From 827014c95249c7e6c19532c0f8593e1f5f779318 Mon Sep 17 00:00:00 2001 From: lebaudantoine Date: Wed, 17 Dec 2025 16:28:51 +0100 Subject: [PATCH] =?UTF-8?q?=E2=99=BB=EF=B8=8F(backend)=20explicitly=20enfo?= =?UTF-8?q?rce=20sub=20field=20immutability?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add OIDC_USER_SUB_FIELD_IMMUTABLE setting to our config and enforce it in the user viewset. Previously relied on implicit Django LaSuite defaults. Makes the sub mutability constraint explicit and ensures it's enforced at the application level, critical for provisional users where sub is assigned on first login. --- src/backend/core/external_api/viewsets.py | 1 + src/backend/meet/settings.py | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/src/backend/core/external_api/viewsets.py b/src/backend/core/external_api/viewsets.py index 2c663902..50d59f99 100644 --- a/src/backend/core/external_api/viewsets.py +++ b/src/backend/core/external_api/viewsets.py @@ -98,6 +98,7 @@ class ApplicationViewSet(viewsets.GenericViewSet): if ( settings.APPLICATION_ALLOW_USER_CREATION and settings.OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION + and not settings.OIDC_USER_SUB_FIELD_IMMUTABLE ): # Create a pending user without sub, but with an email. user = models.User( diff --git a/src/backend/meet/settings.py b/src/backend/meet/settings.py index bf9bbdba..0bc32cde 100755 --- a/src/backend/meet/settings.py +++ b/src/backend/meet/settings.py @@ -406,6 +406,10 @@ class Base(Configuration): default=False, environ_name="OIDC_FALLBACK_TO_EMAIL_FOR_IDENTIFICATION", ) + OIDC_USER_SUB_FIELD_IMMUTABLE = values.BooleanValue( + default=True, + environ_name="OIDC_USER_SUB_FIELD_IMMUTABLE", + ) OIDC_TIMEOUT = values.IntegerValue( 5, environ_name="OIDC_TIMEOUT", environ_prefix=None )