Today I tired to get the groups from a custom created claim "test_affiliation"
For my dummy user account there where two affiliations "staff" and "member"
Sadly the clain is not parsed correctly and i got the group "staff member"
After a bit of digging I found out, that the OAuth 2.0 specs define such claims as a "space-delimited list of values". So that was correct on this side.
I dug a bit into the pas.plugins.oidc and the oic code
|
user_info = client.do_user_info_request(method=method, state=state) |
I found out that the user info claims are parsed via a schema, which is the default schema
try:
_schema = kwargs["user_info_schema"]
except KeyError:
_schema = OpenIDSchemafrom oic/oic/init.py#L947 do_user_info_request
oic.messages.OpenIDSchema
there it is defined how a claim should be parsed, which should be OPTIONAL_LIST_OF_STRINGS for my example.
But of course the default schema does not contain my "test_affiliation", so i got my "staff member" group.
I think there should be some mechanism to extend the schema of the user info claims for them to be parsed correctly.
I will try to implement this somehow, cause I really need it for my Server
Today I tired to get the groups from a custom created claim "test_affiliation"
For my dummy user account there where two affiliations "staff" and "member"
Sadly the clain is not parsed correctly and i got the group "staff member"
After a bit of digging I found out, that the OAuth 2.0 specs define such claims as a "space-delimited list of values". So that was correct on this side.
I dug a bit into the pas.plugins.oidc and the oic code
pas.plugins.oidc/src/pas/plugins/oidc/utils.py
Line 191 in 1794151
I found out that the user info claims are parsed via a schema, which is the default schema
from oic/oic/init.py#L947 do_user_info_request
oic.messages.OpenIDSchema
there it is defined how a claim should be parsed, which should be
OPTIONAL_LIST_OF_STRINGSfor my example.But of course the default schema does not contain my "test_affiliation", so i got my "staff member" group.
I think there should be some mechanism to extend the schema of the user info claims for them to be parsed correctly.
I will try to implement this somehow, cause I really need it for my Server