Recommend getting the sub claim to guarantee uniqueness in the JsonWebToken.getName JavaDocs #332
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ebToken.getName JavaDocs
sberyozkin
changed the title
starksm64
approved these changes
May 20, 2024
ayoho
reviewed
May 20, 2024
Comment on lines
+34
to
+35
| * Returns the unique name of this principal. The upn claim is checked first, the preferred_username claim is | ||
| * checked next, and finally, the sub claim is checked. Note that for guaranteed interoperability a upn claim should |
There was a problem hiding this comment.
We should consider adding a test in the TCK for this. Unless there's already one in there that I missed while looking just now.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
My colleague spotted the problem,
preferred_usernameis not unique, while JsonWebToken#getName talks about uniqueness.This PR gently warns users that if they really need a unique principal identifier they should get a subject claim.
Ideally we'd remove any explicit mentioning of preferred_username - but it is hard to do right without possibly breaking a lot of user applications. May be in some basic cases it can be unique, but definitely not in the OIDC space
CC @ayoho