opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add INSECURE oidc email fallback flag for IdP brokers (#26751)

Browse Source 
<!-- Authored by Coder Agents on behalf of @Emyrk. -->

Adds an opt-in `CODER_DANGEROUS_OIDC_EMAIL_FALLBACK` flag (alias
`--dangerous-oidc-email-fallback`) for IdP brokers that do not issue a
stable `sub` for the same user across connections.
This commit is contained in:
Steven Masley
2026-06-26 11:23:42 -05:00
committed by GitHub
parent 18efcb6c41
commit ad355aeaa9
10 changed files with 254 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/src/api/typesGenerated.ts
Generated
+8
View File
@@ -6264,6 +6264,14 @@ export interface OIDCConfig {
*/
readonly redirect_url: string;
readonly auto_repair_links: boolean;
/**
* EmailFallback allows OIDC logins to fall back to email-based matching
* when the `linked_id` (issuer+subject) does not match an existing user
* link. INSECURE: weakens the linked_id check. It exists for IdP
* brokers that do not issue a stable `sub` for the same user across
* connections.
*/
readonly email_fallback: boolean;
}
// From codersdk/parameters.go