feat: Add support for skipping the email_verified claim on email issuer types#2220
Merged
Merged
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2220 +/- ##
===========================================
- Coverage 57.93% 45.04% -12.90%
===========================================
Files 50 72 +22
Lines 3119 4689 +1570
===========================================
+ Hits 1807 2112 +305
- Misses 1154 2342 +1188
- Partials 158 235 +77 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Hayden-IO
reviewed
Nov 30, 2025
| } | ||
|
|
||
| // ToIssuers returns a proto representation of the OIDC issuer configuration. | ||
| func (fc *FulcioConfig) ToIssuers() []*fulciogrpc.OIDCIssuer { |
Contributor
There was a problem hiding this comment.
Can you also update this function? This is used to output the server's configuration, e.g. http://fulcio.sigstore.dev/api/v2/configuration
Contributor
Author
There was a problem hiding this comment.
yeh definitely, will sort this evening.
Contributor
Author
There was a problem hiding this comment.
this should have been addressed now. make gen/lint/test has also been run and committed too
…ssuer Fixes sigstore#2219 Some enterprise identity providers like Microsoft Entra (Azure AD) and ADFS don't include the email_verified claim in their OIDC tokens because email verification happens through their centralized identity management processes rather than during OIDC token issuance. This caused Fulcio to reject valid tokens from these providers, impacting some enterprise deployments. Added a new optional SkipEmailVerification boolean field to the OIDCIssuer configuration struct. When set to true for a specific issuer, Fulcio will skip the email_verified claim check during principal creation while still validating email format and embedding it in the certificate. This approach maintains security by default (the field defaults to false) while allowing operators to explicitly opt-in for trusted internal identity providers. The implementation moves the issuer configuration lookup earlier in PrincipalFromIDToken so we can access the SkipEmailVerification flag before checking email_verified. For meta-issuers with wildcard patterns, the flag is propagated when constructing concrete issuer configurations. Added tests coverage for scenarios for tokens with missing email_verified claims, explicit false values, and true values when skip is enabled. Updated config parsing tests to verify the new field can be read from both YAML and JSON configurations. Signed-off-by: Morgan Jones <mevanj89@gmail.com>
c807735 to
c397b74
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds support for enterprise identity providers (Microsoft Entra/Azure AD, ADFS) that don't include the
email_verifiedclaim in their OIDC tokens.Problem: Enterprise identity providers often handle email verification through centralized identity management systems rather than including an
email_verifiedclaim in OIDC tokens. Fulcio currently requires this claim to be present and set totruefor all email-type issuers, which blocks valid tokens from these enterprise providers and prevents internal Fulcio deployments in organizations using Microsoft Entra, ADFS, or similar systems.Solution: Added a new optional
skip-email-verificationconfiguration field per OIDC issuer. When set totrue, Fulcio will skip theemail_verifiedclaim check while still validating email format. This maintains security by default (requires verification) while allowing explicit opt-in for trusted internal providers.Testing:
email_verifiedclaims, explicitfalsevalues, andtruevalues when skip is enabledSee issue #2219 for additional context.
Release Note
Added optional
skip-email-verificationconfiguration field for OIDC issuers to support enterprise identity providers (Microsoft Entra/Azure AD, ADFS) that don't include theemail_verifiedclaim in tokens. This field defaults tofalseto maintain existing security behavior. Operators can set it totruefor trusted internal identity providers where email verification is handled through organizational identity management.Configuration example:
Documentation
If we decide to go ahead with this, then i'll update the docs repo too.