Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Hotfix: fix integrity check failure #4635

Merged
merged 2 commits into from
Sep 5, 2024
Merged

Hotfix: fix integrity check failure #4635

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b38fc7b
:test_tube: [#4627] Add regression test for failing check constraint
sergei-maertens Sep 5, 2024
48bc1fe
:ambulance: [#4627] Fix crash due to non-empty check constraint when …
sergei-maertens Sep 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions src/openforms/authentication/contrib/digid_eherkenning_oidc/plugin.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
from django.utils.translation import gettext_lazy as _

from digid_eherkenning.oidc.models import BaseConfig
from flags.state import flag_enabled
from mozilla_django_oidc_db.utils import do_op_logout
from mozilla_django_oidc_db.views import _RETURN_URL_SESSION_KEY

Expand Down Expand Up @@ -210,6 +211,18 @@ def get_logo(self, request) -> LoginLogo | None:
return LoginLogo(title=self.get_label(), **get_eherkenning_logo(request))

def transform_claims(self, normalized_claims: EHClaims) -> FormAuth:
acting_subject_identifier_value = normalized_claims.get(
"acting_subject_claim", ""
)
strict_mode = flag_enabled("DIGID_EHERKENNING_OIDC_STRICT")

if strict_mode and not acting_subject_identifier_value:
raise ValueError(
"The acting_subject_claim value must be set to a non-empty value in "
"strict mode. You may have to contact your identity provider to ensure "
"it is present in the OIDC claims."
)

form_auth: FormAuth = {
"plugin": self.identifier,
# TODO: look at `identifier_type_claim` and return kvk or rsin accordingly.
Expand All @@ -219,9 +232,8 @@ def transform_claims(self, normalized_claims: EHClaims) -> FormAuth:
"value": normalized_claims["legal_subject_claim"],
"loa": str(normalized_claims.get("loa_claim", "")),
"acting_subject_identifier_type": "opaque",
"acting_subject_identifier_value": normalized_claims.get(
"acting_subject_claim", ""
),
"acting_subject_identifier_value": acting_subject_identifier_value
or "dummy-set-by@openforms",
}
if service_restriction := normalized_claims.get("branch_number_claim", ""):
form_auth["legal_subject_service_restriction"] = service_restriction
Expand Down
Loading
Loading