Issue #3008341 by webflo, acrazyanimal, MorinLuc0: Override the 'sub'... (ca28e4b5) · Commits · project / openid_connect_windows_aad

config/schema/openid_connect_windows_aad.schema.yml

+3 −0

Original line number	Diff line number	Diff line
		@@ -46,3 +46,6 @@ openid_connect.client.plugin.windows_aad:
		hide_email_address_warning:
		type: boolean
		label: 'Hide missing email address warning'
		subject_key:
		type: string
		label: 'Subject key'

openid_connect_windows_aad.module

+27 −0

Original line number	Diff line number	Diff line
		@@ -206,3 +206,30 @@ function openid_connect_windows_aad_openid_connect_redirect_logout_alter(array &
		}
		}
		}

		/**
		* Implements hook_openid_connect_userinfo_alter().
		*/
		function openid_connect_windows_aad_openid_connect_userinfo_alter(array &$userinfo, array &$context) {
		$plugin = OpenIDConnectClientEntity::load($context['plugin_id']);
		if ($plugin->getPlugin() instanceof WindowsAad) {
		$originalSubs = [
		'sub' => $context['user_data']['sub'],
		'oid' => $context['user_data']['oid'] ?? NULL,
		];

		$context['user_data']['original_subs'] = $originalSubs;
		$userinfo['original_subs'] = $originalSubs;

		$subjectKey = $plugin->getPlugin()->getConfiguration()['subject_key'];
		if ($subjectKey === 'oid') {
		if ($originalSubs['oid'] === NULL) {
		throw new LogicException('Missing oid in context.');
		}

		// Map oid to sub.
		$context['user_data']['sub'] = $originalSubs['oid'];
		$userinfo['sub'] = $originalSubs['oid'];
		}
		}
		}

src/Plugin/OpenIDConnectClient/WindowsAad.php

+53 −15

Original line number	Diff line number	Diff line
		@@ -99,7 +99,8 @@ class WindowsAad extends OpenIDConnectClientBase {
		'userinfo_graph_api_use_other_mails' => FALSE,
		'userinfo_update_email' => FALSE,
		'hide_email_address_warning' => FALSE,
		'end_session_endpoint' => ''
		'end_session_endpoint' => '',
		'subject_key' => 'sub',
		] + parent::defaultConfiguration();
		}

		@@ -217,6 +218,32 @@ class WindowsAad extends OpenIDConnectClientBase {
		'#default_value' => $this->configuration['client_secret'],
		];

		$form['subject_key'] = [
		'#title' => t('Subject key'),
		'#type' => 'select',
		'#options' => ['sub' => 'sub', 'oid' => 'oid'],
		'#default_value' => $this->configuration['subject_key'],
		'#description' => t('Choose which immutable token parameter to use
		as the mapping between Azure AD accounts and Drupal users.<br/>
		<ul>
		<li>"sub" is unique per user, but varies across AD application registrations.</li>
		<li>"oid" is unique per user and common across all applications in the same tenant.</li>
		<li>See <a href=":url">:url</a> for further details.</li>
		</ul>
		<p><strong>The "oid" option, requires a patch for the openid_connect module. See issue <a href=":issue_url">:issue_url</a> for more information.</strong></p>
		<p>The default "sub" is sufficient in most cases. However, "oid" is useful if
		you want to use AD auth tokens to request access to other services and verify
		the user id. For example the Microsoft Graph API does not return the sub, but
		will return the oid in its "id" parameter. Also to sync databases between
		environments that use different app registrations, users will not map properly
		if "sub" is used.</p>'
		, [
		':url' => 'https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens',
		':issue_url' => 'https://www.drupal.org/i/3298472'
		]),
		'#required' => TRUE,
		];

		$form['front_channel_logout_url'] = [
		'#title' => $this->t('Front-channel logout URL'),
		'#type' => 'item',
		@@ -229,6 +256,17 @@ class WindowsAad extends OpenIDConnectClientBase {
		return $form;
		}

		/**
		* {@inheritdoc}
		*/
		public function getClientScopes(): ?array {
		$scopes = parent::getClientScopes();
		if ($this->configuration['subject_key'] === 'oid') {
		$scopes[] = 'profile';
		}
		return array_unique($scopes);
		}

		/**
		* {@inheritdoc}
		*/