diff --git a/CHANGELOG.md b/CHANGELOG.md index c548af7..58e8065 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,13 +8,17 @@ and this project adheres to ## [Unreleased] +### Changed + +- 🚸(oidc) ignore case when fallback on email #61 + ### Fixed - 🐛(oidc) use correct session key for token expiration check #56 ## [0.0.23] - 2026-01-14 -### Changed + - ⬆️(oidc) allow use mozilla-django-oidc >5.0.0 with PyJWT - ♻️(malware) reuse existing file_hash when rescheduling a task diff --git a/src/lasuite/oidc_login/backends.py b/src/lasuite/oidc_login/backends.py index ba1e4a1..2b4f38e 100644 --- a/src/lasuite/oidc_login/backends.py +++ b/src/lasuite/oidc_login/backends.py @@ -302,7 +302,7 @@ class OIDCAuthenticationBackend(MozillaOIDCAuthenticationBackend): except self.UserModel.DoesNotExist: if email and settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION: try: - return self.UserModel.objects.get(email=email) + return self.UserModel.objects.get(email__iexact=email) except self.UserModel.DoesNotExist: pass return None diff --git a/tests/oidc_login/test_backends.py b/tests/oidc_login/test_backends.py index 6e7fab2..ebacd82 100644 --- a/tests/oidc_login/test_backends.py +++ b/tests/oidc_login/test_backends.py @@ -162,6 +162,25 @@ def test_authentication_getter_existing_user_via_email(django_assert_num_queries assert user == db_user +def test_authentication_getter_existing_user_via_email_case(django_assert_num_queries, monkeypatch): + """ + If an existing user doesn't match the sub but matches the email with different case, + the user should be returned. + """ + klass = OIDCAuthenticationBackend() + db_user = factories.UserFactory(email="Some.User@example.com") + + def get_userinfo_mocked(*args): + return {"sub": "123", "email": "sOmE.useR@example.com"} + + monkeypatch.setattr(OIDCAuthenticationBackend, "get_userinfo", get_userinfo_mocked) + + with django_assert_num_queries(3): # user by email + user by sub + update sub + user = klass.get_or_create_user(access_token="test-token", id_token=None, payload=None) + + assert user == db_user + + def test_authentication_getter_existing_user_no_fallback_to_email(settings, monkeypatch): """ When the "OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION" setting is set to False,