Username syntax restrictions

[gpenin]

Hi,

We are currently evaluating the use of the OpenID identity provider in Fusio 6.0.0, with Microsoft Entra-ID as the backend. The "User-Info" endpoint (https://graph.microsoft.com/v1.0/me) transmits a username (userPrincipalName) that also contains the Active Directory domain separated by the '@' character (User@FQDN). Currently, the syntax validation performed when creating a new user in Fusio does not allow the use of the '@' character (/var/www/html/fusio/vendor/fusio/impl/src/Service/User/Validator.php:99). We have implemented the small patch necessary to support the '@' character and have not observed any specific regressions, but it is difficult for us to evaluate it in the product as a whole.

Is it possible to include the '@' character as an authorized character for username syntax in Fusio ?

Thanks in advance.

[chriskapp]

Hi @gpenin ok so in general it would be difficult to allow @ characters but we could think about building some kind of normalizer which could remove the @ character so that we get from User@FQDN only User would this be also possible or are your required to uses the complete name?

[gpenin]

Hi @chriskapp,

We originally wanted to have usernames without the @FQDN part, so this would be a perfect solution for us.

Regards,

[chriskapp]

ok, great @gpenin could you test the following patch at the file src/Service/User.php and change the method createRemote with s.

This basically removes the @FQDN part from the username, please check whether this works for your case then I will add this to the next release.

[gpenin]

Hi @chriskapp,

The patch works perfectly on our test environment.

Regards,

[chriskapp]

The fix is then available in the next release s. apioo/fusio-impl@634011d