− providerConfig.OIDCConfig.UserIDClaim = "email"
164− }
165166
166167 p.setAllowedGroups(providerConfig.AllowedGroups)
167168
providers/providers_test.go+49
@@ -221,3 +221,52 @@ func TestCanOverwriteS256(t *testing.T) {
221221
222222 g.Expect(method).To(Equal(CodeChallengeMethodPlain))
223223}
224+
225+func TestEmailClaimCorrectlySet(t *testing.T) {
226+ g := NewWithT(t)
227+
228+ testCases := []struct {
229+ name string
230+ userIDClaim string
231+ emailClaim string
232+ expectedEmailClaim string
233+ }{
234+ {
235+ name: "do not override EmailClaim if UserIDClaim is empty",
236+ userIDClaim: "",
237+ emailClaim: "email",
238+ expectedEmailClaim: "email",
239+ },
240+ {
241+ name: "set EmailClaim to UserIDClaim",
242+ userIDClaim: "user_id_claim",
243+ emailClaim: "email",
244+ expectedEmailClaim: "user_id_claim",
245+ },
246+ }
247+
248+ for _, tc := range testCases {
249+ t.Run(tc.name, func(t *testing.T) {
250+ providerConfig := options.Provider{
251+ ID: providerID,
252+ Type: "oidc",
253+ ClientID: clientID,
254+ ClientSecretFile: clientSecret,
255+ LoginURL: msAuthURL,
256+ RedeemURL: msTokenURL,
257+ OIDCConfig: options.OIDCOptions{
258+ IssuerURL: msIssuerURL,
259+ SkipDiscovery: true,
260+ JwksURL: msKeysURL,
261+ UserIDClaim: tc.userIDClaim,
262+ EmailClaim: tc.emailClaim,
263+ },
264+ }
265+
266+ pd, err := newProviderDataFromConfig(providerConfig)
267+ g.Expect(err).ToNot(HaveOccurred())
268+
269+ g.Expect(pd.EmailClaim).To(Equal(tc.expectedEmailClaim))
270+ })
271+ }
272+}