CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Open ID: validate requested claims only if config provides them (#3296)

Browse Source
This commit is contained in:
Richard Schreiber
2023-05-08 14:22:19 +02:00
committed by GitHub
parent 5bacbfa9f1
commit f79ac05dcb
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/pretix/base/customersso/oidc.py
View File

@@ -117,13 +117,15 @@ def oidc_validate_and_complete_config(config):
scopes=", ".join(provider_config.get("scopes_supported", [])) scopes=", ".join(provider_config.get("scopes_supported", []))
)) ))
for k, v in config.items(): if "claims_supported" in provider_config:
if k.endswith('_field') and v: claims_supported = provider_config.get("claims_supported", [])
if v not in provider_config.get("claims_supported", []): # https://openid.net/specs/openid-connect-core-1_0.html#UserInfo for k, v in config.items():
raise ValidationError(_('You are requesting field "{field}" but provider only supports these: {fields}.').format( if k.endswith('_field') and v:
field=v, if v not in claims_supported: # https://openid.net/specs/openid-connect-core-1_0.html#UserInfo
fields=", ".join(provider_config.get("claims_supported", [])) raise ValidationError(_('You are requesting field "{field}" but provider only supports these: {fields}.').format(
)) field=v,
fields=", ".join(provider_config.get("claims_supported", []))
))
config['provider_config'] = provider_config config['provider_config'] = provider_config
return config return config