Custom userOIDCClaim ignored when autoprovisioning users

[eforest]

Describe the bug

Custom userOIDCClaim ignored when autoprovisioning users.
As a result account_resolver.go[94] queries users with value from custom claim, but cs3.go libregraphUserFromClaims [274] assignes username hardcoded to preferred_username.
As a result user cannot be found, autoprovisioning is retried again and again and user cannot login.

Steps to reproduce

1. setup autoprovisioning
2. setup external oidc-login
3. configure env variable PROXY_USER_OIDC_CLAIM=ocis_user for proxy service
4. login with oidc token where preferred_username != ocis_user
   (e.g. preferred_username=Domain/Testuser ocis_user=Domain-Testuser

Expected behavior

User should be able to login when custom userOIDCClaim was specified

Actual behavior

Login is not possible. OCIS shows message:

Nicht angemeldet
Das könnte aufgrund einer routinemäßigen Abmeldung aus Sicherheitsgründen geschehen sein oder Ihr Benutzerkonto ist inaktiv oder noch nicht freigeschaltet. Bitte versuchen Sie es nach einiger Zeit erneut oder wenden Sie sich an Ihre Administration.

ocis.log

Setup

1. setup autoprovisioning
2. setup external oidc-login
3. configure env variable PROXY_USER_OIDC_CLAIM=ocis_user for proxy service

Additional context

If you could support "/" in preferred_username (e.g. "Domain/Testuser"), that would solve my issue as well.

[micbar]

@rhafer Does this make sense?

@eforest did you try to patch ocis to test your hypothesis?

[eforest]

Hi @micbar,
unfortunately I don't have an environment to build ocis (just used your helm charts to deploy it).
But that is what the logs tell me and also when taking a look into ldap I can see that preferred_username was used.

[rhafer]

@micbar Yes, the bugreport is valid.

@eforest Thanks a lot for the detailed bugreport!

[rhafer]

@micbar this is the issue we just talked about, I'll move it to Prio2, please adjust if you disagree.