I am assuming you're using the bundled openid_connect frontend that
works through the pyop library.
The process to configure the frontend to generate an identifier that
is mirroring an attribute value is a bit involved as by default the
frontend is hashing the given sub value.
Note that pyop is not actively being developed anymore and focus has
switched towards the "idpy-oidc" library
). New frontends are
being developed using that library and may at some point be merged on
the repo. See for example:
On Wed, 24 Aug 2022 at 16:55, Kristof Bajnok <kristof(a)bajnok.hu> wrote:
As far as I understand, the 'sub' is the standard claim to release a
user identifier value when you use OpenID Connect frontend. But even
though the subject_id is properly set in the internal request, I can not
get the frontend to not change this value when it creates the id_token.
Is there a way to do this?
In order to set the sub to the exact attribute value you need:
- the client configuration to have `public` as the subject type
(through the `subject_type` option on the client configuration), or
set the provider option `subject_types_supported` to have `public` as
its first item (see,
- provide a subject identifier factory that just returns the given
value when asked to generate an identifier (see,
Or how do others release the user's identifier
using OIDC? I can do it
using 'email' or a custom claim, but none of this seems to be The Right
Correct. The identifier in the OIDC world is the sub.
However, I'm inclined to think that using
'sub' for the user identifier
is overly complex, because I want to be able to populate the subject_id
from a SAML2 NameID (on the backend side), which I can only do with a
response microservice, but I'm not confident that changing the
'subject_id' in a microservice is a safe and supported operation.
By default the NameID is used as input for the sub claim, but
internally on the frontend that value is hashed.
Changing the subject_id (and the corresponding subject_type) is fine.
Changing that and any attribute is the main use case of
However, no matter how you set the subject_id through a micro-service,
the value will be hashed by the frontend that runs after the
So, to override the default behaviour you have to provide your own
subject identifier factory. What exactly is that and how do you do it?
In the OIDC world there are two types of subject identifiers - public
and pairwise (see,
The pairwise identifier is a targeted identifier for the service that
the identifier is being released towards. This means that the pairwise
identifier cannot mirror a given value, but the value will go through
some process that generates a value unique for the service that is
going to receive it. On the other hand, the public identifier is
specified as being the same across services, thus it doesn't need to
go through a process of modifying the value.
In pyop this aspect is controlled through the subject identifier
factory. The default (and only) subject identifier factory is hashing
the values it is given. In the case of the public type it is getting a
value and hashing it with the `sub_hash_salt` value (see,
and returns the result.
What we want to do is have the generation of the public identifier
skip the hashing. Here is some code that does that on the current
- code: https://gist.github.com/c00kiemon5ter/69d5e2efeb8d657ed64b3111e996369c
- revision (to understand the changes):
This code is overriding the current behaviour and replaces the subject
identifier factory with a custom one that does (hopefully) what you
want. I'd be happy to make this part of the frontend if somebody drops
a PR with this code including a new configuration option that controls
which subject identifier factory should be used.
PS: sorry for the long class name; couldn't come up with a better one
Ivan c00kiemon5ter Kanakarakis >:3