grafana / grafana/authlib

AuthInfo: GetName() falls to GetSubject() for OBO token thus not returning a normalized name

Open
#314 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
15
Forks
4
PR merge metrics
No merged PRs in 30d

Description

## Background

As can be seen in the current implementation for AuthInfo:

https://github.com/grafana/authlib/blob/467781b5f1d66d9371fa426dae12edee37025f38/authn/auth_info.go#L62

GetName() works correctly when `id` is present during construction. The [getK8sName](https://github.com/grafana/authlib/blob/main/authn/verifier_id_token.go#L38-L50) implementation correctly returns either the name itself or email as a fallback. Email is a legitimate fallback in cases where a user hasn't set a name - which is surely a possibility in gcom.

## Problem

The regression waiting to take place is when user attribution logic such as the one introduced in https://github.com/grafana/grafana/pull/127983 starts working off of only OBO tokens. The name will then start falling to `GetSubject` and return something like `user:{userId}`, not what frontend expects to be a valid name.

## Possible Solution

In case of OBO token where innermost identity is of type user or service account, special care must be taken to return the legitimate name of the identity. The name may already be in the claims of the innermost subject, so sourcing it correctly in above authlib implementation may just be a one-liner.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in authn/auth_info.go at GetName(), then compare the identity and fallback handling in authn/verifier_id_token.go, especially getK8sName. Trace an OBO token whose innermost identity is a user or service account and verify that GetName() returns its normalized name or email rather than a user:{userId} subject.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
64/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.