chore: prevent non-unqiue oidc subjects from authenticating

Emyrk · Emyrk · commit c9599f28051e · 2025-02-07T14:11:12.000-06:00
Any IdP returning an empty field here breaks the assumption of a
unique subject id. This is defined in the OIDC spec.
diff --git a/coderd/userauth.go b/coderd/userauth.go
@@ -1096,6 +1096,15 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if idToken.Subject == "" {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "OIDC token missing 'sub' claim field or 'sub' claim field is empty.",
+			Detail: "'sub' claim field is required to be unique for all users by a given issue, " +
+				"an empty field is invalid and this authentication attempt is rejected.",
+		})
+		return
+	}
+
 	logger := api.Logger.Named(userAuthLoggerName)
 
 	// "email_verified" is an optional claim that changes the behavior
