HDFGroup / HDFGroup/hsds

OpenID auth broken in jwtUtil

Open
#119 2 comments 0 reactions 1 assignee Assigned to @mattjala View on GitHub
bug
Dominant language
Python
Stars
157
Forks
60
Avg merge
1d 5h
Merged PRs (30d)
15

Description

Moving from v0.6.3 to master, it looks like the OpenID auth was refactored into jwtUtil. However, this no longer works with providers that do not use `unique_name` by default such as Google. In v0.6.3, any valid claim was used as the username, while in v0.7.0 only the claim `unique_name` is allowed to be the username. See,

https://github.com/HDFGroup/hsds/blob/9e1f08183f6f5e7ad51c57a6d2e7ba0ecfd95f02/hsds/util/jwtUtil.py#L177-L191

The v0.6.3 behavior wasn't great so I understand why it was changed, but this needs to be configurable. Possible options:
- The first listed claim is used as the username field (possibly only if `unique_name` isn't present)
- Add a new config option `openid_username_claim` and maybe also `openid_roles_claim`

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.