From 6c3e8798a78d5eadc511b4c7996e9a7937aba515 Mon Sep 17 00:00:00 2001 From: Giuseppe Lo Presti Date: Wed, 20 Apr 2022 15:30:50 +0200 Subject: [PATCH] Do not fail when uid/gid are missing --- pkg/auth/manager/oidc/oidc.go | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/pkg/auth/manager/oidc/oidc.go b/pkg/auth/manager/oidc/oidc.go index c0cd2748314..e02ff318794 100644 --- a/pkg/auth/manager/oidc/oidc.go +++ b/pkg/auth/manager/oidc/oidc.go @@ -198,16 +198,12 @@ func (am *mgr) Authenticate(ctx context.Context, clientID, clientSecret string) if claims["email"] == nil { return nil, nil, fmt.Errorf("no \"email\" attribute found in userinfo: maybe the client did not request the oidc \"email\"-scope") } - if uid, ok := claims[am.c.UIDClaim].(float64); ok { - claims[am.c.UIDClaim] = int64(uid) - } else { - return nil, nil, fmt.Errorf("malformed or missing uid claim in userinfo: '%v'", claims[am.c.UIDClaim]) - } - if gid, ok := claims[am.c.GIDClaim].(float64); ok { - claims[am.c.GIDClaim] = int64(gid) - } else { - return nil, nil, fmt.Errorf("malformed or missing gid claim in userinfo: '%v'", claims[am.c.GIDClaim]) - } + + uid, _ := claims[am.c.UIDClaim].(float64) + claims[am.c.UIDClaim] = int64(uid) // in case the uid claim is missing, resolveUser() should populate it + // Note that if not, will silently carry a user with 0 uid, potentially problematic with storage providers + gid, _ := claims[am.c.GIDClaim].(float64) + claims[am.c.GIDClaim] = int64(gid) err = am.resolveUser(ctx, claims) if err != nil {