Apollo3zehnandApollo3zehn b0d87093a8 fix: propagate AdditionalClaims on session refresh (#3547) ...

AdditionalClaims were only extracted during the initial login. On
cookie refresh, buildSessionFromClaims did extract them into a new
session, but redeemRefreshToken only copied Email, User, Groups and
PreferredUsername back to the existing session, discarding the
AdditionalClaims.

This affects OIDC and MS Entra ID providers. Any header
injection relying on additional claims goes stale until the user
re-authenticates.

Signed-off-by: Apollo3zehn <Apollo3zehn@users.noreply.github.com>
Co-authored-by: Apollo3zehn <Apollo3zehn@users.noreply.github.com>

2026-09-30 17:40:17 +02:00

..

adfs_test.go

refactor: ptr.Ptr to ptr.To

2025-11-16 22:38:59 +01:00

adfs.go

deref everything but now with default constants

2025-11-16 22:38:56 +01:00

auth_test.go

Integrate claim extractor into providers

2022-02-16 10:28:33 +00:00

azure_test.go

chore: Updated go-jwt to v5

2024-03-04 01:42:00 +01:00

azure.go

chore(goconsts): use proper constants for http methods

2026-06-08 12:54:58 +02:00

bitbucket_test.go

Move provider initialisation into providers package

2022-02-16 10:38:05 +00:00

bitbucket.go

Move provider initialisation into providers package

2022-02-16 10:38:05 +00:00

cidaas_test.go

feat: add Cidaas provider (#2273)

2025-08-12 17:41:45 +02:00

cidaas.go

feat: add Cidaas provider (#2273)

2025-08-12 17:41:45 +02:00

digitalocean_test.go

Fix import path for v7 (#800)

2020-09-29 17:44:42 +01:00

digitalocean.go

Fix Linting Errors (#1835)

2022-10-21 11:57:51 +01:00

facebook_test.go

Move provider URLs to package level vars

2020-07-19 18:34:55 +01:00

facebook.go

Integrate claim extractor into providers

2022-02-16 10:28:33 +00:00

gitea_test.go

fix gitea token validation by allowing custom validation url and extracting the proper base api url for github cloud, github enterprise and gitea (#2194)

2023-09-14 10:09:57 +01:00

github_test.go

feat: support for multiple github orgs (#3072)

2025-05-29 18:11:07 +02:00

github.go

fix: Gitea team membership (#3150)

2025-08-19 08:40:36 +02:00

gitlab_test.go

chore(deps): Updated to ginkgo v2 (#2459)

2024-07-18 22:41:02 +02:00

gitlab.go

upgrading to go 1.21 (#2235)

2024-01-22 13:39:53 +00:00

google_test.go

feat: added organizationId/employee id as preferred username (#3237)

2025-11-07 19:44:32 +01:00

google.go

chore(goconsts): use proper constants for http methods

2026-06-08 12:54:58 +02:00

internal_util_test.go

feat: more aggressively truncate logged access_token (#3264)

2026-01-14 23:12:51 +01:00

internal_util.go

feat: more aggressively truncate logged access_token (#3264)

2026-01-14 23:12:51 +01:00

keycloak_oidc_test.go

fix: role extraction from access token in keycloak oidc (#1916)

2025-04-28 10:23:19 +01:00

keycloak_oidc.go

ci: fix linter warnings for preallocation

2026-01-17 16:01:14 +01:00

keycloak_test.go

chore(deps): Updated to ginkgo v2 (#2459)

2024-07-18 22:41:02 +02:00

keycloak.go

upgrading to go 1.21 (#2235)

2024-01-22 13:39:53 +00:00

linkedin_test.go

Update LinkedIn provider validate URL (#1444)

2021-11-19 21:36:33 +00:00

linkedin.go

Fix Linting Errors (#1835)

2022-10-21 11:57:51 +01:00

logingov_test.go

chore: Updated go-jwt to v5

2024-03-04 01:42:00 +01:00

logingov.go

chore(goconsts): use proper constants for http methods

2026-06-08 12:54:58 +02:00

ms_entra_id_test.go

refactor: ptr.Ptr to ptr.To

2025-11-16 22:38:59 +01:00

ms_entra_id.go

fix: propagate AdditionalClaims on session refresh (#3547)

2026-09-30 17:40:17 +02:00

nextcloud_test.go

Integrate claim extractor into providers

2022-02-16 10:28:33 +00:00

nextcloud.go

upgrading to go 1.21 (#2235)

2024-01-22 13:39:53 +00:00

oidc_test.go

fix: propagate AdditionalClaims on session refresh (#3547)

2026-09-30 17:40:17 +02:00

oidc.go

fix: propagate AdditionalClaims on session refresh (#3547)

2026-09-30 17:40:17 +02:00

provider_data_test.go

feat: allow arbitrary claims from the IDToken and IdentityProvider UserInfo endpoint to be added to the session state (#2685)

2026-03-14 12:04:33 +08:00

provider_data.go

fix: filter empty strings from allowed groups (#3365)

2026-03-18 22:44:11 +08:00

provider_default_test.go

fix: filter empty strings from allowed groups (#3365)

2026-03-18 22:44:11 +08:00

provider_default.go

chore(goconsts): use proper constants for http methods

2026-06-08 12:54:58 +02:00

providers_suite_test.go

chore(deps): Updated to ginkgo v2 (#2459)

2024-07-18 22:41:02 +02:00

providers_test.go

feat: add support for specifying allowed OIDC JWT signing algorithms (#2753) (#2851)

2026-03-18 22:24:27 +08:00

providers.go

chore(deps): replace k8s.io/apimachinery/pkg/util/errors with errors.Join (#3552)

2026-09-30 17:26:31 +02:00

srht_test.go

feat: add SourceHut (sr.ht) provider (#2359)

2025-07-22 08:16:32 +02:00

srht.go

chore(goconsts): use proper constants for http methods

2026-06-08 12:54:58 +02:00

util_test.go

feat: add support for specifying allowed OIDC JWT signing algorithms (#2753) (#2851)

2026-03-18 22:24:27 +08:00

util.go

Support for passing through URL query parameters from /oauth2/start to the ID provider's login URL.

2022-02-19 16:11:09 +00:00