OpenID auth broken in jwtUtil
- Dominant language
- Python
- Stars
- 157
- Forks
- 60
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 15
Description
Moving from v0.6.3 to master, it looks like the OpenID auth was refactored into jwtUtil. However, this no longer works with providers that do not use `unique_name` by default such as Google. In v0.6.3, any valid claim was used as the username, while in v0.7.0 only the claim `unique_name` is allowed to be the username. See,
https://github.com/HDFGroup/hsds/blob/9e1f08183f6f5e7ad51c57a6d2e7ba0ecfd95f02/hsds/util/jwtUtil.py#L177-L191
The v0.6.3 behavior wasn't great so I understand why it was changed, but this needs to be configurable. Possible options:
- The first listed claim is used as the username field (possibly only if `unique_name` isn't present)
- Add a new config option `openid_username_claim` and maybe also `openid_roles_claim`
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.