From 4552eef3f6e9fa2e208f309899661fdeedc9c1c5 Mon Sep 17 00:00:00 2001 From: Juan Zuloaga Date: Wed, 9 Sep 2026 17:11:43 -0100 Subject: [PATCH] OIDC: enable non standard claims in admin check (#230) * OIDC: enable non standard claims in admin check * give priority to UserInfo --- .../oidc/app/src/OIDCAuthenticationController.mjs | 3 ++- .../authentication/oidc/app/src/OIDCAuthenticationManager.mjs | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/services/web/modules/authentication/oidc/app/src/OIDCAuthenticationController.mjs b/services/web/modules/authentication/oidc/app/src/OIDCAuthenticationController.mjs index 1309184608..43d2b86c0a 100644 --- a/services/web/modules/authentication/oidc/app/src/OIDCAuthenticationController.mjs +++ b/services/web/modules/authentication/oidc/app/src/OIDCAuthenticationController.mjs @@ -53,7 +53,8 @@ const OIDCAuthenticationController = { } )(req, res, next) }, - async doPassportLogin(req, issuer, profile, context, idToken, accessToken, refreshToken, done) { + async doPassportLogin(req, issuer, uiProfile, idProfile, context, idToken, accessToken, refreshToken, params, done) { + const profile = uiProfile ?? idProfile //id Profile if _skipUserProfile is true let user, info try { if(req.session.intent === 'link') { diff --git a/services/web/modules/authentication/oidc/app/src/OIDCAuthenticationManager.mjs b/services/web/modules/authentication/oidc/app/src/OIDCAuthenticationManager.mjs index 1cd0baf2ea..937f13fc06 100644 --- a/services/web/modules/authentication/oidc/app/src/OIDCAuthenticationManager.mjs +++ b/services/web/modules/authentication/oidc/app/src/OIDCAuthenticationManager.mjs @@ -23,7 +23,8 @@ const OIDCAuthenticationManager = { if (attAdmin === 'email') { isAdmin = (email === valAdmin) } else { - isAdmin = (profile[attAdmin] === valAdmin) + const adminClaim = profile[attAdmin] || profile._json?.[attAdmin] + isAdmin = (adminClaim === valAdmin) } } const oidcUserData = null // Possibly it can be used later