starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #2860] [MERGED] Configurable email_verified OIDC Claim Requirement #2904

New Issue
Closed
opened 2025-12-29 04:19:35 +01:00 by adam · 0 comments
adam commented 2025-12-29 04:19:35 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/2860
Author: @ImpostorKeanu
Created: 11/3/2025
Status: ✅ Merged
Merged: 12/18/2025
Merged by: @kradalby

Base: main ← Head: use-unverified-email

📝 Commits (7)

  • 1a1faac squash latest commits
  • 34a606d oidc: add tests for unverified email scenarios
  • d9f9149 oidc: add test for multiple allowed groups
  • ed06e1d oidc: fix validateOIDCAllowedGroups checking all groups
  • d95e291 docs: add changelog for email_verified_required option
  • 80bc5d6 lint
  • 8a1e3f6 fix nil panic on batcher close

📊 Changes

7 files changed (+292 additions, -46 deletions)

View changed files

📝 CHANGELOG.md (+3 -0)
📝 hscontrol/mapper/batcher_lockfree.go (+7 -4)
📝 hscontrol/oidc.go (+58 -22)
➕ hscontrol/oidc_test.go (+173 -0)
📝 hscontrol/types/config.go (+11 -8)
📝 hscontrol/types/users.go (+2 -2)
📝 hscontrol/types/users_test.go (+38 -10)

📄 Description

  • have read the CONTRIBUTING.md file
  • raised a GitHub issue or discussed it on the projects chat beforehand
  • added unit tests
  • added integration tests
  • updated documentation if needed
  • updated CHANGELOG.md

When configured to use OIDC, email_verified=true is required to appear in ID token claims or user info before the email will be saved in a user's information. There are some scenarios where the email_verified claim cannot be sent/configured, such as when using Cloudflare One-time pin -- which doesn't support adding/modifying claims. This can make writing ACLs difficult or impossible.

This PR adds a configuration that relaxes the email_verified=true requirement by:

  • adding a configuration field: oidc.use_unverified_email
  • considering the setting when:
    • applying oidc.allowed_domains during authorization
    • user records are initialized via User.FromClaim

Related: #2655

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/2860 **Author:** [@ImpostorKeanu](https://github.com/ImpostorKeanu) **Created:** 11/3/2025 **Status:** ✅ Merged **Merged:** 12/18/2025 **Merged by:** [@kradalby](https://github.com/kradalby) **Base:** `main` ← **Head:** `use-unverified-email` --- ### 📝 Commits (7) - [`1a1faac`](https://github.com/juanfont/headscale/commit/1a1faace9bc0a9e90405106c5adcec44eff6014f) squash latest commits - [`34a606d`](https://github.com/juanfont/headscale/commit/34a606d14667269e5d070c712c6667dcb708e62d) oidc: add tests for unverified email scenarios - [`d9f9149`](https://github.com/juanfont/headscale/commit/d9f91495589da653a65d93eca4f07446dd2aa528) oidc: add test for multiple allowed groups - [`ed06e1d`](https://github.com/juanfont/headscale/commit/ed06e1d5deab2fb07dda837bc1daf33fb4352d64) oidc: fix validateOIDCAllowedGroups checking all groups - [`d95e291`](https://github.com/juanfont/headscale/commit/d95e29145e3cd5a14c2925dfa12450e0c2bf1b1b) docs: add changelog for email_verified_required option - [`80bc5d6`](https://github.com/juanfont/headscale/commit/80bc5d6eefaf294903d5f6748be1af9d1b2a2f26) lint - [`8a1e3f6`](https://github.com/juanfont/headscale/commit/8a1e3f64d7b9312b7571ecd9a6c2b7a2264e0932) fix nil panic on batcher close ### 📊 Changes **7 files changed** (+292 additions, -46 deletions) <details> <summary>View changed files</summary> 📝 `CHANGELOG.md` (+3 -0) 📝 `hscontrol/mapper/batcher_lockfree.go` (+7 -4) 📝 `hscontrol/oidc.go` (+58 -22) ➕ `hscontrol/oidc_test.go` (+173 -0) 📝 `hscontrol/types/config.go` (+11 -8) 📝 `hscontrol/types/users.go` (+2 -2) 📝 `hscontrol/types/users_test.go` (+38 -10) </details> ### 📄 Description <!-- Headscale is "Open Source, acknowledged contribution", this means that any contribution will have to be discussed with the Maintainers before being submitted. This model has been chosen to reduce the risk of burnout by limiting the maintenance overhead of reviewing and validating third-party code. Headscale is open to code contributions for bug fixes without discussion. If you find mistakes in the documentation, please submit a fix to the documentation. --> <!-- Please tick if the following things apply. You… --> - [x] have read the [CONTRIBUTING.md](./CONTRIBUTING.md) file - [ ] raised a GitHub issue or discussed it on the projects chat beforehand - [x] added unit tests - [ ] added integration tests - [ ] updated documentation if needed - [ ] updated CHANGELOG.md <!-- If applicable, please reference the issue using `Fixes #XXX` and add tests to cover your new code. --> --- When configured to use OIDC, `email_verified=true` is required to appear in ID token claims or user info before the email will be saved in a user's information. There are some scenarios where the `email_verified` claim cannot be sent/configured, such as when using [Cloudflare One-time pin][cloudflare-otp] -- which doesn't support adding/modifying claims. This can make writing ACLs difficult or impossible. This PR adds a configuration that relaxes the `email_verified=true` requirement by: - adding a configuration field: `oidc.use_unverified_email` - considering the setting when: - applying `oidc.allowed_domains` during authorization - user records are initialized via `User.FromClaim` Related: #2655 [cloudflare-otp]: https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 04:19:35 +01:00
adam closed this issue 2025-12-29 04:19:36 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#2904
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?