CODEWITHSUNDEEP
node.jsexpressopenid-connect
Woodsman
Woodsman

Reputation: 1179

Getting OIDC username after authorization

My goal is to tell if a user is authenticated, and get their name and email. So far, I can only do the first.

My server app is a NodeJS/Express router. The OIDC server is provided by my company, I believe is compliant, but not under my control. I can do an "Authorization code flow": response_type="code". My Node app eventually responds to the callback route and I can get the "code" and "grant_id" query string values. Other than knowing they exist and presuming that means the user is authorized, I have no idea what I can do with those values. It appears that the only scope that works is "openid".

If I can get the access_code, I can call the UserInfo service and get these values.

My other choice is to do an implicit call. Unfortuantely, the OIDC service it provides the "access_code" and other values after a hash mark on the callback. I believe the flow to be like this:

  1. User makes call to Node app. Detects a lack of authentication, issues redirect to SSO service implicit authorization
  2. User's browser follows redirect to SSO service implicit authorization. User fills it out and is successfully authenticated.
  3. W3 returns a redirect to the provided callback URL.
  4. User needs to cooperate with the app, somehow parse the query string parameters to get the access token and pass this back to the Node application.
  5. The browser calls the provided Node callback application, but without the necessary access token.

I think I could make a proxy server to force OIDC to give my node server the request, just so I can get the access_token. It seems like a very convoluted way to do this, so I have to think there's some simpler way.

Again, all I want is to know the user is authorized to use the app, and what their name and email is. It should not be this hard.

Upvotes: 0

Views: 873

Answers (1)

Tore Nestenius
Tore Nestenius

Reputation: 19921

You can use the ID-token to get the details about the user.

It is also important that your identity provider is all about authentication. Final authorization checks should be done in the client, by examining the scopes/claims in the token.

Upvotes: 1

Related Questions