auth.gitlab: account for role_attribute_path_strict (#50088) (#50154)

(cherry picked from commit 6c7b6a7c34)

Co-authored-by: Gabriel MABILLE <gamab@users.noreply.github.com>

pkg/login/social/gitlab_oauth.go

@@ -2,6 +2,7 @@ package social
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"regexp"
@@ -13,9 +14,10 @@ import (
 
 type SocialGitlab struct {
 	*SocialBase
-	allowedGroups     []string
-	apiUrl            string
-	roleAttributePath string
+	allowedGroups       []string
+	apiUrl              string
+	roleAttributePath   string
+	roleAttributeStrict bool
 }
 
 func (s *SocialGitlab) Type() int {
@@ -119,6 +121,9 @@ func (s *SocialGitlab) UserInfo(client *http.Client, token *oauth2.Token) (*Basi
 	if err != nil {
 		s.log.Error("Failed to extract role", "error", err)
 	}
+	if s.roleAttributeStrict && !models.RoleType(role).IsValid() {
+		return nil, errors.New("invalid role")
+	}
 
 	userInfo := &BasicUserInfo{
 		Id:     fmt.Sprintf("%d", data.Id),

pkg/login/social/social.go

@@ -130,10 +130,11 @@ func ProvideService(cfg *setting.Cfg) *SocialService {
 		// GitLab.
 		if name == "gitlab" {
 			ss.socialMap["gitlab"] = &SocialGitlab{
-				SocialBase:        newSocialBase(name, &config, info),
-				apiUrl:            info.ApiUrl,
-				allowedGroups:     util.SplitString(sec.Key("allowed_groups").String()),
-				roleAttributePath: info.RoleAttributePath,
+				SocialBase:          newSocialBase(name, &config, info),
+				apiUrl:              info.ApiUrl,
+				allowedGroups:       util.SplitString(sec.Key("allowed_groups").String()),
+				roleAttributePath:   info.RoleAttributePath,
+				roleAttributeStrict: info.RoleAttributeStrict,
 			}
 		}