[BUG] Remote User contains a wrong email format #133

Activity

1. WilliamB78

   added

   bugSomething isn't workingSomething isn't working

   on May 2, 2025
2. WilliamB78

   assigned

   steveiliop56

   on May 2, 2025
3. steveiliop56 commented on May 2, 2025

   

   steveiliop56

   on May 2, 2025

   Member

   More actions

   It's actually a feature, not a bug. I have configured tinyauth to ask Google and Github for more scopes so I can retrieve the username and the name of the your Google or Github account. If it doesn't get these from the OAuth provider then it will just create pseudo names and usernames based on the email it received. This is also the case for when using simple username/password authentication where it will always make pseudo usernames and domains. It may not look the absolute best but it was the best option to ensure that tinyauth fills the Remote-* headers with not just the email address. I recommend configuring your IDP to provide the prefered_username and name claims so as tinyauth can use them. If you have any suggestions on how to improve the auto generated headers please let me know. Below is my quoted reply from the original issue explaining how the headers work.

   @jmadden91 @adrianipopescu I think I have a solution you may like. I decided to automatically set the Remote-User,Remote-Name and Remote-Email headers no matter if you use OAuth or simple username/password login. The result is:

   When you use something like google you will get pseudo headers, so:

   Remote-Email: someone@gmail.com
   Remote-Name: Someone (gmail.com)
   Remote-User: someone_gmail.com
   

   (I had to include the gmail.com part so users with same usernames but different domains e.g. user@yahoo.com and user@gmail.com can be distinct)

   When you use a service that sets the OIDC claims like pocket ID you will get:

   Remote-Email: admin@admin.com
   Remote-Name: Admin Admin
   Remote-User: admin
   

   Finally when you use username/password you will get:

   Remote-Email: user1@127.0.0.1.sslip.io
   Remote-Name: User1
   Remote-User: user1
   

   (Where 127.0.0.1.sllip.io is derived from your app URL)

   I think that's the best solution. I decided to "hardcode" which claims map to which headers to ensure that authentication to other apps can happen without OAuth and to avoid having to support every different claim an IDP may set. I thought of storing the claims in the cookie but there is only so much you can store in it and if your IDP gave you a massive response then you would quickly reach the limit. There is a pull request open #122 so check it out and tell me what you think!

   👍React with 👍1Reacted by William
4. steveiliop56

   closed this as not plannedon May 2, 2025
5. WilliamB78 commented on May 2, 2025

   

   WilliamB78

   on May 2, 2025

   ContributorAuthor

   More actions

   Thanks for your help !

   Right now i don't have any idea how to improve this, since adding the claims in the Env is sufficient !

   I've submited a PR to the docs to improve it !