-
-
Notifications
You must be signed in to change notification settings - Fork 423
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[14.0] auth_oidc add call to validation endpoint #336
base: 14.0
Are you sure you want to change the base?
[14.0] auth_oidc add call to validation endpoint #336
Conversation
needed this to get auth_oidc working with OpenID Connect. ID Token does not contain a Note: the call to the validation endpoint is not necessary from OpenID Connect Authorization Code Flow (because the ID Token can be and is verified with JWKS according to https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.3.7) however auth_oidc/auth_oauth uses the non standard claim subject = next(filter(None, [
validation.pop(key, None)
for key in [
'sub', # standard
'id', # google v1 userinfo, facebook opengraph
'user_id', # google tokeninfo, odoo (tokeninfo)
]
]), None)
...
validation['user_id'] = subject https://github.com/odoo/odoo/blob/14.0/addons/auth_oauth/models/res_users.py#L56 @stellamargonar would something like this also work for the errors you encountered in #325? ....
validation = oauth_provider._parse_id_token(id_token, access_token)
# required check
if "sub" in validation and not "user_id" in validation:
# set user_id for auth_oauth, user_id is not an OpenID Connect standard claim:
# https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
validation["user_id"] = validation["sub"]
elif not validation.get("user_id"):
_logger.error("user_id claim not found in id_token (after mapping).")
raise AccessDenied()
... I tested locally together with #393 in 15.0 against our oauth/openid provider. For reference the error i encountered without this patch:
|
Syncing from upstream OCA/server-auth (15.0)
add call to oauth provider validation endpoint in the auth_oidc module, as explained in #325