OIDC: customize usernameProperty, add default role, use default_org,

[ftoppi]

What does it do?

Add OIDC config setting username_property to define which claim to use. Defaults to email to keep the same behavior.
Add OIDC config setting default_role in case IdP does not send the claim roles_property AND IdP userInfo cannot be queried. Defaults to null to keep the same behavior.
Use OIDC config setting default_org in case IdP does not send the claim organization_property.
Does not fail if IdP userInfo cannot be queried.

Questions

• Does it require a DB change? NO.
• Are you using it in production? YES.
• Does it require a change in the API (PyMISP for example)? NO.

[JakubOnderka]

Can you please elaborate why b1fcdd7 is needed?

[ftoppi]

Can you please elaborate why b1fcdd7 is needed?

If IdP doesn't send the org property, the connection is immediately rejected even if a default org is configured. IMHO, "default org" should be used if none is sent by IdP.

[JakubOnderka]

Default organisation is set in

MISP/app/Plugin/OidcAuth/Lib/Oidc.php

Line 59 in 8934982

$defaultOrganisationId = $this->defaultOrganisationId();

So can you test it again?

[ftoppi]

Default organisation is set in

MISP/app/Plugin/OidcAuth/Lib/Oidc.php

Line 59 in 8934982

$defaultOrganisationId = $this->defaultOrganisationId();

So can you test it again?

MISP rejects the connection if IdP does not send org name:

MISP/app/Plugin/OidcAuth/Lib/Oidc.php

Line 57 in 8934982

$organisationId = $this->checkOrganization($organisationName, $organisationUuid, $mispUsername);

MISP/app/Plugin/OidcAuth/Lib/Oidc.php

Line 346 in 8934982

return false;