Feat: enable dynamic profile field mapping via env variables for oidc response

src/auth/strategies/oidc.strategy.ts

@@ -23,6 +23,11 @@
 import { OidcConfig } from "src/config/configuration";
 import { AccessGroupService } from "../access-group-provider/access-group.service";
 import { UserPayload } from "../interfaces/userPayload.interface";
+import { IUserInfoMapping } from "src/common/interfaces/common.interface";
+
+type UserInfoResPonseWithGroups = UserinfoResponse & {
+  groups: string[];
+};
 
 export class BuildOpenIdClient {
   constructor(private configService: ConfigService) {}
@@ -66,7 +71,8 @@
   }
 
   async validate(tokenset: TokenSet): Promise<Omit<User, "password">> {
-    const userinfo: UserinfoResponse = await this.client.userinfo(tokenset);
+    const userinfo: UserInfoResPonseWithGroups =
+      await this.client.userinfo(tokenset);
     const oidcConfig = this.configService.get<OidcConfig>("oidc");
 
     const userProfile = this.parseUserInfo(userinfo);
@@ -77,12 +83,19 @@
       accessGroupProperty: oidcConfig?.accessGroupProperty,
       payload: userinfo,
     };
-    userProfile.accessGroups =
+    const accessGroups =
       await this.accessGroupService.getAccessGroups(userPayload);
 
+    if (userProfile.groups && userProfile.groups.length > 0) {
+      userProfile.accessGroups = [...accessGroups, ...userProfile.groups];
+    } else {
+      userProfile.accessGroups = accessGroups;
+    }
+    delete userProfile.groups;
+
     const userFilter: FilterQuery<UserDocument> = {
       $or: [
-        { username: `oidc.${userProfile.username}` },
+        { username: userProfile.username },
         { email: userProfile.email as string },
       ],
     };
@@ -119,46 +132,70 @@
       await this.usersService.updateUserIdentity(
         {
           profile: userProfile,
+          externalId: userProfile.id,
         },
         user._id,
       );
     }
 
     const jsonUser = JSON.parse(JSON.stringify(user));
     const { password, ...returnUser } = jsonUser;
     returnUser.userId = returnUser._id;
 
     return returnUser;
   }
 
-  getUserPhoto(userinfo: UserinfoResponse) {
-    return userinfo.thumbnailPhoto
+  getUserPhoto(thumbnailPhoto: string) {
+    return thumbnailPhoto
       ? "data:image/jpeg;base64," +
-          Buffer.from(userinfo.thumbnailPhoto as string, "binary").toString(
-            "base64",
-          )
+          Buffer.from(thumbnailPhoto, "binary").toString("base64")
       : "no photo";
   }
 
-  parseUserInfo(userinfo: UserinfoResponse) {
+  parseUserInfo(userinfo: UserInfoResPonseWithGroups) {
     type OidcProfile = Profile & UserProfile;
     const profile = {} as OidcProfile;
 
+    const newUserInfoFields =
+      this.configService.get<IUserInfoMapping>("oidc.userInfoMapping") || {};
+
+    // To dynamically map user info fields based on environment variables,
+    // set mappings like OIDC_USERINFO_MAPPING_FIELD_USERNAME=family_name.
+    // This assigns userinfo.family_name to oidcUser.username.
+
+    const oidcUser: IUserInfoMapping = {
+      id: userinfo["sub"] || (userinfo["user_id"] as string) || "",
+      username: userinfo["sub"] || "",
+      displayName: userinfo["name"] || "",
+      familyName: userinfo["family_name"] || "",
+      email: userinfo["email"] || "",
+      thumbnailPhoto: (userinfo["thumbnailPhoto"] as string) || "",
+      groups: userinfo["groups"] || [],
+    };
+
+    Object.entries(newUserInfoFields).forEach(([sourceField, targetField]) => {
+      if (
+        typeof targetField === "string" &&
+        oidcUser.hasOwnProperty(sourceField)
+      ) {
+        oidcUser[sourceField] = userinfo[targetField] as string;
+      }
+    });
+
     // Prior to OpenID Connect Basic Client Profile 1.0 - draft 22, the "sub"
     // claim was named "user_id".  Many providers still use the old name, so
-    // fallback to that.
-    const userId = userinfo.sub || (userinfo.user_id as string);
-    if (!userId) {
+    // fallback to that. https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+
+    if (!oidcUser.id) {
       throw new Error("Could not find sub or user_id in userinfo response");
     }
 
-    profile.id = userId;
-    profile.username = userinfo.preferred_username ?? userinfo.name ?? "";
-    profile.displayName = userinfo.name ?? "";
-    profile.emails = userinfo.email ? [{ value: userinfo.email }] : [];
-    profile.email = userinfo.email ?? "";
-    profile.thumbnailPhoto = this.getUserPhoto(userinfo);
+    profile.displayName = oidcUser.displayName + oidcUser.familyName;
+    profile.emails = oidcUser.email ? [{ value: oidcUser.email }] : [];
+    profile.thumbnailPhoto = this.getUserPhoto(oidcUser.thumbnailPhoto);
+
+    const oidcUserProfile = { ...oidcUser, ...profile };
 
-    return profile;
+    return oidcUserProfile;
   }
 }

src/common/interfaces/common.interface.ts

@@ -67,3 +67,14 @@ export interface IDatafileFilter {
   gid?: string;
   perm?: string;
 }
+
+export interface IUserInfoMapping {
+  id: string;
+  username: string;
+  displayName: string;
+  familyName: string;
+  email: string;
+  thumbnailPhoto: string;
+  groups?: string[];
+  [key: string]: string | string[] | undefined;
+}

src/config/configuration.ts

@@ -92,6 +92,16 @@ const configuration = () => {
       accessGroupProperty: process.env.OIDC_ACCESS_GROUPS_PROPERTY, // Example: groups
       autoLogout: process.env.OIDC_AUTO_LOGOUT || false,
       returnURL: process.env.OIDC_RETURN_URL,
+      userInfoMapping: {
+        id: process.env.OIDC_USERINFO_MAPPING_FIELD_ID,
+        username: process.env.OIDC_USERINFO_MAPPING_FIELD_USERNAME,
+        displayName: process.env.OIDC_USERINFO_MAPPING_FIELD_DISPLAYNAME,
+        familyName: process.env.OIDC_USERINFO_MAPPING_FIELD_FAMILYNAME,
+        emails: process.env.OIDC_USERINFO_MAPPING_FIELD_EMAILS,
+        email: process.env.OIDC_USERINFO_MAPPING_FIELD_EMAIL,
+        thumbnailPhoto: process.env.OIDC_USERINFO_MAPPING_FIELD_THUMBNAIL_PHOTO,
+        groups: process.env.OIDC_USERINFO_MAPPING_FIELD_GROUPS,
+      },
     },
     logbook: {
       enabled:

src/users/schemas/user-profile.schema.ts

@@ -25,6 +25,9 @@ export class UserProfile {
 
   @Prop({ type: [String] })
   accessGroups: string[];
+
+  @Prop()
+  groups?: string[];
 }
 
 export const UserProfileSchema = SchemaFactory.createForClass(UserProfile);