simplesamlphp-module-oidc icon indicating copy to clipboard operation
simplesamlphp-module-oidc copied to clipboard

User identifier attribute option as single value is inadequate with heterogenous IdPs scenarios

Open cicnavi opened this issue 6 months ago • 0 comments

Config option for designating user identifier https://github.com/simplesamlphp/simplesamlphp-module-oidc/blob/0080cf2ca10a6c00a80835a9e83638245ce9ea82/config/module_oidc.php.dist#L79 is a single value. This means that it is expected that this attribute is always available in the set of user attributes after user authentication.

In scenarios with multiple different IdPs, like for example in eduGAIN inter-federation, not every IdP will be able (or willing) to provide designated identifier. For this reason, this config option (and all relevant code that uses it) should be refactored in a way to be able to accept multiple prioritized values (array of prioritized values), or be left as single value.

cicnavi avatar Jun 03 '25 09:06 cicnavi