mystiq/dex
Archived
4
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity

Revert ClaimMapping struct

Browse source 
Signed-off-by: Happy2C0de <46957159+Happy2C0de@users.noreply.github.com>
This commit is contained in:
Happy2C0de 2021-08-19 10:02:55 +02:00
parent 14a0aecc81
commit 2b6bb1997c
2 changed files with 44 additions and 51 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
connector/oidc/oidc.go
View file

@ -61,11 +61,7 @@ type Config struct {
// This setting allows you to override the default behavior of Dex and enforce the mappings defined in `claimMapping`.
OverrideClaimMapping bool `json:"overrideClaimMapping"` // defaults to false
ClaimMapping ClaimMapping `json:"claimMapping"`
}
type ClaimMapping struct {
ClaimMapping struct {
// Configurable key which contains the preferred username claims
PreferredUsernameKey string `json:"preferred_username"` // defaults to "preferred_username"
@ -74,6 +70,7 @@ type ClaimMapping struct {
// Configurable key which contains the groups claims
GroupsKey string `json:"groups"` // defaults to "groups"
} `json:"claimMapping"`
}
// Domains that don't support basic auth. golang.org/x/oauth2 has an internal
@ -162,7 +159,9 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
userIDKey: c.UserIDKey,
userNameKey: c.UserNameKey,
overrideClaimMapping: c.OverrideClaimMapping,
claimMapping: c.ClaimMapping,
preferredUsernameKey: c.ClaimMapping.PreferredUsernameKey,
emailKey: c.ClaimMapping.EmailKey,
groupsKey: c.ClaimMapping.GroupsKey,
}, nil
}
@ -186,7 +185,9 @@ type oidcConnector struct {
userIDKey string
userNameKey string
overrideClaimMapping bool
claimMapping ClaimMapping
preferredUsernameKey string
emailKey string
groupsKey string
}
func (c *oidcConnector) Close() error {
@ -296,8 +297,8 @@ func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.I
prefUsername := "preferred_username"
preferredUsername, found := claims[prefUsername].(string)
if (!found || c.overrideClaimMapping) && c.claimMapping.PreferredUsernameKey != "" {
prefUsername = c.claimMapping.PreferredUsernameKey
if (!found || c.overrideClaimMapping) && c.preferredUsernameKey != "" {
prefUsername = c.preferredUsernameKey
preferredUsername, found = claims[prefUsername].(string)
if !found {
return identity, fmt.Errorf("missing \"%s\" claim", prefUsername)
@ -315,8 +316,8 @@ func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.I
var email string
emailKey := "email"
email, found = claims[emailKey].(string)
if (!found || c.overrideClaimMapping) && c.claimMapping.EmailKey != "" {
emailKey = c.claimMapping.EmailKey
if (!found || c.overrideClaimMapping) && c.emailKey != "" {
emailKey = c.emailKey
email, found = claims[emailKey].(string)
if !found {
return identity, fmt.Errorf("missing \"%s\" claim", emailKey)
@ -340,8 +341,8 @@ func (c *oidcConnector) createIdentity(ctx context.Context, identity connector.I
if c.insecureEnableGroups {
groupsKey := "groups"
vs, found := claims[groupsKey].([]interface{})
if (!found || c.overrideClaimMapping) && c.claimMapping.GroupsKey != "" {
groupsKey = c.claimMapping.GroupsKey
if (!found || c.overrideClaimMapping) && c.groupsKey != "" {
groupsKey = c.groupsKey
vs, found = claims[groupsKey].([]interface{})
}

34
connector/oidc/oidc_test.go
View file

@ -50,7 +50,9 @@ func TestHandleCallback(t *testing.T) {
userIDKey string
userNameKey string
overrideClaimMapping bool
claimMapping ClaimMapping
preferredUsernameKey string
emailKey string
groupsKey string
insecureSkipEmailVerified bool
scopes []string
expectUserID string
@ -80,9 +82,7 @@ func TestHandleCallback(t *testing.T) {
name: "customEmailClaim",
userIDKey: "", // not configured
userNameKey: "", // not configured
claimMapping: ClaimMapping{
EmailKey: "mail",
},
emailKey: "mail",
expectUserID: "subvalue",
expectUserName: "namevalue",
expectedEmailField: "emailvalue",
@ -98,16 +98,14 @@ func TestHandleCallback(t *testing.T) {
userIDKey: "", // not configured
userNameKey: "", // not configured
overrideClaimMapping: true,
claimMapping: ClaimMapping{
EmailKey: "custommail",
},
emailKey: "custommail",
expectUserID: "subvalue",
expectUserName: "namevalue",
expectedEmailField: "customemailvalue",
token: map[string]interface{}{
"sub": "subvalue",
"name": "namevalue",
"mail": "emailvalue",
"email": "emailvalue",
"custommail": "customemailvalue",
"email_verified": true,
},
@ -152,9 +150,7 @@ func TestHandleCallback(t *testing.T) {
},
{
name: "withPreferredUsernameKey",
claimMapping: ClaimMapping{
PreferredUsernameKey: "username_key",
},
preferredUsernameKey: "username_key",
expectUserID: "subvalue",
expectUserName: "namevalue",
expectPreferredUsername: "username_value",
@ -223,9 +219,7 @@ func TestHandleCallback(t *testing.T) {
},
{
name: "customGroupsKey",
claimMapping: ClaimMapping{
GroupsKey: "cognito:groups",
},
groupsKey: "cognito:groups",
expectUserID: "subvalue",
expectUserName: "namevalue",
expectedEmailField: "emailvalue",
@ -242,9 +236,7 @@ func TestHandleCallback(t *testing.T) {
},
{
name: "customGroupsKeyButGroupsProvided",
claimMapping: ClaimMapping{
GroupsKey: "cognito:groups",
},
groupsKey: "cognito:groups",
expectUserID: "subvalue",
expectUserName: "namevalue",
expectedEmailField: "emailvalue",
@ -263,9 +255,7 @@ func TestHandleCallback(t *testing.T) {
{
name: "customGroupsKeyButGroupsProvidedButOverride",
overrideClaimMapping: true,
claimMapping: ClaimMapping{
GroupsKey: "cognito:groups",
},
groupsKey: "cognito:groups",
expectUserID: "subvalue",
expectUserName: "namevalue",
expectedEmailField: "emailvalue",
@ -312,7 +302,9 @@ func TestHandleCallback(t *testing.T) {
BasicAuthUnsupported: &basicAuth,
OverrideClaimMapping: tc.overrideClaimMapping,
}
config.ClaimMapping = tc.claimMapping
config.ClaimMapping.PreferredUsernameKey = tc.preferredUsernameKey
config.ClaimMapping.EmailKey = tc.emailKey
config.ClaimMapping.GroupsKey = tc.groupsKey
conn, err := newConnector(config)
if err != nil {