fix(saml): make saml email address configurable (#907)

spinnaker · Sep 18, 2019 · cf493fe · cf493fe
1 parent 13ce30d
commit cf493fe
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/gate-saml/src/main/groovy/com/netflix/spinnaker/gate/security/saml/SamlSsoConfig.groovy b/gate-saml/src/main/groovy/com/netflix/spinnaker/gate/security/saml/SamlSsoConfig.groovy
@@ -125,6 +125,7 @@ class SamlSsoConfig extends WebSecurityConfigurerAdapter {
     String roles = "memberOf"
     String rolesDelimiter = ";"
     String username
+    String email
   }
 
   @Autowired
@@ -212,8 +213,9 @@ class SamlSsoConfig extends WebSecurityConfigurerAdapter {
         def attributes = extractAttributes(assertion)
         def userAttributeMapping = samlSecurityConfigProperties.userAttributeMapping
 
-        def email = assertion.getSubject().nameID.value
-        String username = attributes[userAttributeMapping.username]?.get(0) ?: email
+        def subjectNameId = assertion.getSubject().nameID.value
+        def email = attributes[userAttributeMapping.email]?.get(0) ?: subjectNameId
+        String username = attributes[userAttributeMapping.username]?.get(0) ?: subjectNameId
         def roles = extractRoles(email, attributes, userAttributeMapping)
 
         if (samlSecurityConfigProperties.requiredRoles) {