feat(dex): add option to modify userid claim, skip email_verified verification

api/v1alpha1/organization_types.go

@@ -85,6 +85,18 @@ type OIDCConfig struct {
 	// OAuth2ClientRedirectURIs are a registered set of redirect URIs. When redirecting from the idproxy to
 	// the client application, the URI requested to redirect to must be contained in this list.
 	OAuth2ClientRedirectURIs []string `json:"oauth2ClientRedirectURIs,omitempty"`
+	// ExtraClaims contains additional configuration for extra claims.
+	ExtraConfig *OIDCExtraConfig `json:"extraConfig,omitempty"`
+}
+
+type OIDCExtraConfig struct {
+	// InsecureSkipEmailVerified allows to skip the verification of the "email_verified" claim in ID tokens.
+	// +kubebuilder:default:=false
+	// +kubebuilder:validation:Enum:=true;false
+	InsecureSkipEmailVerified bool `json:"insecureSkipEmailVerified,omitempty"`
+	// UserIDClaim is the claim to be used as user ID.
+	// +kubebuilder:default:="login_name"
+	UserIDClaim string `json:"userIDClaim,omitempty"`
 }
 
 type SCIMConfig struct {

charts/manager/crds/greenhouse.sap_organizations.yaml

@@ -92,6 +92,25 @@ spec:
                         - key
                         - name
                         type: object
+                      extraConfig:
+                        description: ExtraClaims contains additional configuration
+                          for extra claims.
+                        properties:
+                          insecureSkipEmailVerified:
+                            default: false
+                            description: InsecureSkipEmailVerified allows to skip
+                              the verification of the "email_verified" claim in ID
+                              tokens.
+                            enum:
+                            - true
+                            - false
+                            type: boolean
+                          userIDClaim:
+                            default: login_name
+                            description: UserIDClaim is the claim to be used as user
+                              ID.
+                            type: string
+                        type: object
                       issuer:
                         description: Issuer is the URL of the identity service.
                         type: string

config/samples/organization/demo.yaml

@@ -53,3 +53,5 @@ spec:
         name: demo-oidc
       issuer: https://global.accounts.dev
       redirectURI: https://bogus.accounts.foo
+      insecureSkipEmailVerified: true
+      userIDClaim: email

docs/reference/api/index.html

@@ -1978,6 +1978,61 @@ <h3 id="greenhouse.sap/v1alpha1.OIDCConfig">OIDCConfig
 the client application, the URI requested to redirect to must be contained in this list.</p>
 </td>
 </tr>
+<tr>
+<td>
+<code>extraConfig</code><br>
+<em>
+<a href="#greenhouse.sap/v1alpha1.OIDCExtraConfig">
+OIDCExtraConfig
+</a>
+</em>
+</td>
+<td>
+<p>ExtraClaims contains additional configuration for extra claims.</p>
+</td>
+</tr>
+</tbody>
+</table>
+</div>
+</div>
+<h3 id="greenhouse.sap/v1alpha1.OIDCExtraConfig">OIDCExtraConfig
+</h3>
+<p>
+(<em>Appears on:</em>
+<a href="#greenhouse.sap/v1alpha1.OIDCConfig">OIDCConfig</a>)
+</p>
+<div class="md-typeset__scrollwrap">
+<div class="md-typeset__table">
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>
+<code>insecureSkipEmailVerified</code><br>
+<em>
+bool
+</em>
+</td>
+<td>
+<p>InsecureSkipEmailVerified allows to skip the verification of the &ldquo;email_verified&rdquo; claim in ID tokens.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>userIDClaim</code><br>
+<em>
+string
+</em>
+</td>
+<td>
+<p>UserIDClaim is the claim to be used as user ID.</p>
+</td>
+</tr>
 </tbody>
 </table>
 </div>

docs/reference/api/openapi.yaml

@@ -686,6 +686,21 @@ components:
                         - key
                         - name
                       type: object
+                    extraConfig:
+                      description: ExtraClaims contains additional configuration for extra claims.
+                      properties:
+                        insecureSkipEmailVerified:
+                          default: false
+                          description: InsecureSkipEmailVerified allows to skip the verification of the "email_verified" claim in ID tokens.
+                          enum:
+                            - true
+                            - false
+                          type: boolean
+                        userIDClaim:
+                          default: login_name
+                          description: UserIDClaim is the claim to be used as user ID.
+                          type: string
+                      type: object
                     issuer:
                       description: Issuer is the URL of the identity service.
                       type: string

internal/controller/organization/dex.go

@@ -110,15 +110,26 @@ func (r *OrganizationReconciler) reconcileDexConnector(ctx context.Context, org
 	if err != nil {
 		return err
 	}
+	var userNameKey = "login_name"
+	var skipEmailVerified = false
+	if org.Spec.Authentication.OIDCConfig.ExtraConfig != nil {
+		if org.Spec.Authentication.OIDCConfig.ExtraConfig.UserIDClaim == "" {
+			userNameKey = org.Spec.Authentication.OIDCConfig.ExtraConfig.UserIDClaim
+		}
+		if org.Spec.Authentication.OIDCConfig.ExtraConfig != nil {
+			skipEmailVerified = org.Spec.Authentication.OIDCConfig.ExtraConfig.InsecureSkipEmailVerified
+		}
+	}
 	oidcConfig := &oidc.Config{
-		Issuer:               org.Spec.Authentication.OIDCConfig.Issuer,
-		ClientID:             clientID,
-		ClientSecret:         clientSecret,
-		RedirectURI:          redirectURL,
-		UserNameKey:          "login_name",
-		UserIDKey:            "login_name",
-		InsecureSkipVerify:   true,
-		InsecureEnableGroups: true,
+		Issuer:                    org.Spec.Authentication.OIDCConfig.Issuer,
+		ClientID:                  clientID,
+		ClientSecret:              clientSecret,
+		RedirectURI:               redirectURL,
+		UserNameKey:               userNameKey,
+		UserIDKey:                 userNameKey,
+		InsecureSkipEmailVerified: skipEmailVerified,
+		InsecureSkipVerify:        true,
+		InsecureEnableGroups:      true,
 	}
 	configByte, err := json.Marshal(oidcConfig)
 	if err != nil {

types/typescript/schema.d.ts

@@ -539,6 +539,12 @@ export interface components {
                             /** @description Name of the secret in the same namespace. */
                             name: string;
                         };
+                        /**
+                         * @description InsecureSkipEmailVerified allows to skip the verification of the "email_verified" claim in ID tokens.
+                         * @default false
+                         * @enum {boolean}
+                         */
+                        insecureSkipEmailVerified: true | false;
                         /** @description Issuer is the URL of the identity service. */
                         issuer: string;
                         /**
@@ -551,6 +557,11 @@ export interface components {
                          *     If none is specified, the Greenhouse ID proxy will be used.
                          */
                         redirectURI?: string;
+                        /**
+                         * @description UserIDClaim is the claim to be used as user ID.
+                         * @default login_name
+                         */
+                        userIDClaim: string;
                     };
                     /** @description SCIMConfig configures the SCIM client. */
                     scim?: {