fix: Extract username from JWT token claims instead of UserInfo - #291
Merged
Conversation
* feat: support AWS Cognito as an OIDC provider for external-idp * docs: add authentication.md file * chore: add logs and test for role is not in targetRoles
Collaborator
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
TamarW0
marked this pull request as ready for review
August 4, 2026 07:38
TamarW0
requested review from
IlonaShishov,
vbelouso and
zvigrinberg
as code owners
August 4, 2026 07:38
zvigrinberg
requested changes
Aug 4, 2026
Comment on lines
57
to
123
| public String getUserName() { | ||
| // First try to get username from JWT token directly | ||
| if (securityIdentity != null && securityIdentity.getPrincipal() instanceof JsonWebToken) { | ||
| JsonWebToken jwt = (JsonWebToken) securityIdentity.getPrincipal(); | ||
|
|
||
| // Try email claim (Cognito ID tokens, common in OIDC) | ||
| String name = jwt.getClaim("email"); | ||
| if (Objects.nonNull(name) && !name.isBlank()) { | ||
| return name; | ||
| } | ||
|
|
||
| // Try cognito:username (Cognito-specific) | ||
| name = jwt.getClaim("cognito:username"); | ||
| if (Objects.nonNull(name) && !name.isBlank()) { | ||
| return name; | ||
| } | ||
|
|
||
| // Try username claim | ||
| name = jwt.getClaim("username"); | ||
| if (Objects.nonNull(name) && !name.isBlank()) { | ||
| return name; | ||
| } | ||
|
|
||
| // Try upn (user principal name - common in enterprise) | ||
| name = jwt.getClaim("upn"); | ||
| if (Objects.nonNull(name) && !name.isBlank()) { | ||
| return name; | ||
| } | ||
|
|
||
| // Try preferred_username (standard OIDC claim) | ||
| name = jwt.getClaim("preferred_username"); | ||
| if (Objects.nonNull(name) && !name.isBlank()) { | ||
| return name; | ||
| } | ||
|
|
||
| // Try sub (subject - always present but may be UUID) | ||
| name = jwt.getClaim("sub"); | ||
| if (Objects.nonNull(name) && !name.isBlank()) { | ||
| return name; | ||
| } | ||
| } | ||
|
|
||
| // Fallback to UserInfo if JWT extraction didn't work | ||
| if (Objects.nonNull(userInfo)) { | ||
| var name = userInfo.getString("email"); | ||
| if (Objects.nonNull(name)) { | ||
| return name; | ||
| } | ||
| name = userInfo.getString("upn"); | ||
| if (Objects.nonNull(name)) { | ||
| return name; | ||
| } | ||
| var metadata = userInfo.getObject("metadata"); | ||
| if (Objects.nonNull(metadata)) { | ||
| name = metadata.getString("name"); | ||
| if (Objects.nonNull(name)) { | ||
| return name; | ||
| } | ||
| } | ||
| name = userInfo.getString("preferred_username"); | ||
| if (Objects.nonNull(name)) { | ||
| return name; | ||
| } | ||
| name = userInfo.getString("sub"); | ||
| if (Objects.nonNull(name)) { | ||
| return name; | ||
| } |
Collaborator
There was a problem hiding this comment.
@TamarW0 Tests will be good here, to see that it gives precedence to jwt claims, and if the expected claims are not present in the JWT, it will fallback to the userinfo object as a source.
If you don't have time, as it's urgent, please take it off to a future task. ( the most important things is that you'll verify these behavior for production/external-idp' keycloak that we don't have regressions there).
Collaborator
Author
There was a problem hiding this comment.
it is under testing
…rService.java Co-authored-by: Zvi Grinberg <75700623+zvigrinberg@users.noreply.github.com>
zvigrinberg
approved these changes
Aug 4, 2026
zvigrinberg
left a comment
zvigrinberg
left a comment
Collaborator
There was a problem hiding this comment.
@TamarW0 LGTM Approved with conditions:
- Please open a follow-up task on you to complete the related tests of the added logic here.
- Also don't forget to change the target branch from
maintoga-releaseand then cherry-pick tomain.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.