i'm working on an integration with azure AD. after a successful login, vouch unpacks the body of the OIDC /userinfo response into a structs.User object, which takes values from fields username, email etc.
|
if err = json.Unmarshal(data, user); err != nil { |
when constructing the jwt to store, the claims are constructed using this structs.User.Username.
later when checking the token in /validate, vouch checks if the username is populated and returns 401 if is not.
|
if claims.Username == "" { |
this logic makes the assumption that username is included in the /userinfo response, which in my case it is not. 😞
is there a way to take information like this from the ID token instead of the /userinfo response? in azure AD, i can't configure which fields are included in the /userinfo response (e.g. to add the user's email address), but i can configure which fields are included in the tokens.
vouch config for posterity:
VOUCH_JWT_MAXAGE=20
VOUCH_ALLOWALLUSERS=true
VOUCH_LOGLEVEL=debug
VOUCH_COOKIE_SECURE=false
VOUCH_COOKIE_DOMAIN=localhost
OAUTH_PROVIDER=oidc
OAUTH_CLIENT_ID=...
OAUTH_CLIENT_SECRET=...
OAUTH_BASEURL=https://login.microsoftonline.com/...
OAUTH_AUTH_URL=https://login.microsoftonline.com/.../oauth2/v2.0/authorize
OAUTH_TOKEN_URL=https://login.microsoftonline.com/.../oauth2/v2.0/token
OAUTH_USER_INFO_URL=https://graph.microsoft.com/oidc/userinfo
OAUTH_SCOPES=openid,profile,email
OAUTH_CALLBACK_URLS=http://localhost:9090/auth
i'm working on an integration with azure AD. after a successful login, vouch unpacks the body of the OIDC
/userinforesponse into astructs.Userobject, which takes values from fieldsusername,emailetc.vouch-proxy/pkg/providers/openid/openid.go
Line 55 in 531fc6f
when constructing the jwt to store, the claims are constructed using this
structs.User.Username.vouch-proxy/pkg/jwtmanager/jwtmanager.go
Line 81 in 1f68466
later when checking the token in
/validate, vouch checks if the username is populated and returns 401 if is not.vouch-proxy/handlers/validate.go
Line 48 in 4b6d226
this logic makes the assumption that
usernameis included in the/userinforesponse, which in my case it is not. 😞is there a way to take information like this from the ID token instead of the
/userinforesponse? in azure AD, i can't configure which fields are included in the/userinforesponse (e.g. to add the user's email address), but i can configure which fields are included in the tokens.vouch config for posterity: