Allow arbitrary claims from the IDToken to be injected into the response header #2685
Conversation
vegetablest
changed the title
vegetablest
changed the title
|
Hey @vegetablest, |
pkg/apis/options/providers.go
Outdated
| @@ -84,6 +84,9 @@ type Provider struct { | |||
| // The code challenge method | |||
| CodeChallengeMethod string `json:"code_challenge_method,omitempty"` | |||
|
|
|||
| // Allows additional claims to be obtained from the `id_token`. | |||
| AllowAdditionalClaims []string `json:"allowAdditionalClaims,omitempty"` | |||
There was a problem hiding this comment.
I don't think this a good naming scheme.
In my opinion AllowXX indicates a boolean value instead we should call it AllowedAddiotionalClaims or even better just AdditionalClaims
There was a problem hiding this comment.
I don't think this a good naming scheme.
In my opinion AllowXX indicates a boolean value instead we should call it AllowedAddiotionalClaims or even better just AdditionalClaims
I agree, I have made the correction.
vegetablest
force-pushed
the
feat/claim
branch
3 times, most recently
from
7214b2e to
cc56acc
Compare
|
Is there a timeline for when this feature will be available? |
vegetablest
force-pushed
the
feat/claim
branch
from
cc56acc to
dc45272
Compare
|
@vegetablest diff --git a/oauthproxy.go b/oauthproxy.go
index ca9d4e97..8ed2c68e 100644
--- a/oauthproxy.go
+++ b/oauthproxy.go
@@ -718,15 +718,17 @@ func (p *OAuthProxy) UserInfo(rw http.ResponseWriter, req *http.Request) {
}
userInfo := struct {
- User string `json:"user"`
- Email string `json:"email"`
- Groups []string `json:"groups,omitempty"`
- PreferredUsername string `json:"preferredUsername,omitempty"`
+ User string `json:"user"`
+ Email string `json:"email"`
+ Groups []string `json:"groups,omitempty"`
+ PreferredUsername string `json:"preferredUsername,omitempty"`
+ AdditionalClaims map[string]interface{} `json:"additionalClaims,omitempty"`
}{
User: session.User,
Email: session.Email,
Groups: session.Groups,
PreferredUsername: session.PreferredUsername,
+ AdditionalClaims: session.AdditionalClaims,
}
if err := json.NewEncoder(rw).Encode(userInfo); err != nil { |
|
@artificiosus Thanks for the suggestion! I think it’s a great idea, but it might be better to address this in a separate PR to keep the focus on the issue at hand. Once this PR is merged, I’d be happy to work on the other issue. |
chore: a chore: a
vegetablest
force-pushed
the
feat/claim
branch
from
dc45272 to
e934486
Compare
Description
Allows retrieval of additional claims from
IDToken.Motivation and Context
The
IDTokenfrom theOIDCProviderI'm using contains claims that I want to use, but currently only a few of them can be injected into the response headers. This change allows users to specify additional claims from theIDTokenthat they want to include.Checklist: