Allow OIDC username attribute to be customizable #842
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Recently, I was switching my company authentication from SAML2 to OIDC provided by Okta and I discovered that the default attribute (a claim in OIDC term) used by Hue to create a user account was 'preferred_username'. However, this attribute is not set by our provider and thus, Hue default code hashes the email and create a random user id. This was not desirable.
The solution is to allow OIDC username attribute to be customizable. I've made the appropriate changes as well as keeping the default value 'preferred_username' for backward-compatibility if the newer setting is not provided. This way, with a config change, we can configure OIDC to use 'email' to create a username for a new account in Hue.
CC: @romainr Since you have reviewed a few of my PRs in the past. Thanks in advance!