diff options
| author | KN4CK3R <admin@oldschoolhack.me> | 2021-06-14 12:33:16 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-06-14 13:33:16 +0300 |
| commit | 1295e750b4b8cec5476e7666bf9f8f3a02b39785 (patch) | |
| tree | dac0a6348e52a7cd8f6428bf74a9bc2f8b54194c /routers/web | |
| parent | 2b39357443100188ceee0a68408416d166037247 (diff) | |
| download | gitea-1295e750b4b8cec5476e7666bf9f8f3a02b39785.tar.gz gitea-1295e750b4b8cec5476e7666bf9f8f3a02b39785.zip | |
Add OpenID claims "profile" and "email". (#16141)
* Added OpenID claims "profile" and "email".
* Splitted error.
* Added scopes_supported and claims_supported.
* Added more metadata.
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: Lauris BH <lauris@nix.lv>
Diffstat (limited to 'routers/web')
| -rw-r--r-- | routers/web/user/oauth.go | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/routers/web/user/oauth.go b/routers/web/user/oauth.go index 3359c75020..5667eea45c 100644 --- a/routers/web/user/oauth.go +++ b/routers/web/user/oauth.go @@ -185,6 +185,21 @@ func newAccessTokenResponse(grant *models.OAuth2Grant, clientSecret string) (*Ac ErrorDescription: "cannot find application", } } + err = app.LoadUser() + if err != nil { + if models.IsErrUserNotExist(err) { + return nil, &AccessTokenError{ + ErrorCode: AccessTokenErrorCodeInvalidRequest, + ErrorDescription: "cannot find user", + } + } + log.Error("Error loading user: %v", err) + return nil, &AccessTokenError{ + ErrorCode: AccessTokenErrorCodeInvalidRequest, + ErrorDescription: "server error", + } + } + idToken := &models.OIDCToken{ StandardClaims: jwt.StandardClaims{ ExpiresAt: expirationDate.AsTime().Unix(), @@ -194,6 +209,20 @@ func newAccessTokenResponse(grant *models.OAuth2Grant, clientSecret string) (*Ac }, Nonce: grant.Nonce, } + if grant.ScopeContains("profile") { + idToken.Name = app.User.FullName + idToken.PreferredUsername = app.User.Name + idToken.Profile = app.User.HTMLURL() + idToken.Picture = app.User.AvatarLink() + idToken.Website = app.User.Website + idToken.Locale = app.User.Language + idToken.UpdatedAt = app.User.UpdatedUnix + } + if grant.ScopeContains("email") { + idToken.Email = app.User.Email + idToken.EmailVerified = app.User.IsActive + } + signedIDToken, err = idToken.SignToken(clientSecret) if err != nil { return nil, &AccessTokenError{ |