Can OIDCRemoteUserClaim be set to item in an array?

[intrapid]

Hi!

Using Azure B2C as identity provider I get the email address claim as an array called emails and not the common string called email.
Microsoft calls the data type StringCollection and I figure it's an array because there can potentially be more than one email address.

I wonder how I can set OIDCRemoteUserClaim to use the (first or only) email address?

If I set OIDCRemoteUserClaim emails I will get an error that the remote_user can't be set. I also tried emails[0] and email to no avail.

If I set it to sub everything works fine.
The email address also passes through apache as it shows up in PHP as:
$_SERVER['OIDC_CLAIM_emails']='[email protected];

I'm using version 2.4.12.3-2 (Debian's packaged version) changelog so I think there is support for nested claims and arrays.

Decoded token (using https://jwt.ms)

{
  "ver": "1.0",
  "iss": "https://xxxxxxxxx.b2clogin.com/xxxxxxxxxxxxxxxxxxxxxxxxxxx/v2.0/",
  "sub": "xxxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx",
  "aud": "xxxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx",
  "exp": 1695564480,
  "nonce": "defaultNonce",
  "iat": 1695528480,
  "auth_time": 1695528480,
  "name": "John Doe",
  "emails": [
    "[email protected]"
  ],
  "tfp": "B2C_1_signin",
  "nbf": 1695528480
}

[zandbelt]

there's only support for plain string values today; I'm hesitant to add support for arrays as they're not sorted and it may lead to unpredictable/unwanted results; I believe the best approach would be to add a new claim on the Provider side for this purpose, typically email since that is a standardized value and format as opposed to emails, or perhaps upn since you're in MS land

[intrapid]

OK, great! That's very useful to know.

Thanks!

[intrapid]

I think for OIDCRemoteUserClaim it would actually make sense to keep it 100% consistent with the other claims. Right now that is to convert the array into a flattened comma separated list.

It really doesn't matter if the content of the array is a list of emails or something else.

That's just my opinion of course.

[zandbelt]

regular claims passing and the remote user setting don't have the same semantics: the remote user claim should be a single unique user identifier that does not change over time and does not get re-used (in fact that is why the default is "sub" and why "email" is less preferred but even more preferred that an unsorted list of reusable identifiers...); as such I think it is good practice to discourage using arrays through a work-around-only solution

[intrapid]

Thanks @zandbelt, when you put it like that it makes sense to not make it too easy!

But just so I understand, the REMOTE_USER that OIDCRemoteUserClaim configs isn't something that mod_auth_openidc is actually using itself?
It's just to emulate where basic auth (and other options) usually put the username in Apache, right?

[zandbelt]

you are correct about REMOTE_USER

another note on "emails" usage: you should be aware that in a consumer facing identity platform, that array is most likely something that end users populate and change themselves, which makes it even less suitable as a unique and persistent user identifier, but of course the impact of that depends on the application using it