Skip to content

Commit de0601d

Browse files
janLocoadler
janLo
and
coadler
authored
feat: allow configurable username claim field in OIDC (#5507)
Co-authored-by: Colin Adler <colin1adler@gmail.com>
1 parent 8968a00 commit de0601d

File tree

11 files changed

+59
-3
lines changed

11 files changed

+59
-3
lines changed

‎cli/deployment/config.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -248,6 +248,12 @@ func newConfig() *codersdk.DeploymentConfig {
248248
Flag: "oidc-ignore-email-verified",
249249
Default: false,
250250
},
251+
UsernameField: &codersdk.DeploymentConfigField[string]{
252+
Name: "OIDC Username Field",
253+
Usage: "OIDC claim field to use as the username.",
254+
Flag: "oidc-username-field",
255+
Default: "preferred_username",
256+
},
251257
},
252258

253259
Telemetry: &codersdk.TelemetryConfig{

‎cli/server.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -526,8 +526,9 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
526526
Verifier: oidcProvider.Verifier(&oidc.Config{
527527
ClientID: cfg.OIDC.ClientID.Value,
528528
}),
529-
EmailDomain: cfg.OIDC.EmailDomain.Value,
530-
AllowSignups: cfg.OIDC.AllowSignups.Value,
529+
EmailDomain: cfg.OIDC.EmailDomain.Value,
530+
AllowSignups: cfg.OIDC.AllowSignups.Value,
531+
UsernameField: cfg.OIDC.UsernameField.Value,
531532
}
532533
}
533534

‎cli/testdata/coder_server_--help.golden

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,9 @@ Flags:
112112
OIDC.
113113
Consumes $CODER_OIDC_SCOPES (default
114114
[openid,profile,email])
115+
--oidc-username-field string OIDC claim field to use as the username.
116+
Consumes $CODER_OIDC_USERNAME_FIELD
117+
(default "preferred_username")
115118
--postgres-url string URL of a PostgreSQL database. If empty,
116119
PostgreSQL binaries will be downloaded
117120
from Maven

‎coderd/apidoc/docs.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1975,6 +1975,9 @@ const docTemplate = `{
19751975
},
19761976
"scopes": {
19771977
"$ref": "#/definitions/codersdk.DeploymentConfigField-array_string"
1978+
},
1979+
"username_field": {
1980+
"$ref": "#/definitions/codersdk.DeploymentConfigField-string"
19781981
}
19791982
}
19801983
},

‎coderd/apidoc/swagger.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1795,6 +1795,9 @@
17951795
},
17961796
"scopes": {
17971797
"$ref": "#/definitions/codersdk.DeploymentConfigField-array_string"
1798+
},
1799+
"username_field": {
1800+
"$ref": "#/definitions/codersdk.DeploymentConfigField-string"
17981801
}
17991802
}
18001803
},

‎coderd/coderdtest/coderdtest.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -880,6 +880,7 @@ func (o *OIDCConfig) OIDCConfig() *coderd.OIDCConfig {
880880
}, &oidc.Config{
881881
SkipClientIDCheck: true,
882882
}),
883+
UsernameField: "preferred_username",
883884
}
884885
}
885886

‎coderd/userauth.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,9 @@ type OIDCConfig struct {
198198
// IgnoreEmailVerified allows ignoring the email_verified claim
199199
// from an upstream OIDC provider. See #5065 for context.
200200
IgnoreEmailVerified bool
201+
// UsernameField selects the claim field to be used as the created user's
202+
// username.
203+
UsernameField string
201204
}
202205

203206
func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
@@ -236,7 +239,7 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
236239
})
237240
return
238241
}
239-
usernameRaw, ok := claims["preferred_username"]
242+
usernameRaw, ok := claims[api.OIDCConfig.UsernameField]
240243
var username string
241244
if ok {
242245
username, _ = usernameRaw.(string)

‎codersdk/deploymentconfig.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ type OIDCConfig struct {
9999
IssuerURL *DeploymentConfigField[string] `json:"issuer_url" typescript:",notnull"`
100100
Scopes *DeploymentConfigField[[]string] `json:"scopes" typescript:",notnull"`
101101
IgnoreEmailVerified *DeploymentConfigField[bool] `json:"ignore_email_verified" typescript:",notnull"`
102+
UsernameField *DeploymentConfigField[string] `json:"username_field" typescript:",notnull"`
102103
}
103104

104105
type TelemetryConfig struct {

‎docs/api/general.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -535,6 +535,17 @@ curl -X GET http://coder-server:8080/api/v2/config/deployment \
535535
"shorthand": "string",
536536
"usage": "string",
537537
"value": "string"
538+
},
539+
"username_field": {
540+
"default": "string",
541+
"enterprise": true,
542+
"flag": "string",
543+
"hidden": true,
544+
"name": "string",
545+
"secret": true,
546+
"shorthand": "string",
547+
"usage": "string",
548+
"value": "string"
538549
}
539550
},
540551
"pg_connection_url": {

‎docs/api/schemas.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1119,6 +1119,17 @@ CreateParameterRequest is a structure used to create a new parameter value for a
11191119
"shorthand": "string",
11201120
"usage": "string",
11211121
"value": "string"
1122+
},
1123+
"username_field": {
1124+
"default": "string",
1125+
"enterprise": true,
1126+
"flag": "string",
1127+
"hidden": true,
1128+
"name": "string",
1129+
"secret": true,
1130+
"shorthand": "string",
1131+
"usage": "string",
1132+
"value": "string"
11221133
}
11231134
},
11241135
"pg_connection_url": {
@@ -2072,6 +2083,17 @@ CreateParameterRequest is a structure used to create a new parameter value for a
20722083
"shorthand": "string",
20732084
"usage": "string",
20742085
"value": "string"
2086+
},
2087+
"username_field": {
2088+
"default": "string",
2089+
"enterprise": true,
2090+
"flag": "string",
2091+
"hidden": true,
2092+
"name": "string",
2093+
"secret": true,
2094+
"shorthand": "string",
2095+
"usage": "string",
2096+
"value": "string"
20752097
}
20762098
}
20772099
```
@@ -2087,6 +2109,7 @@ CreateParameterRequest is a structure used to create a new parameter value for a
20872109
| `ignore_email_verified` | [codersdk.DeploymentConfigField-bool](#codersdkdeploymentconfigfield-bool) | false | | |
20882110
| `issuer_url` | [codersdk.DeploymentConfigField-string](#codersdkdeploymentconfigfield-string) | false | | |
20892111
| `scopes` | [codersdk.DeploymentConfigField-array_string](#codersdkdeploymentconfigfield-array_string) | false | | |
2112+
| `username_field` | [codersdk.DeploymentConfigField-string](#codersdkdeploymentconfigfield-string) | false | | |
20902113

20912114
## codersdk.Parameter
20922115

‎site/src/api/typesGenerated.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -452,6 +452,7 @@ export interface OIDCConfig {
452452
readonly issuer_url: DeploymentConfigField<string>
453453
readonly scopes: DeploymentConfigField<string[]>
454454
readonly ignore_email_verified: DeploymentConfigField<boolean>
455+
readonly username_field: DeploymentConfigField<string>
455456
}
456457

457458
// From codersdk/organizations.go

0 commit comments

Comments
 (0)