feat: add INSECURE oidc email fallback flag for IdP brokers - #26751
Merged
Conversation
Adds CODER_DANGEROUS_OIDC_EMAIL_FALLBACK (--dangerous-oidc-email-fallback) as an opt-in escape hatch for IdP brokers (e.g. Auth0) that emit different OIDC subjects for the same user across connections (passwordless email vs SAML SSO). With the flag on, an OIDC login whose linked_id (issuer+subject) does not match an existing user_link but whose email does match is allowed through; the existing linked_id is preserved. The flag is hidden and defaults to false. It re-opens the email-based account-takeover vector closed by PLAT-229, so a warn log is emitted every time the fallback resolves a login. Implementation: - findLinkedUser takes allowInsecureLinkedIDMismatch and skips errLinkedIDAlreadyBound on mismatch (OIDC callsite passes the flag, GitHub callsite passes false). - oauthLoginParams.AllowInsecureLinkedIDMismatch gates the defense-in-depth check in oauthLogin so the existing linked_id is not overwritten. Authored by Coder Agents on behalf of @Emyrk.
Docs preview📖 View docs preview for |
Emyrk
marked this pull request as ready for review
June 26, 2026 16:19
sreya
approved these changes
Jun 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an opt-in
CODER_DANGEROUS_OIDC_EMAIL_FALLBACKflag (alias--dangerous-oidc-email-fallback) for IdP brokers that do not issue a stablesubfor the same user across connections.When the flag is on and an OIDC login's
linked_id(issuer||subject) does not match an existinguser_link, the code falls back to email matching, lets the login proceed, and preserves the originallinked_id. The existing subject still resolves via the primarylinked_idpath on subsequent logins.The flag is hidden, defaults to
false, and weakens thelinked_idcheck restored in #25712 (PLAT-229).Scope is OIDC only. The GitHub callsite continues to pass
falseand behaves exactly as before.Implementation notes
findLinkedUsernow takesallowInsecureLinkedIDMismatch bool. When true, theerrLinkedIDAlreadyBoundcheck is skipped and the email-matched user + existing link are returned.oauthLoginParams.AllowInsecureLinkedIDMismatchgates the defense-in-depthlinked_idmismatch check insideoauthLoginso the existinglinked_idis preserved.UpdateUserLinkalready does not touchlinked_id; only the OAuth token and claims are refreshed.TestUserOIDC:OIDCInsecureEmailFallbackAllowed: mismatched sub + matching email succeeds with the flag on; originallinked_idis preserved.OIDCInsecureEmailFallbackPreservesOriginalLogin: after a fallback login, the original subject still resolves via the primary path.OIDCInsecureEmailFallbackDoesNotCreateUsers: the flag does not bypass the signup gate for brand-new emails.Coder Agents on behalf of @Emyrk.