identity/oidc: omit null and empty string claims from provider tokens#32000
Open
emmayusufu wants to merge 1 commit into
Open
identity/oidc: omit null and empty string claims from provider tokens#32000emmayusufu wants to merge 1 commit into
emmayusufu wants to merge 1 commit into
Conversation
|
Deployment failed with the following error: Learn More: https://vercel.com/docs/concepts/projects/project-configuration |
dosubot
Bot
added
the
size:S
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
When an OIDC scope template references entity metadata that is missing, Vault returns the claim with an empty string value in the ID token and UserInfo response. The OIDC spec says a claim that is not returned should be omitted rather than sent with a null or empty string value. Omit claims whose value is null or an empty string when merging scope templates in mergeJSONTemplates, the shared path for both the ID token and the UserInfo response. Empty lists and objects are preserved, since an empty collection is a meaningful value. Fixes hashicorp#13936
emmayusufu
force-pushed
the
oidc-omit-empty-claims
branch
from
June 17, 2026 12:35
5eb72da to
ec5d261
Compare
Author
|
@austingebauer this implements the empty-claims exclusion you welcomed in #13936. The fix is in |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #13936.
When an OIDC scope template references entity metadata that is missing, Vault currently returns the claim with an empty string value in the ID token and UserInfo response (for example
"name": ""). The OIDC spec (Core 5.3.2) says a claim that is not returned should be omitted rather than sent with a null or empty string value.This omits claims whose value is null or an empty string when merging scope templates, in
mergeJSONTemplates. That function is the shared path for both the ID token (generatePayload) and the UserInfo response, so the behaviour is consistent across both. Empty lists and objects are preserved, since an empty collection is a meaningful value (for example agroupsclaim with no groups).Added a unit test covering the omitted and preserved cases.