fix(auth-server): Add email claims to ID Token for compatibility #19938
+31
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Mozilla Connect (and potentially other SPs) requires email and email_verified claims in the ID Token to successfully authenticate users. This change ensures these claims are included when the email or profile scope is requested. This also adds unit tests to verify the claims are only included when appropriate scopes are authorized. Closes: mozilla#18854
sreecharan-desu
force-pushed
the
fix/connect-401
branch
from
ad9b237 to
97bbaf1
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Mozilla Connect requires
emailandemail_verifiedclaims in the ID Token to authenticate (it throws a 401 otherwise).I updated
grant.jsto explicitly include these claims in theid_tokenpayload when theemailorprofilescope is requested.Fixes #18854
Because
Khoros (Mozilla Connect) expects these claims to verify identity. Without them, login fails.
This pull request
generateIdTokeninpackages/fxa-auth-server/lib/oauth/grant.jsto includeemailandemail_verifiedin the token if we have the right scopes.packages/fxa-auth-server/test/oauth/grant.jsto verify the claims are added correctly and restricted to the proper scopes.Checklist
Put an
xin the boxes that apply