connectors/oidc: mapping the non-standard claims to standard one

[morarucostel]

Hello,
We are using oauth2-proxy together with dex and would like know if it is possible to get the standard claims like given_name and family_name back into id_token returned by dex?

The oauth2-proxy is configured to use dex as the issuer-url, and dex is configuring the real IdP as an oidc connector with

  connectors:
  - config:
      clientID: XXXXXXXX
      clientSecret: YYYYYYYY
      issuer: real_idp_issuer_url
      redirectURI: real_dex_callback
    id: idp_staging
    name: idp staging
    type: oidc

The jwt returned by the IdP is something like:

{
    "s_hash": "some-hash-here",
    "sub": "[email protected]",
    "name": "John Doe",
    "firstName": "John",
    "emailAddress": "[email protected]",
    "lastName": "Doe",
    "aud": "value-here",
    "iat": numeric-value-here,
    "exp": numeric-value-here
....
  }

and the jwt returned by dex to oauth2-proxy is:

{
  "at_hash": "some-hash-here",
  "aud": "oauth2-proxy",
  "email": "[email protected]",
  "email_verified": true,
  "exp": numeric-value-here,
  "iat": numeric-value-here,
  "iss": "https://domain/dex",
  "name": "John Doe",
  "preferred_username": "[email protected]",
  "sub": "edited-value"
}

Is there any way either in dex's configuration, or via claimMapping or any other way, to map the firstName claim from the IdP's jwt to dex's issued jwt either as standard or non-standard claim?
So, basically, we would like to get back from dex, part of the id_token, also the firstName and lastName as given_name and family_name. What should we change in the configuration?

[morarucostel]

Hey @JoelSpeed, any idea on how this might work?

[JoelSpeed]

This is an interesting one; I'm not sure if this is possible today.

In Dex, as far as I'm aware we don't have a way to customise what's generated into the ID Token, however, the information you want should IIRC be in the userinfo endpoint (if you have a Dex handy and could verify that, that would be ideal).

In OAuth2 Proxy, we want to add arbitrary claim mapping into our sessions, but have only recently got a point anywhere near being able to do this. The idea would be that the user supplies a list of claims and we try to extract from either the ID Token or the userinfo, at this point, once it's in the session, you can use OAuth2 Proxy (alpha) config to map this to headers for consumption by the upstream.

If you want to do this sooner, you may be able to pass the Dex ID Token to your app and call the Dex userinfo endpoint from there, depends how deep you want to get into that?

[morarucostel]

Thanks @JoelSpeed for the quick answer.

Definitely we don't want to make a call from the application layer to dex userinfo endpoint, we want to keep it abstract to the application.
So, I'm getting that the information we want is available in the userinfo endpoint but currently there is no way in consolidating all of that into the id_token that is returned by dex.

The actual problem that I'm trying to bypass is the fact that our IdP returns a claim in the id_token, that for some users can be quite big and breaks the downstream apps, and we don't even want it, nor we can configure the idp not to send it.

[JoelSpeed]

As far as I'm aware, it's not configurable today, but should be available once we get this extra claim mapping I mentioned in OAuth2 Proxy (CC @NickMeves)

We may also want to look into adding this to Dex in the longer term as a way to allow users to extract extra values from their IDP UserInfo or Tokens and make these available to downstream consumers