mirror of
https://github.com/go-gitea/gitea.git
synced 2026-05-06 04:01:05 +09:00
b1bfca39f1
This PR adds an External ID Claim Name configuration field to the OIDC auth source. When set, Gitea uses the specified JWT claim as the user's `ExternalID` instead of the default `sub` claim. This PR fixes the bug when migrating from Azure AD V2 to OIDC. When an admin migrates the same auth source to OIDC, goth's `openidConnect` provider defaults to using the `sub` claim as `UserID`. However, Azure AD's `sub` is a pairwise identifier: > `sub`: The subject is a pairwise identifier and is unique to an application ID. If a single user signs into two different apps using two different client IDs, those apps receive two different values for the subject claim. https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference#payload-claims As a result, every existing user appears as a new account after migration. To fix this issue, Gitea should use `oid` claim for `UserID`. > `oid`: This ID uniquely identifies the user across applications - two different applications signing in the same user receives the same value in the oid claim. Note: The `oid` claim is not included in Azure AD tokens by default. The `profile` scope must be added to the Scopes field of the auth source.
106 lines
2.9 KiB
Go
106 lines
2.9 KiB
Go
// Copyright 2014 The Gogs Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package forms
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"code.gitea.io/gitea/modules/web/middleware"
|
|
"code.gitea.io/gitea/services/context"
|
|
|
|
"gitea.com/go-chi/binding"
|
|
)
|
|
|
|
// AuthenticationForm form for authentication
|
|
type AuthenticationForm struct {
|
|
ID int64
|
|
Type int `binding:"Range(2,7)"`
|
|
Name string `binding:"Required;MaxSize(30)"`
|
|
TwoFactorPolicy string
|
|
IsActive bool
|
|
IsSyncEnabled bool
|
|
|
|
// LDAP
|
|
Host string
|
|
Port int
|
|
BindDN string
|
|
BindPassword string
|
|
UserBase string
|
|
UserDN string
|
|
AttributeUsername string
|
|
AttributeName string
|
|
AttributeSurname string
|
|
AttributeMail string
|
|
AttributeSSHPublicKey string
|
|
AttributeAvatar string
|
|
SSHKeysAreVerified bool
|
|
AttributesInBind bool
|
|
UsePagedSearch bool
|
|
SearchPageSize int
|
|
Filter string
|
|
AdminFilter string
|
|
GroupsEnabled bool
|
|
GroupDN string
|
|
GroupFilter string
|
|
GroupMemberUID string
|
|
UserUID string
|
|
RestrictedFilter string
|
|
AllowDeactivateAll bool
|
|
GroupTeamMap string `binding:"ValidGroupTeamMap"`
|
|
GroupTeamMapRemoval bool
|
|
|
|
// SMTP
|
|
SMTPAuth string
|
|
SMTPHost string
|
|
SMTPPort int
|
|
AllowedDomains string
|
|
SecurityProtocol int `binding:"Range(0,2)"`
|
|
TLS bool
|
|
SkipVerify bool
|
|
HeloHostname string
|
|
DisableHelo bool
|
|
ForceSMTPS bool
|
|
|
|
// PAM
|
|
PAMServiceName string
|
|
PAMEmailDomain string
|
|
|
|
// Oauth2 & OIDC
|
|
Oauth2Provider string
|
|
Oauth2Key string
|
|
Oauth2Secret string
|
|
OpenIDConnectAutoDiscoveryURL string
|
|
Oauth2UseCustomURL bool
|
|
Oauth2TokenURL string
|
|
Oauth2AuthURL string
|
|
Oauth2ProfileURL string
|
|
Oauth2EmailURL string
|
|
Oauth2IconURL string
|
|
Oauth2Tenant string
|
|
Oauth2Scopes string
|
|
Oauth2RequiredClaimName string
|
|
Oauth2RequiredClaimValue string
|
|
Oauth2GroupClaimName string
|
|
Oauth2AdminGroup string
|
|
Oauth2RestrictedGroup string
|
|
Oauth2GroupTeamMap string `binding:"ValidGroupTeamMap"`
|
|
Oauth2GroupTeamMapRemoval bool
|
|
Oauth2SSHPublicKeyClaimName string
|
|
Oauth2FullNameClaimName string
|
|
OpenIDConnectExternalIDClaim string
|
|
|
|
// SSPI
|
|
SSPIAutoCreateUsers bool
|
|
SSPIAutoActivateUsers bool
|
|
SSPIStripDomainNames bool
|
|
SSPISeparatorReplacement string `binding:"AlphaDashDot;MaxSize(5)"`
|
|
SSPIDefaultLanguage string
|
|
}
|
|
|
|
// Validate validates fields
|
|
func (f *AuthenticationForm) Validate(req *http.Request, errs binding.Errors) binding.Errors {
|
|
ctx := context.GetValidateContext(req)
|
|
return middleware.Validate(errs, ctx.Data, f, ctx.Locale)
|
|
}
|