opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add CODER_OIDC_IGNORE_EMAIL_VERIFIED config knob (#5165)

Browse Source 
* Adds a configuration knob CODER_OIDC_IGNORE_EMAIL_VERIFIED that allows
  ignoring the email_verified OIDC claim
* Adds warning message at startup if CODER_OIDC_IGNORE_EMAIL_VERIFIED=true
* Adds warning whenever an unverified OIDC email is let through
* Skips flaky test on non-linux platforms

Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>
This commit is contained in:
Cian Johnston
2022-11-25 10:10:09 +00:00
committed by GitHub
co-authored by Mathias Fredriksson
parent 6ed12ade54
commit a4a319a76e
10 changed files with 91 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/auth.md
+10
View File
@@ -76,11 +76,21 @@ Once complete, run `sudo service coder restart` to reboot Coder.
> When a new user is created, the `preferred_username` claim becomes the username. If this claim is empty, the email address will be stripped of the domain, and become the username (e.g. `example@coder.com` becomes `example`).
If your OpenID Connect provider requires client TLS certificates for authentication, you can configure them like so:
```console
CODER_TLS_CLIENT_CERT_FILE=/path/to/cert.pem
CODER_TLS_CLIENT_KEY_FILE=/path/to/key.pem
```
Coder requires all OIDC email addresses to be verified by default. If the `email_verified` claim is present in the token response from the identity provider, Coder will validate that its value is `true`.
If needed, you can disable this behavior with the following setting:
```console
CODER_OIDC_IGNORE_EMAIL_VERIFIED=true
```
> **Note:** This will cause Coder to implicitly treat all OIDC emails as "verified".
## SCIM (enterprise)
Coder supports user provisioning and deprovisioning via SCIM 2.0 with header