DependencyTrack / DependencyTrack/dependency-track
OpenID Connect with token
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 9h 4m
- Merged PRs (30d)
- 229
Description
The enhancement may already be reported! Please search for the enhancement before creating one.
### Current Behavior:
Hello,
We are currently using version 4.2.2, and we have configured OpenID Connect for authentication.
We have 2 types of accounts:
- a professional account example : name, last name, upn, email : firstname.lastname@company.com
- a technical account : first name, last name, upn and without email address.
When we use the professional account, OIDC works correctly because the API returns the user information correctly, in particular the email address which allows authentication.
The security department only accepts technical accounts that do not have an email address in our Azue Active Directory.
### Proposed Behavior:
We have identified during our tests that the token contains the elements we are missing.
Is it possible that the OpenID Connect is based on the token to do authentication?
Contributor guide
Research direction
No files, tests, or entry points are named. Review the existing OpenID Connect authentication flow and compare the token claims with the current email-based user information; done requires a maintainer-confirmed design for authenticating technical accounts without email addresses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100