git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #57 from aigarius/patch-1

Fall back to using OIDC Subject instead of Email

commit21c9d38ada204932f5781018a22f02e59bc2e5be authorJoel Speed <Joel.speed@hotmail.co.uk> dateFri 8 Mar 2019, 14:20 (8 years ago) parent84d7c514e6593b
2 files changed+4−1
compare with master
unifiedsplit
CHANGELOG.md+1 providers/oidc.go+3−1
CHANGELOG.md+1
@@ -2,6 +2,7 @@
22
33## Changes since v3.1.0
44
5+- [#57](https://github.com/pusher/oauth2_proxy/pull/57) Fall back to using OIDC Subject instead of Email (@aigarius)
56- [#85](https://github.com/pusher/oauth2_proxy/pull/85) Use non-root user in docker images (@kskewes)
67- [#68](https://github.com/pusher/oauth2_proxy/pull/68) forward X-Auth-Access-Token header (@davidholsgrove)
78- [#41](https://github.com/pusher/oauth2_proxy/pull/41) Added option to manually specify OIDC endpoints instead of relying on discovery
providers/oidc.go+3−1
@@ -106,6 +106,7 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok
106106
107107 // Extract custom claims.
108108 var claims struct {
109+ Subject string `json:"sub"`
109110 Email string `json:"email"`
110111 Verified *bool `json:"email_verified"`
111112 }
@@ -114,7 +115,8 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok
114115 }
115116
116117 if claims.Email == "" {
117− return nil, fmt.Errorf("id_token did not contain an email")
118+ // TODO: Try getting email from /userinfo before falling back to Subject
119+ claims.Email = claims.Subject
118120 }
119121 if claims.Verified != nil && !*claims.Verified {
120122 return nil, fmt.Errorf("email in id_token (%s) isn't verified", claims.Email)