fix: Use 'username' claim for user_id in IBM JWT#1284
Conversation
Replace use of the 'uid' claim with the 'username' claim when deriving user_id from IBM JWTs, and align user_id selection with email/name extraction. The change uses claims.get('username', sub) as the fallback to the subject (sub), making user_id consistent with the email and display name fields. Note: this also subtly changes behavior when a username key exists but is empty (it will now be used rather than falling back to sub).
edwinjosechittilappilly
changed the title
github-actions
Bot
added
the
backend
There was a problem hiding this comment.
Pull request overview
Updates IBM AMS JWT claim parsing so user_id is derived from the username claim (with fallback to sub), aligning the user_id choice with how email and name are currently extracted.
Changes:
- Switch
user_idderivation from theuidclaim to theusernameclaim (withsubfallback).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| user_id = claims.get("username", sub) | ||
| email = claims.get("username", sub) | ||
| name = claims.get("display_name", claims.get("username", sub)) |
There was a problem hiding this comment.
Using claims.get("username", sub) changes fallback semantics compared to the previous ... or sub: if the username claim exists but is an empty string, user_id becomes "" (and later if ibm_token and user_id: will treat it as missing and return unauthenticated) even though a valid sub exists. If the intent is to fall back to sub when username is missing or empty, use claims.get("username") or sub (and consider reusing the same normalized value for email/name to keep them consistent).
| user_id = claims.get("username", sub) | |
| email = claims.get("username", sub) | |
| name = claims.get("display_name", claims.get("username", sub)) | |
| normalized_username = claims.get("username") or sub | |
| user_id = normalized_username | |
| email = normalized_username | |
| name = claims.get("display_name") or normalized_username |
Replace use of the 'uid' claim with the 'username' claim when deriving user_id from IBM JWTs, and align user_id selection with email/name extraction. The change uses claims.get('username', sub) as the fallback to the subject (sub), making user_id consistent with the email and display name fields. Note: this also subtly changes behavior when a username key exists but is empty (it will now be used rather than falling back to sub).