@@ -199,7 +199,7 @@ func (p *OIDCProvider) createSessionStateInternal(ctx context.Context, rawIDToke
199199
200200 claims, err := p.findClaimsFromIDToken(ctx, idToken, accessToken, p.ProfileURL.String())
201201 if err != nil {
202− return nil, fmt.Errorf("couldn't extract claims from id_token (%e)", err)
202+ return nil, fmt.Errorf("couldn't extract claims from id_token (%v)", err)
203203 }
204204
205205 newSession.IDToken = rawIDToken
@@ -243,20 +243,19 @@ func (p *OIDCProvider) findClaimsFromIDToken(ctx context.Context, idToken *oidc.
243243 }
244244
245245 userID := claims.rawClaims[p.UserIDClaim]
246− if userID == nil {
247− return nil, fmt.Errorf("claims did not contains the required user-id-claim '%s'", p.UserIDClaim)
246+ if userID != nil {
247+ claims.UserID = fmt.Sprint(userID)
248248 }
249− claims.UserID = fmt.Sprint(userID)
250249
251− if p.UserIDClaim == emailClaim && claims.UserID == "" {
250+ // userID claim was not present or was empty in the ID Token
251+ if claims.UserID == "" {
252252 if profileURL == "" {
253− return nil, fmt.Errorf("id_token did not contain an email")
253+ return nil, fmt.Errorf("id_token did not contain user ID claim (%q)", p.UserIDClaim)
254254 }
255255
256256 // If the userinfo endpoint profileURL is defined, then there is a chance the userinfo
257257 // contents at the profileURL contains the email.
258258 // Make a query to the userinfo endpoint, and attempt to locate the email from there.
259−
260259 req, err := http.NewRequestWithContext(ctx, "GET", profileURL, nil)
261260 if err != nil {
262261 return nil, err
@@ -268,12 +267,12 @@ func (p *OIDCProvider) findClaimsFromIDToken(ctx context.Context, idToken *oidc.
268267 return nil, err
269268 }
270269
271− email, err := respJSON.Get("email").String()
270+ userID, err := respJSON.Get(p.UserIDClaim).String()
272271 if err != nil {
273− return nil, fmt.Errorf("neither id_token nor userinfo endpoint contained an email")
272+ return nil, fmt.Errorf("neither id_token nor userinfo endpoint contained user ID claim (%q)", p.UserIDClaim)
274273 }
275274
276− claims.UserID = email
275+ claims.UserID = userID
277276 }
278277
279278 return claims, nil