collective / collective/pas.plugins.oidc
claim used for group_ids won't be parsed correctly and will always be one string
- Dominant language
- Python
- Stars
- 6
- Forks
- 16
- PR merge metrics
- No merged PRs in 30d
Description
Today I tired to get the groups from a custom created claim "test_affiliation"
For my dummy user account there where two affiliations "staff" and "member"
Sadly the clain is not parsed correctly and i got the group "staff member"
After a bit of digging I found out, that the OAuth 2.0 specs define such claims as a "space-delimited list of values". So that was correct on this side.
I dug a bit into the pas.plugins.oidc and the oic code
https://github.com/collective/pas.plugins.oidc/blob/17941517ab0f7b769891f1db8f8b1adf4f5ce312/src/pas/plugins/oidc/utils.py#L191
I found out that the user info claims are parsed via a schema, which is the default schema
```py
try:
_schema = kwargs["user_info_schema"]
except KeyError:
_schema = OpenIDSchema
```
from [oic/oic/__init__.py#L947 do_user_info_request](https://github.com/CZ-NIC/pyoidc/blob/4b155c893c2ec21298be59541e647a0e98d5d7b8/src/oic/oic/__init__.py#L947)
[oic.messages.OpenIDSchema](https://github.com/CZ-NIC/pyoidc/blob/4b155c893c2ec21298be59541e647a0e98d5d7b8/src/oic/oic/message.py#L522)
there it is defined how a claim should be parsed, which should be `OPTIONAL_LIST_OF_STRINGS` for my example.
But of course the default schema does not contain my "test_affiliation", so i got my "staff member" group.
I think there should be some mechanism to extend the schema of the user info claims for them to be parsed correctly.
I will try to implement this somehow, cause I really need it for my Server
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in src/pas/plugins/oidc/utils.py around the user-info claim parsing, then read pyoidc's do_user_info_request in src/oic/oic/__init__.py and OpenIDSchema in src/oic/oic/message.py. Determine how a custom user-info schema can be supplied or extended, and verify that a space-delimited custom claim such as test_affiliation is returned as separate group values rather than one string.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100