Make sure auto-onboard username claim has higher priority

This commit adjust the priority when consolidating data from userinfo
endpoint and id token, making sure the auto-onboard username claim from
ID token has highest priority.

fixes #15504

Signed-off-by: Daniel Jiang <jiangd@vmware.com>

src/pkg/oidc/helper.go

@@ -126,13 +126,14 @@ type Token struct {
 // UserInfo wraps the information that is extracted via token.  It will be transformed to data object that is persisted
 // in the DB
 type UserInfo struct {
-	Issuer           string   `json:"iss"`
-	Subject          string   `json:"sub"`
-	Username         string   `json:"name"`
-	Email            string   `json:"email"`
-	Groups           []string `json:"groups"`
-	AdminGroupMember bool     `json:"admin_group_member"`
-	hasGroupClaim    bool
+	Issuer              string   `json:"iss"`
+	Subject             string   `json:"sub"`
+	Username            string   `json:"name"`
+	Email               string   `json:"email"`
+	Groups              []string `json:"groups"`
+	AdminGroupMember    bool     `json:"admin_group_member"`
+	autoOnboardUsername string
+	hasGroupClaim       bool
 }
 
 func getOauthConf() (*oauth2.Config, error) {
@@ -291,7 +292,13 @@ func mergeUserInfo(remote, local *UserInfo) *UserInfo {
 		// Used data from userinfo
 		Email: remote.Email,
 	}
-	if remote.Username != "" {
+	// priority for username (high to low):
+	// 1. Username based on the auto onboard claim from ID token
+	// 2. Username from response of userinfo endpoint
+	// 3. Username from the default "name" claim from ID token
+	if local.autoOnboardUsername != "" {
+		res.Username = local.autoOnboardUsername
+	} else if remote.Username != "" {
 		res.Username = remote.Username
 	} else {
 		res.Username = local.Username
@@ -348,7 +355,7 @@ func userInfoFromClaims(c claimsProvider, setting cfgModels.OIDCSetting) (*UserI
 		}
 
 		if username, ok := allClaims[setting.UserClaim].(string); ok {
-			res.Username = username
+			res.autoOnboardUsername = username
 		} else {
 			log.Warningf("OIDC. Failed to recover Username from claim. Claim '%s' is invalid or not a string", setting.UserClaim)
 		}

src/pkg/oidc/helper_test.go

@@ -211,12 +211,13 @@ func TestUserInfoFromClaims(t *testing.T) {
 				AdminGroup:  "g1",
 			},
 			expect: &UserInfo{
-				Issuer:        "",
-				Subject:       "",
-				Username:      "Daniel",
-				Email:         "daniel@gmail.com",
-				Groups:        []string{},
-				hasGroupClaim: false,
+				Issuer:              "",
+				Subject:             "",
+				autoOnboardUsername: "",
+				Username:            "Daniel",
+				Email:               "daniel@gmail.com",
+				Groups:              []string{},
+				hasGroupClaim:       false,
 			},
 		},
 		{
@@ -232,13 +233,14 @@ func TestUserInfoFromClaims(t *testing.T) {
 				AdminGroup:  "g1",
 			},
 			expect: &UserInfo{
-				Issuer:           "",
-				Subject:          "",
-				Username:         "Daniel",
-				Email:            "daniel@gmail.com",
-				Groups:           []string{"g1", "g2"},
-				AdminGroupMember: true,
-				hasGroupClaim:    true,
+				Issuer:              "",
+				Subject:             "",
+				autoOnboardUsername: "",
+				Username:            "Daniel",
+				Email:               "daniel@gmail.com",
+				Groups:              []string{"g1", "g2"},
+				AdminGroupMember:    true,
+				hasGroupClaim:       true,
 			},
 		},
 		{
@@ -256,13 +258,14 @@ func TestUserInfoFromClaims(t *testing.T) {
 				AdminGroup:  "g1",
 			},
 			expect: &UserInfo{
-				Issuer:           "issuer",
-				Subject:          "subject000",
-				Username:         "jack",
-				Email:            "jack@gmail.com",
-				Groups:           []string{},
-				hasGroupClaim:    true,
-				AdminGroupMember: false,
+				Issuer:              "issuer",
+				Subject:             "subject000",
+				autoOnboardUsername: "",
+				Username:            "jack",
+				Email:               "jack@gmail.com",
+				Groups:              []string{},
+				hasGroupClaim:       true,
+				AdminGroupMember:    false,
 			},
 		},
 		{
@@ -278,13 +281,14 @@ func TestUserInfoFromClaims(t *testing.T) {
 				AdminGroup:  "g1",
 			},
 			expect: &UserInfo{
-				Issuer:           "",
-				Subject:          "",
-				Username:         "airadier@gmail.com",
-				Email:            "airadier@gmail.com",
-				Groups:           []string{},
-				hasGroupClaim:    false,
-				AdminGroupMember: false,
+				Issuer:              "",
+				Subject:             "",
+				autoOnboardUsername: "airadier@gmail.com",
+				Username:            "Alvaro",
+				Email:               "airadier@gmail.com",
+				Groups:              []string{},
+				hasGroupClaim:       false,
+				AdminGroupMember:    false,
 			},
 		},
 	}
@@ -303,20 +307,22 @@ func TestMergeUserInfo(t *testing.T) {
 	}{
 		{
 			fromInfo: &UserInfo{
-				Issuer:        "",
-				Subject:       "",
-				Username:      "daniel",
-				Email:         "daniel@gmail.com",
-				Groups:        []string{},
-				hasGroupClaim: false,
+				Issuer:              "",
+				Subject:             "",
+				autoOnboardUsername: "",
+				Username:            "daniel",
+				Email:               "daniel@gmail.com",
+				Groups:              []string{},
+				hasGroupClaim:       false,
 			},
 			fromIDToken: &UserInfo{
-				Issuer:        "issuer-google",
-				Subject:       "subject-daniel",
-				Username:      "daniel",
-				Email:         "daniel@yahoo.com",
-				Groups:        []string{"developers", "everyone"},
-				hasGroupClaim: true,
+				Issuer:              "issuer-google",
+				Subject:             "subject-daniel",
+				autoOnboardUsername: "",
+				Username:            "daniel",
+				Email:               "daniel@yahoo.com",
+				Groups:              []string{"developers", "everyone"},
+				hasGroupClaim:       true,
 			},
 			expected: &UserInfo{
 				Issuer:        "issuer-google",
@@ -329,20 +335,22 @@ func TestMergeUserInfo(t *testing.T) {
 		},
 		{
 			fromInfo: &UserInfo{
-				Issuer:        "",
-				Subject:       "",
-				Username:      "tom",
-				Email:         "tom@gmail.com",
-				Groups:        nil,
-				hasGroupClaim: false,
+				Issuer:              "",
+				Subject:             "",
+				autoOnboardUsername: "",
+				Username:            "tom",
+				Email:               "tom@gmail.com",
+				Groups:              nil,
+				hasGroupClaim:       false,
 			},
 			fromIDToken: &UserInfo{
-				Issuer:        "issuer-okta",
-				Subject:       "subject-jiangtan",
-				Username:      "tom",
-				Email:         "tom@okta.com",
-				Groups:        []string{"nouse"},
-				hasGroupClaim: false,
+				Issuer:              "issuer-okta",
+				Subject:             "subject-jiangtan",
+				autoOnboardUsername: "",
+				Username:            "tom",
+				Email:               "tom@okta.com",
+				Groups:              []string{"nouse"},
+				hasGroupClaim:       false,
 			},
 			expected: &UserInfo{
 				Issuer:        "issuer-okta",
@@ -355,20 +363,22 @@ func TestMergeUserInfo(t *testing.T) {
 		},
 		{
 			fromInfo: &UserInfo{
-				Issuer:        "",
-				Subject:       "",
-				Username:      "jim",
-				Email:         "jim@gmail.com",
-				Groups:        []string{},
-				hasGroupClaim: true,
+				Issuer:              "",
+				Subject:             "",
+				autoOnboardUsername: "",
+				Username:            "jim",
+				Email:               "jim@gmail.com",
+				Groups:              []string{},
+				hasGroupClaim:       true,
 			},
 			fromIDToken: &UserInfo{
-				Issuer:        "issuer-yahoo",
-				Subject:       "subject-jim",
-				Username:      "jim",
-				Email:         "jim@yaoo.com",
-				Groups:        []string{"g1", "g2"},
-				hasGroupClaim: true,
+				Issuer:              "issuer-yahoo",
+				Subject:             "subject-jim",
+				autoOnboardUsername: "",
+				Username:            "jim",
+				Email:               "jim@yaoo.com",
+				Groups:              []string{"g1", "g2"},
+				hasGroupClaim:       true,
 			},
 			expected: &UserInfo{
 				Issuer:        "issuer-yahoo",
@@ -381,14 +391,24 @@ func TestMergeUserInfo(t *testing.T) {
 		},
 		{
 			fromInfo: &UserInfo{
-				Issuer:        "",
-				Subject:       "",
-				Username:      "",
-				Email:         "kevin@whatever.com",
-				Groups:        []string{},
-				hasGroupClaim: false,
+				Issuer:              "",
+				Subject:             "",
+				autoOnboardUsername: "",
+				Username:            "",
+				Email:               "kevin@whatever.com",
+				Groups:              []string{},
+				hasGroupClaim:       false,
 			},
 			fromIDToken: &UserInfo{
+				Issuer:              "issuer-whatever",
+				Subject:             "subject-kevin",
+				autoOnboardUsername: "",
+				Username:            "kevin",
+				Email:               "kevin@whatever.com",
+				Groups:              []string{"g1", "g2"},
+				hasGroupClaim:       true,
+			},
+			expected: &UserInfo{
 				Issuer:        "issuer-whatever",
 				Subject:       "subject-kevin",
 				Username:      "kevin",
@@ -396,11 +416,32 @@ func TestMergeUserInfo(t *testing.T) {
 				Groups:        []string{"g1", "g2"},
 				hasGroupClaim: true,
 			},
+		},
+		{
+			fromInfo: &UserInfo{
+				Issuer:  "",
+				Subject: "",
+				// only the auto onboard username from token will be used
+				autoOnboardUsername: "info-jt",
+				Username:            "",
+				Email:               "jt@whatever.com",
+				Groups:              []string{},
+				hasGroupClaim:       false,
+			},
+			fromIDToken: &UserInfo{
+				Issuer:              "issuer-whatever",
+				Subject:             "subject-jt",
+				autoOnboardUsername: "token-jt",
+				Username:            "jt",
+				Email:               "jt@whatever.com",
+				Groups:              []string{"g1", "g2"},
+				hasGroupClaim:       true,
+			},
 			expected: &UserInfo{
 				Issuer:        "issuer-whatever",
-				Subject:       "subject-kevin",
-				Username:      "kevin",
-				Email:         "kevin@whatever.com",
+				Subject:       "subject-jt",
+				Username:      "token-jt",
+				Email:         "jt@whatever.com",
 				Groups:        []string{"g1", "g2"},
 				hasGroupClaim: true,
 			},