OIDC: Fetch UserInfo to get EmailVerified if necessary

[benley]

Some OIDC providers (including Okta) do not include an email_verified claim in ID tokens, so headscale will never trust their email addresses. The OIDC spec says that the set of "standard claims" can be returned in either the UserInfo response or the ID token, so we can try requesting UserInfo if necessary to find the email_verified claim that we're looking for. If this also fails, the behavior of headscale is unchanged from before.

Please let me know if this approach looks acceptable, and I can try to add test coverage and update docs as needed.

Related to #2333 and #2295

• have read the CONTRIBUTING.md file
• raised a GitHub issue or discussed it on the projects chat beforehand
• added unit tests
• added integration tests
• updated documentation if needed
• updated CHANGELOG.md

[kradalby]

I think this looks reasonable, is it confirmed that some of the providers (like Okta), sets the email verified in the user info?

Question for further improvement, is there more info we potentially should "fall back" to getting from userinfo if we dont get it in the claim?

Could you please add a changelog entry?

[benley]

I think this looks reasonable, is it confirmed that some of the providers (like Okta), sets the email verified in the user info?

Okta's knowledge base indicates that they do this (https://support.okta.com/help/s/article/how-to-return-the-email-verified-claim), and I have confirmed the behavior through live testing. The only other one I've tested is Keycloak, but keycloak also includes email_verified in the id token response.

Question for further improvement, is there more info we potentially should "fall back" to getting from userinfo if we dont get it in the claim?

Good question! In theory we could try UserInfo for any of the standard claims that headscale uses: name, email, picture, preferred_username.

Could you please add a changelog entry?

Yes, coming right up.

[benley]

No rush, but I think this is ready for another look.

[alteriks]

Hi, I've created #2505 with docs regarding how to configure Authelia.

Since v4.39.0, by default Authelia removed 'default' claims from ID Token.
If headscale starts using UserInfo endpoint we won't have to send those claims to Headscale.

Ping me, if you'd like me to verify your code with Authelia.

[kradalby]

@benley looks good, will merge when the TestUpdateHostnameFromClient passes, mostly a formality.

Would you be up for a PR to use this info for the other fields too?

I imagine we prioritise the claims, and then fall back to userinfo.

[benley]

Would you be up for a PR to use this info for the other fields too?

I imagine we prioritise the claims, and then fall back to userinfo.

Sure, I can followup with a second PR to do the rest of the fields. Thank you for merging this one!