also log

Emyrk · Emyrk · commit 846a50a0d077 · 2025-02-07T14:50:20.000-06:00
diff --git a/coderd/userauth.go b/coderd/userauth.go
@@ -1096,15 +1096,6 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if idToken.Subject == "" {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "OIDC token missing 'sub' claim field or 'sub' claim field is empty.",
-			Detail: "'sub' claim field is required to be unique for all users by a given issue, " +
-				"an empty field is invalid and this authentication attempt is rejected.",
-		})
-		return
-	}
-
 	logger := api.Logger.Named(userAuthLoggerName)
 
 	// "email_verified" is an optional claim that changes the behavior
@@ -1121,6 +1112,20 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if idToken.Subject == "" {
+		logger.Error(ctx, "oauth2: missing 'sub' claim field in OIDC token",
+			slog.F("source", "id_token"),
+			slog.F("claim_fields", claimFields(idtokenClaims)),
+			slog.F("blank", blankFields(idtokenClaims)),
+		)
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "OIDC token missing 'sub' claim field or 'sub' claim field is empty.",
+			Detail: "'sub' claim field is required to be unique for all users by a given issue, " +
+				"an empty field is invalid and this authentication attempt is rejected.",
+		})
+		return
+	}
+
 	logger.Debug(ctx, "got oidc claims",
 		slog.F("source", "id_token"),
 		slog.F("claim_fields", claimFields(idtokenClaims)),
