fix: generate email if it is the empty string on external login #2868
Conversation
Change-Id: I379382bb07c5e01766ff1ce131f560eabfef253b
|
We have created an issue in Pivotal Tracker to manage this: https://www.pivotaltracker.com/story/show/187543759 The labels on this github issue will be updated when the story is started. |
|
Without the change, the test case will throw an exception: java.lang.IllegalArgumentException: Email is required Because UaaUser has Assert.hasText(prototype.getEmail(), "Email is required") which is inconsistent with the null check in ExternalLoginAuthenticationManager. |
| @@ -380,8 +380,8 @@ protected UaaUser getUser(Authentication request, AuthenticationData authenticat | |||
| Object verifiedObj = claims.get(emailVerifiedClaim == null ? "email_verified" : emailVerifiedClaim); | |||
| boolean verified = verifiedObj instanceof Boolean ? (Boolean)verifiedObj: false; | |||
|
|
|||
| if (email == null) { | |||
| email = generateEmailIfNull(username); | |||
| if (!StringUtils.hasText(email)) { | |||
There was a problem hiding this comment.
Why use !StringUtils.hasText(email) here but StringUtils.isEmpty(email) in ExternalLoginAuthenticationManager.java? Why the different logics?
It looks like !StringUtils.hasText is a narrower/stricter validation? It also evaluates to true if the string contains only whitespace(s).
There was a problem hiding this comment.
Only because this one uses the Spring StringUtils and isEmpty is deprecated. ExternalLoginAuthenticationManager uses the Apache StringUtils. I didn't want to affect other lines of code by changing one or the other, and I didn't want to use a deprecated method.
|
Also, what is the issue in real life? When logging in with an external IDP, the email value we get from the IDP would be an empty string & the user will fail to log in due to "Email is required" error? Why would the IDP has an empty string as the email (instead of just not having it)? Is the real issue here the operator didn't set up the |
The issue is that it's treated inconsistently. A null email will result in one being generated. An empty string will throw an exception that email is required. In reality an attributeMapping for email is not required, that why we can generate one. So we should be consistent about how we do that. |
|
Hi @mikeroda, approved, please merge. |
I don't have merge rights. |
If the email is the empty string, treat it as null and generate one.