bdfca92 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Handle UPN fallback when profileURL isn't set

commitbdfca925a37e45357be3311312ce7f7df487e71b authorNick Meves <nick.meves@greenhouse.io> dateSat 3 Jul 2021, 13:40 (5 years ago) parent1621ea3

2 files changed+13−5

unifiedsplit

providers/adfs.go+2−5

@@ -84,11 +84,8 @@ func (p *ADFSProvider) GetLoginURL(redirectURI, state, nonce string) string {

8484// from the claims. If Email is missing, falls back to ADFS `upn` claim.

8585func (p *ADFSProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {

8686 err := p.oidcEnrichFunc(ctx, s)

87− if err != nil {

88− return err

89− }

90−

91− if s.Email == "" {

87+ if err != nil || s.Email == "" {

88+ // OIDC only errors if email is missing

9289 return p.fallbackUPN(ctx, s)

9390 }

9491 return nil

providers/adfs_test.go+11

@@ -5,6 +5,7 @@ import (

55 "crypto/rand"

66 "crypto/rsa"

77 "encoding/base64"

8+ "errors"

89 "net/http"

910 "net/http/httptest"

1011 "net/url"

@@ -253,6 +254,16 @@ var _ = Describe("ADFS Provider Tests", func() {

253254 Expect(err).ToNot(HaveOccurred())

254255 Expect(session.Email).To(Equal("upn@company.com"))

255256 })

257+

258+ It("falls back to UPN claim on errors", func() {

259+ p.oidcEnrichFunc = func(_ context.Context, s *sessions.SessionState) error {

260+ return errors.New("neither the id_token nor the profileURL set an email")

261+ }

262+

263+ err := p.EnrichSession(context.Background(), session)

264+ Expect(err).ToNot(HaveOccurred())

265+ Expect(session.Email).To(Equal("upn@company.com"))

266+ })

256267 })

257268

258269 Describe("RefreshSession", func() {