OIDC: make use of attribute "email_verified"
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.1k
- Forks
- 564
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 29
Description
When we introduced OpenID Connect support back in #5974 and PR #6433, we left out a few things. One of those was support for the email verified status of new user accounts.
Currently, only the Shibboleth provider offers support for this:
Within OpenID Connect, we have a defined scope email attribute email_verified, which can be set by the provider. (This is one of the points where OIDC offers more that OAuth2 only...).
We should start to support this, as it makes the process more easy, when the IDM/IAM/OIDC provider already did the verification for us.
I'm not sure if UI/UX team is involved here, as there is no UI change necessary.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading AuthenticationServiceBean.java around lines 609-618, where Shibboleth email verification is handled, and review the OIDC support introduced in #5974 and PR #6433. Trace how the OIDC provider supplies the email scope and email_verified attribute. Done means new accounts can use a provider's verified email status consistently with the existing Shibboleth behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, backend
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100