fix(coderd): userOIDC: ignore leading @ of EmailDomain (#13568)

johnstcn · web-flow · commit fe240add86f6 · 2024-06-14T09:29:07.000+01:00
diff --git a/coderd/userauth.go b/coderd/userauth.go
@@ -960,6 +960,8 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
 		}
 		userEmailDomain := emailSp[len(emailSp)-1]
 		for _, domain := range api.OIDCConfig.EmailDomain {
+			// Folks sometimes enter EmailDomain with a leading '@'.
+			domain = strings.TrimPrefix(domain, "@")
 			if strings.EqualFold(userEmailDomain, domain) {
 				ok = true
 				break
diff --git a/coderd/userauth_test.go b/coderd/userauth_test.go
@@ -941,6 +941,30 @@ func TestUserOIDC(t *testing.T) {
 			},
 			StatusCode: http.StatusForbidden,
 		},
+		{
+			Name: "EmailDomainWithLeadingAt",
+			IDTokenClaims: jwt.MapClaims{
+				"email":          "cian@coder.com",
+				"email_verified": true,
+			},
+			AllowSignups: true,
+			EmailDomain: []string{
+				"@coder.com",
+			},
+			StatusCode: http.StatusOK,
+		},
+		{
+			Name: "EmailDomainForbiddenWithLeadingAt",
+			IDTokenClaims: jwt.MapClaims{
+				"email":          "kyle@kwc.io",
+				"email_verified": true,
+			},
+			AllowSignups: true,
+			EmailDomain: []string{
+				"@coder.com",
+			},
+			StatusCode: http.StatusForbidden,
+		},
 		{
 			Name: "EmailDomainCaseInsensitive",
 			IDTokenClaims: jwt.MapClaims{

Original file line number	Diff line number	Diff line change
`@@ -960,6 +960,8 @@ func (api API) userOIDC(rw http.ResponseWriter, r http.Request) {`
`960`	`960`	`}`
`961`	`961`	`userEmailDomain := emailSp[len(emailSp)-1]`
`962`	`962`	`for _, domain := range api.OIDCConfig.EmailDomain {`
	`963`	`+ // Folks sometimes enter EmailDomain with a leading '@'.`
	`964`	`+ domain = strings.TrimPrefix(domain, "@")`
`963`	`965`	`if strings.EqualFold(userEmailDomain, domain) {`
`964`	`966`	`ok = true`
`965`	`967`	`break`