Skip to content

feat(oidc): optionally merge userinfo claims into auth session#5364

Merged
markphelps merged 1 commit into
flipt-io:v2from
gzxu:oidc-userinfo
Feb 6, 2026
Merged

feat(oidc): optionally merge userinfo claims into auth session#5364
markphelps merged 1 commit into
flipt-io:v2from
gzxu:oidc-userinfo

Conversation

@gzxu

@gzxu gzxu commented Feb 6, 2026 •
edited by erka
Loading

Copy link
Copy Markdown
Contributor

Summary

Some OIDC providers keep ID token claims minimal and require calling the UserInfo endpoint to obtain additional attributes (for example: email, display name, or group membership). This adds an opt-in include_user_info provider option to fetch UserInfo during the callback flow and merge returned claims into the session claim set.

closes #5363.

Changes

  • Update configuration schema to allow authentication.methods.oidc.providers.<provider>.include_user_info
  • Add IncludeUserInfo to OIDC provider config struct
  • When enabled, call UserInfo endpoint and merge returned claims into existing claims

Backward compatibility

  • Default remains false

Test plan

  • Unit tests (added a new one besides existing OIDC callback/login tests)

@gzxu
gzxu requested a review from a team as a code owner February 6, 2026 07:40
@dosubot dosubot Bot added the size:S This PR changes 10-29 lines, ignoring generated files. label Feb 6, 2026
@dosubot

dosubot Bot commented Feb 6, 2026

Copy link
Copy Markdown

Related Documentation

Checked 4 published document(s) in 1 knowledge base(s). No updates required.

How did I do? Any feedback?  Join Discord

@dosubot dosubot Bot added size:L This PR changes 100-499 lines, ignoring generated files. and removed size:S This PR changes 10-29 lines, ignoring generated files. labels Feb 6, 2026
@gzxu gzxu mentioned this pull request Feb 6, 2026
Closed
erka
erka reviewed Feb 6, 2026
View reviewed changes

@erka erka left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @gzxu. Great work! Some small tweaks and we could merge it.

Comment thread internal/server/authn/method/oidc/server.go Outdated
Comment thread internal/server/authn/method/oidc/server_test.go Outdated
Comment thread internal/server/authn/method/oidc/server_test.go Outdated
Comment thread config/flipt.schema.cue Outdated
@erka erka added needs docs Requires documentation updates v2 Flipt v2 labels Feb 6, 2026
@codecov

codecov Bot commented Feb 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 60.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.54%. Comparing base (c4446a8) to head (66aa064).
⚠️ Report is 1 commits behind head on v2.

Files with missing lines Patch % Lines
internal/server/authn/method/oidc/server.go 60.00% 2 Missing and 2 partials ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##               v2    #5364      +/-   ##
==========================================
- Coverage   60.54%   60.54%   -0.01%     
==========================================
  Files         138      138              
  Lines       13584    13594      +10     
==========================================
+ Hits         8225     8231       +6     
- Misses       4662     4664       +2     
- Partials      697      699       +2
Flag Coverage Δ
integrationtests 34.61% <0.00%> (-0.02%) ⬇️
unittests 51.95% <60.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

erka
erka approved these changes Feb 6, 2026
View reviewed changes

@erka erka left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thank you @gzxu

@gzxu
feat(oidc): optionally merge userinfo claims into auth session
66aa064 
Some OIDC providers keep ID token claims minimal and require calling the
UserInfo endpoint to obtain additional attributes, especially when the
group list is long.

This patch adds an `include_user_info` provider option to fetch UserInfo
during the callback flow and merge returned claims into the existing claim
set.

The default remains false to preserve existing behavior.

This patch also removed unused UserInfo mocks from old tests.

Signed-off-by: Edward Xu <[email protected]>
markphelps
markphelps approved these changes Feb 6, 2026
View reviewed changes

@markphelps markphelps left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks great! thanks again @gzxu

@markphelps
markphelps merged commit f238264 into flipt-io:v2 Feb 6, 2026
24 of 25 checks passed
@github-project-automation github-project-automation Bot moved this to Done in Flipt V2 Feb 6, 2026
@gzxu

gzxu commented Feb 6, 2026

Copy link
Copy Markdown
Contributor Author

Thanks @erka and @markphelps ! By the way, when would we have the next official release of Flipt, are we releasing on a monthly or bi-monthly basis? 😄

@gzxu
gzxu deleted the oidc-userinfo branch February 6, 2026 15:52
@erka

erka commented Feb 6, 2026

Copy link
Copy Markdown
Contributor

Mark planned to do a release this week, but we postponed it because of the Go release. I hope it will happen soon. @gzxu

@gzxu

gzxu commented Feb 6, 2026

Copy link
Copy Markdown
Contributor Author

Sure, thanks so much!

@markphelps markphelps mentioned this pull request Feb 8, 2026
Merged
@erka erka mentioned this pull request Apr 7, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@erka erka erka approved these changes
@markphelps markphelps markphelps approved these changes

Assignees

No one assigned

Labels

needs docs Requires documentation updates size:L This PR changes 100-499 lines, ignoring generated files. v2 Flipt v2

Projects

Flipt V2
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

feat(oidc): optionally fetch UserInfo claims during login

3 participants

@gzxu @erka @markphelps