From c35a0f7553411a6a4ff78f1817c9736750f2d461 Mon Sep 17 00:00:00 2001 From: Ralf Haferkamp Date: Tue, 30 Nov 2021 17:18:06 +0100 Subject: [PATCH] OIDC: fallback to "email" if IDP doesn't provide "preferred_username" claim Some IDPs (e.g. Authelia) don't add the "preferred_username" claim. Fallback to the "email" claim in that case. Fixes: #2644 --- changelog/unreleased/user-claim-fallback.md | 6 ++++++ proxy/pkg/user/backend/accounts.go | 8 ++++++-- 2 files changed, 12 insertions(+), 2 deletions(-) create mode 100644 changelog/unreleased/user-claim-fallback.md diff --git a/changelog/unreleased/user-claim-fallback.md b/changelog/unreleased/user-claim-fallback.md new file mode 100644 index 000000000..ef72f8d1e --- /dev/null +++ b/changelog/unreleased/user-claim-fallback.md @@ -0,0 +1,6 @@ +Change: OIDC: fallback if IDP doesn't provide "preferred_username" claim + +Some IDPs don't add the "preferred_username" claim. Fallback to the "email" +claim in that case + +https://github.com/owncloud/ocis/issues/2644 diff --git a/proxy/pkg/user/backend/accounts.go b/proxy/pkg/user/backend/accounts.go index d05a69465..1c9fd0b83 100644 --- a/proxy/pkg/user/backend/accounts.go +++ b/proxy/pkg/user/backend/accounts.go @@ -123,8 +123,12 @@ func (a accountsServiceBackend) CreateUserFromClaims(ctx context.Context, claims } } if req.Account.PreferredName, ok = claims[oidc.PreferredUsername].(string); !ok { - a.logger.Warn().Msg("Missing preferred_username claim") - } else { + a.logger.Warn().Msg("Missing preferred_username claim, falling back to email") + if req.Account.PreferredName, ok = claims[oidc.Email].(string); !ok { + a.logger.Debug().Msg("Missing email claim as well") + } + } + if req.Account.PreferredName != "" { // also use as on premises samaccount name req.Account.OnPremisesSamAccountName = req.Account.PreferredName }