Merge pull request #1417 from gezb/feature/odic_add_email_verfied_override

Add option to OIDC connecter to override email_verified to true

Documentation/connectors/oidc.md

@@ -55,6 +55,11 @@ connectors:
     #  - profile
     #  - email
     #  - groups
+
+    # Some providers return claims without "email_verified", when they had no usage of emails verification in enrollement process
+    # or if they are acting as a proxy for another IDP etc AWS Cognito with an upstream SAML IDP
+    # This can be overridden with the below option
+    # insecureSkipEmailVerified: true 
 ```
 
 [oidc-doc]: openid-connect.md

connector/oidc/oidc.go

@@ -36,6 +36,9 @@ type Config struct {
 	// Optional list of whitelisted domains when using Google
 	// If this field is nonempty, only users from a listed domain will be allowed to log in
 	HostedDomains []string `json:"hostedDomains"`
+
+	// Override the value of email_verifed to true in the returned claims
+	InsecureSkipEmailVerified bool `json:"insecureSkipEmailVerified"`
 }
 
 // Domains that don't support basic auth. golang.org/x/oauth2 has an internal
@@ -116,6 +119,7 @@ func (c *Config) Open(id string, logger log.Logger) (conn connector.Connector, e
 		logger:                    logger,
 		cancel:                    cancel,
 		hostedDomains:             c.HostedDomains,
+		insecureSkipEmailVerified: c.InsecureSkipEmailVerified,
 	}, nil
 }
 
@@ -132,6 +136,7 @@ type oidcConnector struct {
 	cancel                    context.CancelFunc
 	logger                    log.Logger
 	hostedDomains             []string
+	insecureSkipEmailVerified bool
 }
 
 func (c *oidcConnector) Close() error {
@@ -209,6 +214,11 @@ func (c *oidcConnector) HandleCallback(s connector.Scopes, r *http.Request) (ide
 		}
 	}
 
+	if c.insecureSkipEmailVerified {
+		claims.EmailVerified = true
+
+	}
+
 	identity = connector.Identity{
 		UserID:        idToken.Subject,
 		Username:      claims.Username,