AuthInfo: GetName() falls to GetSubject() for OBO token thus not returning a normalized name
- Dominant language
- Go
- Stars
- 15
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
## Background
As can be seen in the current implementation for AuthInfo:
https://github.com/grafana/authlib/blob/467781b5f1d66d9371fa426dae12edee37025f38/authn/auth_info.go#L62
GetName() works correctly when `id` is present during construction. The [getK8sName](https://github.com/grafana/authlib/blob/main/authn/verifier_id_token.go#L38-L50) implementation correctly returns either the name itself or email as a fallback. Email is a legitimate fallback in cases where a user hasn't set a name - which is surely a possibility in gcom.
## Problem
The regression waiting to take place is when user attribution logic such as the one introduced in https://github.com/grafana/grafana/pull/127983 starts working off of only OBO tokens. The name will then start falling to `GetSubject` and return something like `user:{userId}`, not what frontend expects to be a valid name.
## Possible Solution
In case of OBO token where innermost identity is of type user or service account, special care must be taken to return the legitimate name of the identity. The name may already be in the claims of the innermost subject, so sourcing it correctly in above authlib implementation may just be a one-liner.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in authn/auth_info.go at GetName(), then compare the identity and fallback handling in authn/verifier_id_token.go, especially getK8sName. Trace an OBO token whose innermost identity is a user or service account and verify that GetName() returns its normalized name or email rather than a user:{userId} subject.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100