From 7b224adf9fce1d56b4b48da00064bcb9ead65100 Mon Sep 17 00:00:00 2001
From: Kyle Schouviller <kyschouv@microsoft.com>
Date: Thu, 28 Apr 2022 23:13:19 -0700
Subject: [PATCH] AzureAd Oauth: Fix strictMode to reject users without an
 assigned role (#48474)

* AzureAd Oauth: Fix strictMode to reject users without an assigned role

Signed-off-by: kyschouv <kyschouv@microsoft.com>

* AzureAd OAuth: Add test for strictMode auth when no role claims are returned

Signed-off-by: kyschouv <kyschouv@microsoft.com>
---
 pkg/login/social/azuread_oauth.go      |  4 ++++
 pkg/login/social/azuread_oauth_test.go | 16 ++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/pkg/login/social/azuread_oauth.go b/pkg/login/social/azuread_oauth.go
index c305e29bb81..ff1d51a7a4e 100644
--- a/pkg/login/social/azuread_oauth.go
+++ b/pkg/login/social/azuread_oauth.go
@@ -124,6 +124,10 @@ func extractEmail(claims azureClaims) string {
 
 func extractRole(claims azureClaims, autoAssignRole string, strictMode bool) models.RoleType {
 	if len(claims.Roles) == 0 {
+		if strictMode {
+			return models.RoleType("")
+		}
+
 		return models.RoleType(autoAssignRole)
 	}
 
diff --git a/pkg/login/social/azuread_oauth_test.go b/pkg/login/social/azuread_oauth_test.go
index b81c9667978..a213943e3c6 100644
--- a/pkg/login/social/azuread_oauth_test.go
+++ b/pkg/login/social/azuread_oauth_test.go
@@ -296,6 +296,22 @@ func TestSocialAzureAD_UserInfo(t *testing.T) {
 			want:    nil,
 			wantErr: true,
 		},
+		{
+			name: "Fetch empty role when strict attribute role is true and no role claims returned",
+			fields: fields{
+				roleAttributeStrict: true,
+			},
+			claims: &azureClaims{
+				Email:             "me@example.com",
+				PreferredUsername: "",
+				Roles:             []string{},
+				Groups:            []string{},
+				Name:              "My Name",
+				ID:                "1234",
+			},
+			want:    nil,
+			wantErr: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {