Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow OIDC connector to remap claims even if the original claims are not available #2162

Closed
nabokihms opened this issue Jun 7, 2021 · 0 comments · Fixed by #2233
Closed
Milestone

Comments

@nabokihms
Copy link
Member

Is your feature request related to a problem?

There is a problem, that users cannot map custom OIDC token claim to the dex claim.
For example, the original token has two claims:

{
 "email": "[email protected]",
 "preferred_email": "[email protected]",
  ...
}

Apparently, a user wants to use preferred_email as an email claim in Dex but has no opportunity to do it, because the email claim is present in the token.

See corresponding code lines:
https://github.com/dexidp/dex/blob/master/connector/oidc/oidc.go#L306-L310

Describe the solution you'd like to see

Allow users to remap claims even if the standard one exists in the token. There are many OIDC providers that allow claims customization. I see no objections to allowing users to manage claims as they want.

Sadly, making this strategy enabled by default is a breaking change.

Describe alternatives you've considered

Middlewares? :)

Additional context

Was discussed here #2158 (comment)

@nabokihms nabokihms changed the title Allow OIDC connector to remap a claim even if the original claim is not available Allow OIDC connector to remap claims even if the original claims are not available Jun 7, 2021
@sagikazarmark sagikazarmark added this to the v2.31.0 milestone Jan 16, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants