Adding oidc email scope check #1610
Conversation
nabokihms
force-pushed
the
oidc-email-scope-check
branch
from
32038d8 to
45bc3be
Compare
connector/oidc/oidc.go
Outdated
| EmailVerified: emailVerified, | ||
| ConnectorData: connData, | ||
| } | ||
| if email != "" { |
There was a problem hiding this comment.
This check is not necessary because of default values.
connector/oidc/oidc.go
Outdated
| @@ -302,10 +315,12 @@ func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.I | |||
| identity = connector.Identity{ | |||
| UserID: idToken.Subject, | |||
| Username: name, | |||
| Email: email, | |||
There was a problem hiding this comment.
I would revert this, because it doesn't change behavior at all.
|
Further thinking about this: |
nabokihms
force-pushed
the
oidc-email-scope-check
branch
from
7f049f0 to
cbed29a
Compare
|
Yep, it has sense. I will change the behavior according to your thoughts. |
nabokihms
force-pushed
the
oidc-email-scope-check
branch
3 times, most recently
from
b03ed83 to
c4ebee2
Compare
connector/oidc/oidc.go
Outdated
| @@ -262,15 +262,28 @@ func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.I | |||
| if !found { | |||
| return identity, fmt.Errorf("missing \"%s\" claim", userNameKey) | |||
| } | |||
|
|
|||
| emailInScopes := func() bool { | |||
There was a problem hiding this comment.
How about:
hasEmailScope := false
for _, s := range c.oauth2Config.Scopes {
if s == "email" {
hasEmailScope = true
break
}
}
Feels a bit cleaner and more readable
connector/oidc/oidc.go
Outdated
| email, found := claims["email"].(string) | ||
| if !found { | ||
| return identity, errors.New("missing \"email\" claim") | ||
| if emailInScopes { |
There was a problem hiding this comment.
You could merge these two ifs. The default value of email is an empty string because of the type.
There was a problem hiding this comment.
Yep, you are right. Fixed.
This helps to avoid "no email claim" error if email scope was not specified. Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
nabokihms
force-pushed
the
oidc-email-scope-check
branch
from
c4ebee2 to
383c2fe
Compare
This helps to avoid "no email claim" error if the email scope was not specified.
Signed-off-by: m.nabokikh maksim.nabokikh@flant.com
Closes #1598