Add new default behavior to reject a link in an OIDC IdP if email_verified is present and is false

[robotdan]

Add new default behavior to reject a link in an OIDC IdP if email_verified is present and is false

Description

When you configure an IdP in FusionAuth you always need to be sure you trust this 3rd party. However, to provide additional built in protection, if the IdP does offer the email_verified claim in the UserInfo response, and the value is false we should fail to link on email.

Workaround

If your Identity Provider returns the email_verified claim in the Userinfo response, you may inspect this claim in the OpenID Connect Reconcile lambda and if it is provided and false, you could choose to throw an exception which would fail the login attempt.

While this will technically work, it is a poor user experience, and the error will not be helpful to the end user.

Additional information

This problem can apply to any IdP. However, IdPs such as Azure AD make it a bit more complicated because an AD connection can be configured to Use Common Endpoint which means a user can authenticate with any Azure AD tenant.

Auth0 has added some specific configuration for using Azure AD. In summary they allow you to consider all emails verified, or all emails unverified when using this connection. When configure to consider all emails un-verified, they force an email verification workflow inline during the first authentication. See https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/azuread-adfs-email-verification.

We could consider adding this for all IdPs. This specific issue is really only addressing the OIDC IdP configuration. But we could consider adding a configuration for any IdP to indicate if FusionAuth should trust emails from the 3rd party knowing that we cannot know if the email is verified, not verified, or has been mutated at runtime.

Related

• Allow an OIDC IdP to restrict the use of the email claim during linking unless email_verified: true #2184

Documentation

• New API parameter on the OpenID Connect IdP
• New field in the UI on the OpenID Connect IdP configuration
• New API parameter on the ExternalJWT IdP
• New field in the UI on the External JWT IdP configuration
• New error that can occur for External JWT or OpenID Connect when email is not verified. UnverifiedEmail and new themed message [ExternalAuthenticationException]UnverifiedEmail.

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

Release Notes

When the OpenID Connect or External JWT Identity Provider is configured to Link by Email and the IdP returns a claim named email_verified and the value is false, the link request will be rejected. This change is intended to reduce the risk of linking on an un-verified email address.

[mooreds]

added a workaround.

[robotdan]

Internal:

• https://github.com/FusionAuth/fusionauth-app/pull/304

[robotdan]

Doc:

• IdP updates and changes for 1.48.0 fusionauth-site#2647