simplesamlphp / simplesamlphp/simplesamlphp-module-oidc

User identifier attribute option as single value is inadequate with heterogenous IdPs scenarios

Open
#307 1 comment 0 reactions 1 assignee View on GitHub

@cicnavi is already working on this.

Since Jun 3, 2025.

enhancement prepared
Dominant language
PHP
Stars
50
Forks
28
Avg merge
1m
Merged PRs (30d)
2

Description

Config option for designating user identifier https://github.com/simplesamlphp/simplesamlphp-module-oidc/blob/0080cf2ca10a6c00a80835a9e83638245ce9ea82/config/module_oidc.php.dist#L79 is a single value. This means that it is expected that this attribute is always available in the set of user attributes after user authentication.

In scenarios with multiple different IdPs, like for example in eduGAIN inter-federation, not every IdP will be able (or willing) to provide designated identifier. For this reason, this config option (and all relevant code that uses it) should be refactored in a way to be able to accept multiple prioritized values (array of prioritized values), or be left as single value.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.