opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-21 12:44:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add INSECURE oidc email fallback flag for IdP brokers (#26751)

Browse Source 
<!-- Authored by Coder Agents on behalf of @Emyrk. -->

Adds an opt-in `CODER_DANGEROUS_OIDC_EMAIL_FALLBACK` flag (alias
`--dangerous-oidc-email-fallback`) for IdP brokers that do not issue a
stable `sub` for the same user across connections.
This commit is contained in:
Steven Masley
2026-06-26 11:23:42 -05:00
committed by GitHub
parent 18efcb6c41
commit ad355aeaa9
10 changed files with 254 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/api/general.md
Generated
+1
View File
@@ -435,6 +435,7 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
"email_domain": [
"string"
],
"email_fallback": true,
"email_field": "string",
"group_allow_list": [
"string"
docs/reference/api/schemas.md
Generated
+4
View File
@@ -5794,6 +5794,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
"email_domain": [
"string"
],
"email_fallback": true,
"email_field": "string",
"group_allow_list": [
"string"
@@ -6399,6 +6400,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
"email_domain": [
"string"
],
"email_fallback": true,
"email_field": "string",
"group_allow_list": [
"string"
@@ -8881,6 +8883,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
"email_domain": [
"string"
],
"email_fallback": true,
"email_field": "string",
"group_allow_list": [
"string"
@@ -8950,6 +8953,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
| `client_key_file` | string | false | | Client key file & ClientCertFile are used in place of ClientSecret for PKI auth. |
| `client_secret` | string | false | | |
| `email_domain` | array of string | false | | |
| `email_fallback` | boolean | false | | Email fallback allows OIDC logins to fall back to email-based matching when the `linked_id` (issuer+subject) does not match an existing user link. INSECURE: weakens the linked_id check. It exists for IdP brokers that do not issue a stable `sub` for the same user across connections. |
| `email_field` | string | false | | |
| `group_allow_list` | array of string | false | | |
| `group_auto_create` | boolean | false | | |