From 7cd601825349c0ed782acc21a53659dfd72c7eb0 Mon Sep 17 00:00:00 2001
From: Karl Persson <kalle.persson@grafana.com>
Date: Wed, 5 Apr 2023 17:24:06 +0200
Subject: [PATCH] GenericOAuth: Set sub as auth id (#65902)

* GenericOAuth: Set sud as auth id

* GenericOAuth: Extract function to reduce complexity
---
 pkg/login/social/generic_oauth.go | 52 +++++++++++++++++++------------
 1 file changed, 32 insertions(+), 20 deletions(-)

diff --git a/pkg/login/social/generic_oauth.go b/pkg/login/social/generic_oauth.go
index 3eb9e76490e..637d0b6f765 100644
--- a/pkg/login/social/generic_oauth.go
+++ b/pkg/login/social/generic_oauth.go
@@ -76,6 +76,7 @@ func (s *SocialGenericOAuth) IsOrganizationMember(client *http.Client) bool {
 }
 
 type UserInfoJson struct {
+	Sub         string              `json:"sub"`
 	Name        string              `json:"name"`
 	DisplayName string              `json:"display_name"`
 	Login       string              `json:"login"`
@@ -108,31 +109,16 @@ func (s *SocialGenericOAuth) UserInfo(client *http.Client, token *oauth2.Token)
 	for _, data := range toCheck {
 		s.log.Debug("Processing external user info", "source", data.source, "data", data)
 
+		if userInfo.Id == "" {
+			userInfo.Id = data.Sub
+		}
+
 		if userInfo.Name == "" {
 			userInfo.Name = s.extractUserName(data)
 		}
 
 		if userInfo.Login == "" {
-			if data.Login != "" {
-				s.log.Debug("Setting user info login from login field", "login", data.Login)
-				userInfo.Login = data.Login
-			} else {
-				if s.loginAttributePath != "" {
-					s.log.Debug("Searching for login among JSON", "loginAttributePath", s.loginAttributePath)
-					login, err := s.searchJSONForStringAttr(s.loginAttributePath, data.rawJSON)
-					if err != nil {
-						s.log.Error("Failed to search JSON for login attribute", "error", err)
-					} else if login != "" {
-						userInfo.Login = login
-						s.log.Debug("Setting user info login from login field", "login", login)
-					}
-				}
-
-				if userInfo.Login == "" && data.Username != "" {
-					s.log.Debug("Setting user info login from username field", "username", data.Username)
-					userInfo.Login = data.Username
-				}
-			}
+			userInfo.Login = s.extractLogin(data)
 		}
 
 		if userInfo.Email == "" {
@@ -338,6 +324,32 @@ func (s *SocialGenericOAuth) extractEmail(data *UserInfoJson) string {
 	return ""
 }
 
+func (s *SocialGenericOAuth) extractLogin(data *UserInfoJson) string {
+	if data.Login != "" {
+		s.log.Debug("Setting user info login from login field", "login", data.Login)
+		return data.Login
+	}
+
+	if s.loginAttributePath != "" {
+		s.log.Debug("Searching for login among JSON", "loginAttributePath", s.loginAttributePath)
+		login, err := s.searchJSONForStringAttr(s.loginAttributePath, data.rawJSON)
+		if err != nil {
+			s.log.Error("Failed to search JSON for login attribute", "error", err)
+		}
+
+		if login != "" {
+			return login
+		}
+	}
+
+	if data.Username != "" {
+		s.log.Debug("Setting user info login from username field", "username", data.Username)
+		return data.Username
+	}
+
+	return ""
+}
+
 func (s *SocialGenericOAuth) extractUserName(data *UserInfoJson) string {
 	if s.nameAttributePath != "" {
 		name, err := s.searchJSONForStringAttr(s.nameAttributePath, data.rawJSON)