fix: Remove case sensitivity check in OIDC email domain (coder#4534)

kylecarbs · web-flow · commit 574e5d37c76c · 2022-10-13T15:51:54.000Z
Fixes coder#4533.
diff --git a/coderd/userauth.go b/coderd/userauth.go
@@ -261,7 +261,7 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
 		username = httpapi.UsernameFrom(username)
 	}
 	if api.OIDCConfig.EmailDomain != "" {
-		if !strings.HasSuffix(email, api.OIDCConfig.EmailDomain) {
+		if !strings.HasSuffix(strings.ToLower(email), strings.ToLower(api.OIDCConfig.EmailDomain)) {
 			httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
 				Message: fmt.Sprintf("Your email %q is not a part of the %q domain!", email, api.OIDCConfig.EmailDomain),
 			})
diff --git a/coderd/userauth_test.go b/coderd/userauth_test.go
@@ -373,6 +373,15 @@ func TestUserOIDC(t *testing.T) {
 		AllowSignups: true,
 		EmailDomain:  "coder.com",
 		StatusCode:   http.StatusForbidden,
+	}, {
+		Name: "EmailDomainCaseInsensitive",
+		Claims: jwt.MapClaims{
+			"email":          "kyle@KWC.io",
+			"email_verified": true,
+		},
+		AllowSignups: true,
+		EmailDomain:  "kwc.io",
+		StatusCode:   http.StatusTemporaryRedirect,
 	}, {
 		Name:         "EmptyClaims",
 		Claims:       jwt.MapClaims{},

Original file line number	Diff line number	Diff line change
`@@ -261,7 +261,7 @@ func (api API) userOIDC(rw http.ResponseWriter, r http.Request) {`
`261`	`261`	`username = httpapi.UsernameFrom(username)`
`262`	`262`	`}`
`263`	`263`	`if api.OIDCConfig.EmailDomain != "" {`
`264`		`- if !strings.HasSuffix(email, api.OIDCConfig.EmailDomain) {`
	`264`	`+ if !strings.HasSuffix(strings.ToLower(email), strings.ToLower(api.OIDCConfig.EmailDomain)) {`
`265`	`265`	`httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{`
`266`	`266`	`Message: fmt.Sprintf("Your email %q is not a part of the %q domain!", email, api.OIDCConfig.EmailDomain),`
`267`	`267`	`})`