OIDC connector insecureSkipEmailVerified flag is not used

[pbochynski]

The documentation says:

Some providers return claims without "email_verified", when they had no usage of emails verification in enrollement process or if they are acting as a proxy for another IDP etc AWS Cognito with an upstream SAML IDP
This can be overridden with the below option
insecureSkipEmailVerified: true

But if "email_vierified" claim is missing the flag is never checked. It works only if the field exists and has boolean value. The code responsible for it is in here:

dex/connector/oidc/oidc.go

Lines 220 to 242 in 49e59fb

	emailVerified, found := claims["email_verified"].(bool)
	if !found {
	return identity, errors.New("missing \"email_verified\" claim")
	}
	hostedDomain, _ := claims["hd"].(string)
	if len(c.hostedDomains) > 0 {
	found := false
	for _, domain := range c.hostedDomains {
	if hostedDomain == domain {
	found = true
	break
	}
	}
	if !found {
	return identity, fmt.Errorf("oidc: unexpected hd claim %v", hostedDomain)
	}
	}
	if c.insecureSkipEmailVerified {
	emailVerified = true
	}

The configuration check should be moved up and claim email_vierified should not be retrieved if the flag is set to true

[srenatus]

That sounds accurate. Looks like this nuance got introduced in #1448, and I might even have asked for it... 😅 (All blame is on me!)

I'll look into it. Thanks!

[pbochynski]

Thanks for the quick response and really quick fix. I'm impressed!