CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Open ID: validate requested claims only if config provides them (#3296)

Browse Source
This commit is contained in:
Richard Schreiber
2023-05-08 14:22:19 +02:00
committed by GitHub
parent 5bacbfa9f1
commit f79ac05dcb
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/pretix/base/customersso/oidc.py
View File

@@ -117,9 +117,11 @@ def oidc_validate_and_complete_config(config):
scopes=", ".join(provider_config.get("scopes_supported", [])) scopes=", ".join(provider_config.get("scopes_supported", []))
)) ))
if "claims_supported" in provider_config:
claims_supported = provider_config.get("claims_supported", [])
for k, v in config.items(): for k, v in config.items():
if k.endswith('_field') and v: if k.endswith('_field') and v:
if v not in provider_config.get("claims_supported", []): # https://openid.net/specs/openid-connect-core-1_0.html#UserInfo if v not in claims_supported: # https://openid.net/specs/openid-connect-core-1_0.html#UserInfo
raise ValidationError(_('You are requesting field "{field}" but provider only supports these: {fields}.').format( raise ValidationError(_('You are requesting field "{field}" but provider only supports these: {fields}.').format(
field=v, field=v,
fields=", ".join(provider_config.get("claims_supported", [])) fields=", ".join(provider_config.get("claims_supported", []))