Fix issue with Google OAuth integration #2062
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
OIDC doesn't specify the format for access_token. Some providers use it as a JWT to store information about groups (eg: Keycloak), some don't use it as a JWT (eg: Google). So we try to parse it as a JWT but if that fails we ignore the error and move on. In case the access_token is not an JWT, the groups info is stored in the id_token and that's where we look. Refs #2003
|
Hey @thimios and @keanpaderes! Can you please check if this fixes the issue with Google OAuth for you? Also, I'm curious if any of you use groups to manage users and whether you know where Google stores that info in the OAuth payload? It seems groups are only available in a Google Workspace environment. And I don't have access to one to test that functionality. |
|
@sunu the fix works for our setup. We do not use google groups to manage the users, so I do not know much about them. Thanks for pushing this forward. It would be great to have some specs covering the OAuth functionality so that it does not break again in the future. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
OIDC doesn't specify the format for access_token. Some providers use it
as a JWT to store information about groups (eg: Keycloak), some don't
use it as a JWT (eg: Google).
So we try to parse it as a JWT but if that fails we ignore the error
and move on. In case the access_token is not an JWT, the groups info is
stored in the id_token and that's where we look.
Fixes #2003