OIDC authentication and "login" information

[vbrillau]

Hi!

While using an Open-Xchange server running 7.10.5-7_7.1, I found a few issues when using OIDC authentication.
All are probably based on the same issue, that the real "login" is not stored into the session when logging in with OIDC (to be confirmed):
- When using the onboarding wizard, the "login" set for carddav & caldav is `${userid}@${contextid}`. At least when using Resource Owner Password Credentials Grant, it doesn't seem to work (is it sent to the oidc provider as-is?)
- When creating new application password, the "login" displayed (& stored in the DB I believe) is `${userid}@${contextid}`. I think that this doesn't break anything, but is a bit strange nonetheless.

I started looking into the code, but to be honest, I've not yet managed to figure out where the session is populated (without a "login").
I'd guess that a parameter could be added to specify what part of the claim should be considered as the login, what do you think?

Cheers,
Vincent

[vbrillau]

Hi again,

I've finally managed to trace back the issue in the code!

• This `${userid}@${contextid}` is generated at https://github.com/open-xchange/appsuite-middleware/blob/release-7.10.5/com.openexchange.oidc.impl/src/com/openexchange/oidc/spi/AbstractOIDCBackend.java#L254-L260. It make sense from this function point of view, as there is nothing else it can use to identify the user...
• It's called from https://github.com/open-xchange/apps...dler.java#L457 that doesn't have much details either...
• However, that one is called from https://github.com/open-xchange/apps...dler.java#L370 which still has the full ID token that it pulled back from the session reservation!

So I'm not too sure why the original login/username is not kept from the ID token :/
I can see at least two ways to improve this:

• Modify this call stack to pass over the login information
• [If modifying the login in the session is fine after it's created] Use performSessionAdditions, which has all the information relevant, to update it

I guess for backward compatibility, there should be a new configuration parameter that define from which part of the ID token the login should be taken:

• If unset, keep the same`${userid}@${contextid}` as before
• If set, pull that value, if it exist, set it, otherwise default to `${userid}@${contextid}`

What do you think? Would one of these solution be acceptable? Let me know which one and I can try writing a patch (after I figure out how to setup a dev/build environment for OX ).

Thanks in advance,
Vincent