Openid Connect username should be available in preferred_username
The OpenID connect provider in GitLab is currently configured to use the nickname
claim to provide the username to services who try to authenticate against GitLab. The OIDC spec says for the nickname:
Casual name of the End-User that may or may not be the same as the given_name. For instance, a nickname value of Mike might be returned alongside a given_name value of Michael.
I think it would be better to provide this data within preferred_username
which is described as:
Shorthand name by which the End-User wishes to be referred to at the RP, such as janedoe or j.doe. This value MAY be any valid JSON string including special characters such as @, /, or whitespace. The RP MUST NOT rely upon this value being unique, as discussed in Section 5.7. |
The spec can be found at https://openid.net/specs/openid-connect-core-1_0.html - the table with the claims is located at 5.1. Standard Claims
.
The configuration of the provider within GitLab is done here: https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/doorkeeper_openid_connect.rb#L35
I came across this because Coder used the preferred_username
claim for the username and tried to generate something out of the user's email if this claim was not present. I think it is safe with any compatibility concerns to configure the provider to additionally use the preferred_username
claim and leave the nickname
configuration as is.