Skip to content
Projects
Groups
Snippets
Help
Loading...
Sign in
Toggle navigation
D
dex
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Commits
Issue Boards
Open sidebar
go
dex
Commits
fc723af0
Commit
fc723af0
authored
Mar 05, 2019
by
Gerald Barker
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Add option to OIDC connecter to override email_verified to true
parent
83a0326b
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
25 additions
and
10 deletions
+25
-10
oidc.md
Documentation/connectors/oidc.md
+5
-0
oidc.go
connector/oidc/oidc.go
+20
-10
No files found.
Documentation/connectors/oidc.md
View file @
fc723af0
...
@@ -55,6 +55,11 @@ connectors:
...
@@ -55,6 +55,11 @@ connectors:
# - profile
# - profile
# - email
# - email
# - groups
# - groups
# Some providers return claims without "email_verified", when they had no usage of emails verification in enrollement process
# or if they are acting as a proxy for another IDP etc AWS Cognito with an upstream SAML IDP
# This can be overridden with the below option
# insecureSkipEmailVerified: true
```
```
[
oidc-doc
]:
openid-connect.md
[
oidc-doc
]:
openid-connect.md
...
...
connector/oidc/oidc.go
View file @
fc723af0
...
@@ -36,6 +36,9 @@ type Config struct {
...
@@ -36,6 +36,9 @@ type Config struct {
// Optional list of whitelisted domains when using Google
// Optional list of whitelisted domains when using Google
// If this field is nonempty, only users from a listed domain will be allowed to log in
// If this field is nonempty, only users from a listed domain will be allowed to log in
HostedDomains
[]
string
`json:"hostedDomains"`
HostedDomains
[]
string
`json:"hostedDomains"`
// Override the value of email_verifed to true in the returned claims
InsecureSkipEmailVerified
bool
`json:"insecureSkipEmailVerified"`
}
}
// Domains that don't support basic auth. golang.org/x/oauth2 has an internal
// Domains that don't support basic auth. golang.org/x/oauth2 has an internal
...
@@ -113,9 +116,10 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
...
@@ -113,9 +116,10 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
verifier
:
provider
.
Verifier
(
verifier
:
provider
.
Verifier
(
&
oidc
.
Config
{
ClientID
:
clientID
},
&
oidc
.
Config
{
ClientID
:
clientID
},
),
),
logger
:
logger
,
logger
:
logger
,
cancel
:
cancel
,
cancel
:
cancel
,
hostedDomains
:
c
.
HostedDomains
,
hostedDomains
:
c
.
HostedDomains
,
insecureSkipEmailVerified
:
c
.
InsecureSkipEmailVerified
,
},
nil
},
nil
}
}
...
@@ -125,13 +129,14 @@ var (
...
@@ -125,13 +129,14 @@ var (
)
)
type
oidcConnector
struct
{
type
oidcConnector
struct
{
redirectURI
string
redirectURI
string
oauth2Config
*
oauth2
.
Config
oauth2Config
*
oauth2
.
Config
verifier
*
oidc
.
IDTokenVerifier
verifier
*
oidc
.
IDTokenVerifier
ctx
context
.
Context
ctx
context
.
Context
cancel
context
.
CancelFunc
cancel
context
.
CancelFunc
logger
log
.
Logger
logger
log
.
Logger
hostedDomains
[]
string
hostedDomains
[]
string
insecureSkipEmailVerified
bool
}
}
func
(
c
*
oidcConnector
)
Close
()
error
{
func
(
c
*
oidcConnector
)
Close
()
error
{
...
@@ -209,6 +214,11 @@ func (c *oidcConnector) HandleCallback(s connector.Scopes, r *http.Request) (ide
...
@@ -209,6 +214,11 @@ func (c *oidcConnector) HandleCallback(s connector.Scopes, r *http.Request) (ide
}
}
}
}
if
c
.
insecureSkipEmailVerified
{
claims
.
EmailVerified
=
true
}
identity
=
connector
.
Identity
{
identity
=
connector
.
Identity
{
UserID
:
idToken
.
Subject
,
UserID
:
idToken
.
Subject
,
Username
:
claims
.
Username
,
Username
:
claims
.
Username
,
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment