Problem: When setting up GitHub OpenID, parsing is not possible except for Email

[YoungJinJung]

Issue

When setting up GitHub OpenID, there is a phenomenon where the username and name are not set properly.

When I checked the parsing logic, I confirmed that it was parsed as preferred_username, and I confirmed that the field does not exist in the GitHub user API.

• src code
  

  semaphore/util/OdbcProvider.go

  Line 15 in 75ffe9c

  UsernameClaim string `json:"username_claim" default:"preferred_username"`

• https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-a-user

It seems that this part needs to be fixed.

I think it should implement each OpenID method differently.

Impact

Web-Frontend (what users interact with)

Installation method

Binary

Database

BoltDB

Browser

Chrome

Semaphore Version

2.13.0-75ffe9c-1742166024

Ansible Version

Logs & errors

No response

Manual installation - system information

No response

Configuration

{
      "bolt": {
              "host": "/opt/semaphore/semaphoreui/database.boltdb"
      },
      "dialect": "bolt",
      "tmp_path": "/tmp/semaphore",
      "cookie_hash": "xxx",
      "cookie_encryption": "xxx",
      "access_key_encryption": "xxx",
      "oidc_providers": {
        "github": {
            "icon": "github",
            "display_name": "Sign in with GitHub",
            "client_id": "xxx",
            "client_secret": "xxx",
            "redirect_url": "https://semaphoreui.eagw.ucube.cool/api/auth/oidc/github/redirect",
            "endpoint": {
                "auth": "https://github.com/login/oauth/authorize",
                "token": "https://github.com/login/oauth/access_token",
                "userinfo": "https://api.github.com/user"
            },
            "scopes": ["read:user", "user:email"],
            "username_claim": "email | {{ .email }}",
            "email_claim": "email",
            "name_claim": "email | {{ .email }}",
            "order": 1
        }
  }
}

Additional information

No response

[fiftin]

GitHub can hide email address. So you will have only "id". You need:

            "scopes": ["read:user", "user:email"],
            "username_claim": "email | {{ .id }}@your-domain.com",
            "email_claim": "email | {{ .id }}@your-domain.com",
            "name_claim": "name",

In this example, email 1234567@your-domain.com will be used instead of real user email if it hidden.

[fiftin]

I know it is not the best implementation. It will be replaced with more flexible implementation soon.

[YoungJinJung]

The same issue is occurring with OKTA OpenID as well.

Would it be okay for me to try implementing a solution?