git.iko.soy/typeable/oauth2-proxy
on master help sign in
Fill empty UserIDClaim before assigning it to other values
commit82bb08609f57ba154a598d66a4e59e9566c9b651 authorMarc Schiereck <mdreem@fastmail.fm> dateMon 5 Dec 2022, 20:55 (4 years ago) parent2d67495
2 files changed+53−3
compare with master
unifiedsplit
providers/providers.go+4−3 providers/providers_test.go+49
providers/providers.go+4−3
@@ -145,6 +145,10 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,
145145 logger.Printf("Warning: Your provider supports PKCE methods %+q, but you have not enabled one with --code-challenge-method", p.SupportedCodeChallengeMethods)
146146 }
147147
148+ if providerConfig.OIDCConfig.UserIDClaim == "" {
149+ providerConfig.OIDCConfig.UserIDClaim = "email"
150+ }
151+
148152 // TODO (@NickMeves) - Remove This
149153 // Backwards Compatibility for Deprecated UserIDClaim option
150154 if providerConfig.OIDCConfig.EmailClaim == options.OIDCEmailClaim &&
@@ -159,9 +163,6 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,
159163 p.Scope += " groups"
160164 }
161165 }
162− if providerConfig.OIDCConfig.UserIDClaim == "" {
163− providerConfig.OIDCConfig.UserIDClaim = "email"
164− }
165166
166167 p.setAllowedGroups(providerConfig.AllowedGroups)
167168
providers/providers_test.go+49
@@ -221,3 +221,52 @@ func TestCanOverwriteS256(t *testing.T) {
221221
222222 g.Expect(method).To(Equal(CodeChallengeMethodPlain))
223223}
224+
225+func TestEmailClaimCorrectlySet(t *testing.T) {
226+ g := NewWithT(t)
227+
228+ testCases := []struct {
229+ name string
230+ userIDClaim string
231+ emailClaim string
232+ expectedEmailClaim string
233+ }{
234+ {
235+ name: "do not override EmailClaim if UserIDClaim is empty",
236+ userIDClaim: "",
237+ emailClaim: "email",
238+ expectedEmailClaim: "email",
239+ },
240+ {
241+ name: "set EmailClaim to UserIDClaim",
242+ userIDClaim: "user_id_claim",
243+ emailClaim: "email",
244+ expectedEmailClaim: "user_id_claim",
245+ },
246+ }
247+
248+ for _, tc := range testCases {
249+ t.Run(tc.name, func(t *testing.T) {
250+ providerConfig := options.Provider{
251+ ID: providerID,
252+ Type: "oidc",
253+ ClientID: clientID,
254+ ClientSecretFile: clientSecret,
255+ LoginURL: msAuthURL,
256+ RedeemURL: msTokenURL,
257+ OIDCConfig: options.OIDCOptions{
258+ IssuerURL: msIssuerURL,
259+ SkipDiscovery: true,
260+ JwksURL: msKeysURL,
261+ UserIDClaim: tc.userIDClaim,
262+ EmailClaim: tc.emailClaim,
263+ },
264+ }
265+
266+ pd, err := newProviderDataFromConfig(providerConfig)
267+ g.Expect(err).ToNot(HaveOccurred())
268+
269+ g.Expect(pd.EmailClaim).To(Equal(tc.expectedEmailClaim))
270+ })
271+ }
272+}