opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add INSECURE oidc email fallback flag for IdP brokers (#26751)

Browse Source 
<!-- Authored by Coder Agents on behalf of @Emyrk. -->

Adds an opt-in `CODER_DANGEROUS_OIDC_EMAIL_FALLBACK` flag (alias
`--dangerous-oidc-email-fallback`) for IdP brokers that do not issue a
stable `sub` for the same user across connections.
This commit is contained in:
Steven Masley
2026-06-26 11:23:42 -05:00
committed by GitHub
parent 18efcb6c41
commit ad355aeaa9
10 changed files with 254 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/apidoc/docs.go
Generated
+4
View File
@@ -21285,6 +21285,10 @@ const docTemplate = `{
"type": "string"
}
},
"email_fallback": {
"description": "EmailFallback allows OIDC logins to fall back to email-based matching\nwhen the ` + "`" + `linked_id` + "`" + ` (issuer+subject) does not match an existing user\nlink. INSECURE: weakens the linked_id check. It exists for IdP\nbrokers that do not issue a stable ` + "`" + `sub` + "`" + ` for the same user across\nconnections.",
"type": "boolean"
},
"email_field": {
"type": "string"
},
coderd/apidoc/swagger.json
Generated
+4
View File
@@ -19415,6 +19415,10 @@
"type": "string"
}
},
"email_fallback": {
"description": "EmailFallback allows OIDC logins to fall back to email-based matching\nwhen the `linked_id` (issuer+subject) does not match an existing user\nlink. INSECURE: weakens the linked_id check. It exists for IdP\nbrokers that do not issue a stable `sub` for the same user across\nconnections.",
"type": "boolean"
},
"email_field": {
"type": "string"
},