Add provider.oidc.use-preferred-username option to use 'preferred_username' attribute in place of 'email' for OIDC providers

thomseddon / traefik-forward-auth

Minimal forward authentication service that provides Google/OpenID oauth based login and authentication for the traefik reverse proxy

MIT License

2.18k stars 412 forks source link

Add provider.oidc.use-preferred-username option to use 'preferred_username' attribute in place of 'email' for OIDC providers #400

Open mdusher opened 1 week ago

mdusher commented 1 week ago

This might not be desirable for everyone, so I'll leave it up to you if you wish to bring it in.

I'm a Keycloak user and I do not primarily use email addresses as usernames if I can avoid it. I have added an option to override the email attribute with the value of the preferred_username attribute (if it is provided and the provider.oidc.use-preferred-username flag is set.

If the flag is set, and preferred_username is not provided - it will still use the value of the email attribute.