DependencyTrack / DependencyTrack/dependency-track

OpenID Connect with token

Open
#1,233 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
9h 4m
Merged PRs (30d)
229

Description

The enhancement may already be reported! Please search for the enhancement before creating one.

### Current Behavior:
Hello,

We are currently using version 4.2.2, and we have configured OpenID Connect for authentication.

We have 2 types of accounts:
- a professional account example : name, last name, upn, email : firstname.lastname@company.com
- a technical account : first name, last name, upn and without email address.

When we use the professional account, OIDC works correctly because the API returns the user information correctly, in particular the email address which allows authentication.

The security department only accepts technical accounts that do not have an email address in our Azue Active Directory.

### Proposed Behavior:

We have identified during our tests that the token contains the elements we are missing.

Is it possible that the OpenID Connect is based on the token to do authentication?

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Review the existing OpenID Connect authentication flow and compare the token claims with the current email-based user information; done requires a maintainer-confirmed design for authenticating technical accounts without email addresses.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, java
Domain
authentication, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.