Email claim from OIDC

[kasper0811]

Hey, everyone.
I`ve configured harbor auth via OIDC (ADFS)
Everything works fine, but email claim not mapping to User profile email (its empty)
ADFS provides email claim in access token.
This situation occurs after some time, because early users have email.
I will be grateful to any ideas

[Vad1mo]

please provide all necessary configuration and settings and logs of your instance.

[kasper0811]

OIDC conf:
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", "http://schemas.xmlsoap.org/claims/Group"), query = ";mail,tokenGroups;{0}", param = c.Value);

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
=> issue(store = "Active Directory", types = ("name"), query = ";sAMAccountName;{0}", param = c.Value);

In harbor-core logs nothing

[reasonerjt]

@kasper0811

Have you double checked the ID token returned by ADFS? If the email claim was present previously but disappeared later, I feel it may due to some change on ADFS side.

I don't have experience on ADFS, so cannot comment on the conf you pasted.

[kasper0811]

@reasonerjt nothing changed in ADFS from first configure
ID token has though tokens

[Vad1mo]

Please get hold of the token and inspect where the email is, adopt config accordingly. let one user log in and see if the user is created with the email and on subsequent log in is mapped correctly.

I suspect, harbor can be map users because of underlaying changes in ADFS or Harbor. as @reasonerjt mentioned.

[JonTheNiceGuy]

I've found this particularly useful for troubleshooting OIDC and SAML issues:

• JWT Tracker Extension in Firefox
• JWT Tracker Extension in Chrome

[github-actions]

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.

[github-actions]

This issue was closed because it has been stalled for 30 days with no activity. If this issue is still relevant, please re-open a new issue.