13202fd · typeable/oauth2-proxy

CHANGELOG.md+1

@@ -14,6 +14,7 @@

14- [#1906](https://github.com/oauth2-proxy/oauth2-proxy/pull/1906) Fix PKCE code verifier generation to never use UTF-8 characters

15- [#1839](https://github.com/oauth2-proxy/oauth2-proxy/pull/1839) Add readiness checks for deeper health checks (@kobim)

16- [#1927](https://github.com/oauth2-proxy/oauth2-proxy/pull/1927) Fix default scope settings for none oidc providers

17+- [#1920](https://github.com/oauth2-proxy/oauth2-proxy/pull/1920) Make sure emailClaim is not overriden if userIDClaim is not set

17

18

19

19# V7.4.0

20# V7.4.0

providers/providers.go+4−3

@@ -145,6 +145,10 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,

145 logger.Printf("Warning: Your provider supports PKCE methods %+q, but you have not enabled one with --code-challenge-method", p.SupportedCodeChallengeMethods)

146 }

147

148+ if providerConfig.OIDCConfig.UserIDClaim == "" {

149+ providerConfig.OIDCConfig.UserIDClaim = "email"

150+ }

151+

148 // TODO (@NickMeves) - Remove This

152 // TODO (@NickMeves) - Remove This

149 // Backwards Compatibility for Deprecated UserIDClaim option

153 // Backwards Compatibility for Deprecated UserIDClaim option

150 if providerConfig.OIDCConfig.EmailClaim == options.OIDCEmailClaim &&

154 if providerConfig.OIDCConfig.EmailClaim == options.OIDCEmailClaim &&

@@ -159,9 +163,6 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,

159 p.Scope += " groups"

163 p.Scope += " groups"

160 }

164 }

161 }

165 }

162− if providerConfig.OIDCConfig.UserIDClaim == "" {

163− providerConfig.OIDCConfig.UserIDClaim = "email"

164− }

165

166

166 p.setAllowedGroups(providerConfig.AllowedGroups)

167 p.setAllowedGroups(providerConfig.AllowedGroups)

167

168

providers/providers_test.go+49

@@ -221,3 +221,52 @@ func TestCanOverwriteS256(t *testing.T) {

221

222 g.Expect(method).To(Equal(CodeChallengeMethodPlain))

223}

224+

225+func TestEmailClaimCorrectlySet(t *testing.T) {

226+ g := NewWithT(t)

227+

228+ testCases := []struct {

229+ name string

230+ userIDClaim string

231+ emailClaim string

232+ expectedEmailClaim string

233+ }{

234+ {

235+ name: "do not override EmailClaim if UserIDClaim is empty",

236+ userIDClaim: "",

237+ emailClaim: "email",

238+ expectedEmailClaim: "email",

239+ },

240+ {

241+ name: "set EmailClaim to UserIDClaim",

242+ userIDClaim: "user_id_claim",

243+ emailClaim: "email",

244+ expectedEmailClaim: "user_id_claim",

245+ },

246+ }

247+

248+ for _, tc := range testCases {

249+ t.Run(tc.name, func(t *testing.T) {

250+ providerConfig := options.Provider{

251+ ID: providerID,

252+ Type: "oidc",

253+ ClientID: clientID,

254+ ClientSecretFile: clientSecret,

255+ LoginURL: msAuthURL,

256+ RedeemURL: msTokenURL,

257+ OIDCConfig: options.OIDCOptions{

258+ IssuerURL: msIssuerURL,

259+ SkipDiscovery: true,

260+ JwksURL: msKeysURL,

261+ UserIDClaim: tc.userIDClaim,

262+ EmailClaim: tc.emailClaim,

263+ },

264+ }

265+

266+ pd, err := newProviderDataFromConfig(providerConfig)

267+ g.Expect(err).ToNot(HaveOccurred())

268+

269+ g.Expect(pd.EmailClaim).To(Equal(tc.expectedEmailClaim))

270+ })

271+ }

272+}