Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow OIDC username attribute to be customizable #842

Merged
merged 2 commits into from
Apr 17, 2019
Merged

Allow OIDC username attribute to be customizable #842

merged 2 commits into from
Apr 17, 2019

Conversation

thaibui
Copy link
Contributor

@thaibui thaibui commented Apr 16, 2019

Recently, I was switching my company authentication from SAML2 to OIDC provided by Okta and I discovered that the default attribute (a claim in OIDC term) used by Hue to create a user account was 'preferred_username'. However, this attribute is not set by our provider and thus, Hue default code hashes the email and create a random user id. This was not desirable.

The solution is to allow OIDC username attribute to be customizable. I've made the appropriate changes as well as keeping the default value 'preferred_username' for backward-compatibility if the newer setting is not provided. This way, with a config change, we can configure OIDC to use 'email' to create a username for a new account in Hue.

CC: @romainr Since you have reviewed a few of my PRs in the past. Thanks in advance!

@jdesjean
Copy link
Contributor

Please also add the property to both:
https://github.com/cloudera/hue/blob/master/desktop/conf/pseudo-distributed.ini.tmpl
https://github.com/cloudera/hue/blob/master/desktop/conf.dist/hue.ini

Additionally, would it make sense to simply get the property from desktop.conf and not add it to settings?

@thaibui
Copy link
Contributor Author

thaibui commented Apr 17, 2019

@jdesjean Thanks for reviewing. I've added the new setting to Hue config template.

It would make sense to get the property from desktop.conf, however, I was simply following the pattern that is used in OIDC implementation for consistency sinceimport_from_settings(..) pattern was used everywhere.

I can simply switch to a desktop.conf.OIDC.OIDC_USERNAME_ATTRIBUTE.get(). It's your choice.

@jdesjean jdesjean merged commit 378a07a into cloudera:master Apr 17, 2019
@thaibui thaibui deleted the oidc_username_attribute branch April 17, 2019 19:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants