simplesamlphp / simplesamlphp/simplesamlphp-module-oidc
User identifier attribute option as single value is inadequate with heterogenous IdPs scenarios
@cicnavi is already working on this.
Since Jun 3, 2025.
- Dominant language
- PHP
- Stars
- 50
- Forks
- 28
- Avg merge
- 1m
- Merged PRs (30d)
- 2
Description
Config option for designating user identifier https://github.com/simplesamlphp/simplesamlphp-module-oidc/blob/0080cf2ca10a6c00a80835a9e83638245ce9ea82/config/module_oidc.php.dist#L79 is a single value. This means that it is expected that this attribute is always available in the set of user attributes after user authentication.
In scenarios with multiple different IdPs, like for example in eduGAIN inter-federation, not every IdP will be able (or willing) to provide designated identifier. For this reason, this config option (and all relevant code that uses it) should be refactored in a way to be able to accept multiple prioritized values (array of prioritized values), or be left as single value.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.