feat: check access token for group attribute as well; fix #43 #46
Conversation
hahahannes
changed the title
|
@hahahannes thanks for your PR, could you please check #54 probably it will work for you. Otherwise, please update your PR in accordance with the new project structure |
|
This problem still exists in the latest 3.0 version, maybe you need to re-fork and fix it on the latest branch? |
|
Yeah, I will rebase! @NeroBlackstone |
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -724,14 +726,21 @@ | |||
| is_admin = False | |||
| user_groups = [] | |||
|
|
|||
| decoded_access_token = jwt.decode(access_token, audience=AppConfig.get_property("OIDC_AUDIENCE"), options={"verify_signature": False}) | |||
Check failure
Code scanning / SonarCloud
JWT should be signed and verified High
This will add the feature of checking the access token for the
OIDC_GROUPS_ATTRIBUTE. This is useful for cases where the needed value is stored in the access token and not in the user info token