Skip to content

Google and generic OIDC brokers show email instead of display name in GDM #1368

@nooreldeenmansour

Description

@nooreldeenmansour

GDM shows the user's email instead of their full name when authenticating via the google or oidc brokers. The msentraid broker is unaffected.

Before After (Expected Fix)
Image Image

The google and oidc brokers both use GenericProvider, whose claims struct maps the display name field to json:"gecos". "gecos" is not an OIDC standard claim and no provider emits it, so it is always empty. The fallback in info.NewUser() then sets the display name to the login username (email), which is what GDM renders.

type claims struct {
Email string `json:"email"`
Sub string `json:"sub"`
Home string `json:"home"`
Shell string `json:"shell"`
Gecos string `json:"gecos"`
EmailVerified bool `json:"email_verified"`
}

if u.Gecos == "" {
u.Gecos = u.Name
}
return u

The msentraid broker's claims struct correctly uses json:"name", the standard OIDC claim for full name:

type claims struct {
PreferredUserName string `json:"preferred_username"`
Sub string `json:"sub"`
Home string `json:"home"`
Shell string `json:"shell"`
Gecos string `json:"name"`
}

The same bug exists in MockProvider, which masks the regression in tests:

type claims struct {
Email string `json:"email"`
Sub string `json:"sub"`
Home string `json:"home"`
Shell string `json:"shell"`
Gecos string `json:"gecos"`
}

Propsed Fix (Will open a PR)

Change json:"gecos" to json:"name" in GenericProvider and MockProvider:

-    Gecos         string `json:"gecos"`
+    Gecos         string `json:"name"`

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions