Description

This pull request adds the claims parameter to the OIDC authorization request to explicitly request the email claim to be included in the ID Token.

Background & Problem

Currently, Leantime attempts to read user claims (like email) directly from the ID Token. According to the OpenID Connect Core 1.0 specification, an ID Token is primarily for authentication and contains only a minimal set of claims (such as iss, sub, aud, exp, iat). It is not required, nor guaranteed, to contain any user claims like email or name.

The specification states that user claims should be obtained from the UserInfo Endpoint using the Access Token. However, Leantime's current OIDC implementation does not call the UserInfo endpoint if an ID Token is present, leading to authentication failures when the Identity Provider (IdP) does not include these claims in the ID Token by default.

From the OpenID Connect Core 1.0 specification:

"ID Token is a JSON Web Token (JWT) that contains claims about the authentication event. It is NOT intended to provide user information claims; those are available from the UserInfo Endpoint."
— OpenID Connect Core 1.0, Section 2

"Claims requested using the claims parameter can be specified as essential or voluntary. An essential claim is one that the Client considers necessary for a successful authentication flow."
— OpenID Connect Core 1.0, Section 5.5.1

Many IdPs (like Google) include email as a pragmatic measure, but strictly compliant IdPs (like SimpleSAMLphp with the OIDC module) follow the specification and do not include them, causing Leantime to fail with errors like Unable to read email to log you in.

The Fix

This PR implements the correct OIDC flow for requesting claims. As per the specification, a Client can request specific claims to be returned in the ID Token using the claims request parameter.

By adding this to the authorization request:

'claims' => json_encode([
    'id_token' => [
        'email' => ['essential' => true]
    ]
])

Leantime explicitly signals to the IdP that the email claim is essential and should be included in the ID Token. This ensures the IdP includes it, making the authentication flow work with all compliant providers without changing Leantime's core logic of reading the ID Token.

Changes Made

1. Modified buildLoginUrl() in app/Domain/Oidc/Services/Oidc.php to add the claims parameter to the authorization URL.

2. The parameter requests the email claim as essential for the ID Token.

Code Changes

public function buildLoginUrl(): string
{
    if ($this->getAuthUrl()) {
        return $this->getAuthUrl().'?'.http_build_query([
            'client_id' => $this->clientId,
            'redirect_uri' => $this->buildRedirectUrl(),
            'response_type' => 'code',
            'scope' => $this->scopes,
            'state' => $this->generateState(),
+           'claims' => json_encode([
+               'id_token' => [
+                   'email' => ['essential' => true]
+               ]
+           ]),
        ]);
    }
    return false;
}

Impact

• Fixes authentication for strictly compliant OpenID Connect Providers (e.g., SimpleSAMLphp, Keycloak, etc.)

• Maintains backward compatibility with providers that already include claims in the ID Token

• Brings Leantime's OIDC implementation one step closer to full specification compliance without a major rewrite

• No breaking changes for existing installations

Related Issues

This addresses a common problem where users integrating Leantime with standard OIDC providers encounter email retrieval errors. Similar issues have been reported in various integration scenarios.

How Has This Been Tested?

• Tested with SimpleSAMLphp OIDC module (strictly compliant provider)

• Verified that email is properly extracted from ID Token

• Confirmed backward compatibility with existing OIDC providers

References

OpenID Connect Core 1.0, Section 2 - ID Token

OpenID Connect Core 1.0, Section 5.5.1 - Individual Claims Requests

OpenID Connect Core 1.0, Section 5.3 - UserInfo Endpoint

Additional Notes

This change follows the principle of "explicit over implicit" in OIDC. By explicitly requesting the email claim for the ID Token, Leantime becomes more robust and compatible with a wider range of OpenID Connect Providers while maintaining the same user experience.