7acec62 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Fall back to using OIDC Subject instead of Email

Email is not mandatory field, Subject is mandatory and expected to be unique. Might want to take a look at UserInfo first, however. Issue: #56

commit7acec6243bb35a06cff99f01b6d7258bdf528083 authorAigars Mahinovs <aigarius@gmail.com> dateWed 13 Feb 2019, 16:26 (8 years ago) parent84d7c51

1 file changed+3−1

unifiedsplit

providers/oidc.go+3−1

@@ -106,6 +106,7 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok

106106

107107 // Extract custom claims.

108108 var claims struct {

109+ Subject string `json:"sub"`

109110 Email string `json:"email"`

110111 Verified *bool `json:"email_verified"`

111112 }

@@ -114,7 +115,8 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok

114115 }

115116

116117 if claims.Email == "" {

117− return nil, fmt.Errorf("id_token did not contain an email")

118+ // TODO: Try getting email from /userinfo before falling back to Subject

119+ claims.Email = claims.Subject

118120 }

119121 if claims.Verified != nil && !*claims.Verified {

120122 return nil, fmt.Errorf("email in id_token (%s) isn't verified", claims.Email)