Make sure to respect the IDClaim override (#4650)

timeu · web-flow · commit d0695a4fd640 · 2024-05-24T11:23:18.000+02:00
diff --git a/pkg/auth/manager/oidc/oidc.go b/pkg/auth/manager/oidc/oidc.go
@@ -185,13 +185,17 @@ func (am *mgr) isIssuerAllowed(issuer string) bool {
 }
 
 func (am *mgr) doUserMapping(tkn *oidc.IDToken, claims jwt.MapClaims) (string, error) {
+	var sub = tkn.Subject
+	if am.c.IDClaim != "sub" && claims[am.c.IDClaim] != nil {
+		sub, _ = claims[am.c.IDClaim].(string)
+	}
 	if len(am.oidcUsersMapping) == 0 {
-		return tkn.Subject, nil
+		return sub, nil
 	}
 	// we need the custom claims for the mapping
 	if claims[am.c.GroupClaim] == nil {
 		// we are required to perform a user mapping but the group claim is not available
-		return tkn.Subject, nil
+		return sub, nil
 	}
 
 	mappings := make([]string, 0, len(am.oidcUsersMapping))

Original file line number	Diff line number	Diff line change
`@@ -185,13 +185,17 @@ func (am *mgr) isIssuerAllowed(issuer string) bool {`
`185`	`185`	`}`
`186`	`186`
`187`	`187`	`func (am mgr) doUserMapping(tkn oidc.IDToken, claims jwt.MapClaims) (string, error) {`
	`188`	`+ var sub = tkn.Subject`
	`189`	`+ if am.c.IDClaim != "sub" && claims[am.c.IDClaim] != nil {`
	`190`	`+ sub, _ = claims[am.c.IDClaim].(string)`
	`191`	`+ }`
`188`	`192`	`if len(am.oidcUsersMapping) == 0 {`
`189`		`- return tkn.Subject, nil`
	`193`	`+ return sub, nil`
`190`	`194`	`}`
`191`	`195`	`// we need the custom claims for the mapping`
`192`	`196`	`if claims[am.c.GroupClaim] == nil {`
`193`	`197`	`// we are required to perform a user mapping but the group claim is not available`
`194`		`- return tkn.Subject, nil`
	`198`	`+ return sub, nil`
`195`	`199`	`}`
`196`	`200`
`197`	`201`	`mappings := make([]string, 0, len(am.oidcUsersMapping))`