From 78cc59e6902bfbb6b5006d4f99f7cde2ba98c289 Mon Sep 17 00:00:00 2001 From: Roberto Dip Date: Wed, 28 Jun 2023 12:19:13 -0300 Subject: [PATCH] lowercase DisplayName attributes when reading SSO response (#12545) this is to accommodate providers like [Okta][1] that send the user's full name as an attribute named `displayName` [1]: https://developer.okta.com/docs/reference/api/users/#default-profile-properties --- changes/sso-display-name-case | 1 + server/sso/authorization_response.go | 3 ++- server/sso/authorization_response_test.go | 1 + 3 files changed, 4 insertions(+), 1 deletion(-) create mode 100644 changes/sso-display-name-case diff --git a/changes/sso-display-name-case b/changes/sso-display-name-case new file mode 100644 index 0000000000..9df3502db9 --- /dev/null +++ b/changes/sso-display-name-case @@ -0,0 +1 @@ +- Ignore casing in SAML response for display name. For example the display name attribute can be provided now as `displayname` or `displayName`. diff --git a/server/sso/authorization_response.go b/server/sso/authorization_response.go index 62079148dc..95258437b3 100644 --- a/server/sso/authorization_response.go +++ b/server/sso/authorization_response.go @@ -6,6 +6,7 @@ import ( "encoding/xml" "errors" "fmt" + "strings" "github.com/fleetdm/fleet/v4/server/fleet" ) @@ -108,7 +109,7 @@ func (r resp) UserID() string { func (r resp) UserDisplayName() string { if r.response != nil { for _, attr := range r.response.Assertion.AttributeStatement.Attributes { - if _, ok := validDisplayNameAttrs[attr.Name]; ok { + if _, ok := validDisplayNameAttrs[strings.ToLower(attr.Name)]; ok { for _, v := range attr.AttributeValues { if v.Value != "" { return v.Value diff --git a/server/sso/authorization_response_test.go b/server/sso/authorization_response_test.go index edd78519cd..77536fe6e9 100644 --- a/server/sso/authorization_response_test.go +++ b/server/sso/authorization_response_test.go @@ -508,6 +508,7 @@ func TestUserDisplayName(t *testing.T) { }{ {"name", []AttributeValue{{Value: "Name Surname"}}, "Name Surname"}, {"displayname", []AttributeValue{{Value: "Name Surname"}}, "Name Surname"}, + {"displayName", []AttributeValue{{Value: "Name Surname"}}, "Name Surname"}, {"cn", []AttributeValue{{Value: "Name Surname"}}, "Name Surname"}, {"urn:oid:2.5.4.3", []AttributeValue{{Value: "Name Surname"}}, "Name Surname"}, {"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", []AttributeValue{{Value: "Name Surname"}}, "Name Surname"},