mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-29 18:36:30 +02:00
418ee79e1a
Currently, the Session proto id_token field is populated with Pomerium session data during initial login, but with IdP ID token data after an IdP session refresh. Instead, store only IdP ID token data in this field. Update the existing SetRawIDToken method to populate the structured data fields based on the contents of the raw ID token. Remove the other code that sets these fields (in the authenticateflow package and in manager.sessionUnmarshaler). Add a test for the identity manager, exercising the combined effect of session claims unmarshaling and SetRawIDToken(), to verify that the combined behavior is preserved unchanged.
35 lines
961 B
Go
35 lines
961 B
Go
// Package authenticateflow implements the core authentication flow. This
|
|
// includes creating and parsing sign-in redirect URLs, storing and retrieving
|
|
// session data, and handling authentication callback URLs.
|
|
package authenticateflow
|
|
|
|
import (
|
|
"fmt"
|
|
"time"
|
|
|
|
"google.golang.org/protobuf/types/known/structpb"
|
|
|
|
"github.com/pomerium/pomerium/pkg/grpc"
|
|
"github.com/pomerium/pomerium/pkg/grpc/user"
|
|
"github.com/pomerium/pomerium/pkg/identity"
|
|
)
|
|
|
|
// timeNow is time.Now but pulled out as a variable for tests.
|
|
var timeNow = time.Now
|
|
|
|
var outboundGRPCConnection = new(grpc.CachedOutboundGRPClientConn)
|
|
|
|
func populateUserFromClaims(u *user.User, claims map[string]any) {
|
|
if v, ok := claims["name"]; ok {
|
|
u.Name = fmt.Sprint(v)
|
|
}
|
|
if v, ok := claims["email"]; ok {
|
|
u.Email = fmt.Sprint(v)
|
|
}
|
|
if u.Claims == nil {
|
|
u.Claims = make(map[string]*structpb.ListValue)
|
|
}
|
|
for k, vs := range identity.Claims(claims).Flatten().ToPB() {
|
|
u.Claims[k] = vs
|
|
}
|
|
}
|