mbiryukova/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity

Revert using preferred_username

Browse source 
It might present a security issue if the users can change this value for themselves. Needs further investigation
This commit is contained in:
Cristian Le 2021-05-05 08:12:17 +09:00
parent e5b206c1de
commit bb1e051b27
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
authority/provisioner/oidc.go
View file

@ -389,7 +389,8 @@ func (o *OIDC) AuthorizeSSHSign(ctx context.Context, token string) ([]SignOption
// Get the identity using either the default identityFunc or one injected
// externally. Note that the PreferredUsername might be empty.
iden, err := o.getIdentityFunc(ctx, o, claims.Email, claims.PreferredUsername)
// TBD: Would preferred_username present a safety issue here?
iden, err := o.getIdentityFunc(ctx, o, claims.Email)
if err != nil {
return nil, errs.Wrap(http.StatusInternalServerError, err, "oidc.AuthorizeSSHSign")
}