From b3552bbfb5340dc8e13e889b13465d0c705d1aba Mon Sep 17 00:00:00 2001 From: Carlos Esteban Lopez Date: Wed, 22 Nov 2023 16:41:46 -0500 Subject: [PATCH] chore: Address PR comments 3 Signed-off-by: Carlos Esteban Lopez --- .../src/authenticator.ts | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/plugins/auth-backend-module-vmware-cloud-provider/src/authenticator.ts b/plugins/auth-backend-module-vmware-cloud-provider/src/authenticator.ts index abac9cf2b6..3a64c4ffb1 100644 --- a/plugins/auth-backend-module-vmware-cloud-provider/src/authenticator.ts +++ b/plugins/auth-backend-module-vmware-cloud-provider/src/authenticator.ts @@ -58,13 +58,10 @@ export const vmwareCloudAuthenticator = createOAuthAuthenticator< ); } + const vmwareClaims = ['email', 'given_name', 'family_name', 'context_name']; + const identity = decodeJwt(input.session.idToken); - const missingClaims = [ - 'email', - 'given_name', - 'family_name', - 'context_name', - ].filter(key => !(key in identity)); + const missingClaims = vmwareClaims.filter(key => !(key in identity)); if (missingClaims.length > 0) { throw new Error( @@ -72,6 +69,16 @@ export const vmwareCloudAuthenticator = createOAuthAuthenticator< ); } + const typeMismatchClaims = vmwareClaims.filter( + key => typeof identity[key] !== 'string', + ); + + if (typeMismatchClaims.length > 0) { + throw new Error( + `ID token claims type mismatch: ${typeMismatchClaims.join(', ')}`, + ); + } + if (identity.context_name !== input.fullProfile.organizationId) { throw new Error(`ID token organizationId mismatch`); }