Use "name" claim in OIDC SSO for display name

[RaphaelRoumezin]

When creating a user from SSO, the code uses the OIDC claim "preferred_username" for the username, which is usually more of a login username than a display name, which is more how vaultwarden uses it. Entra ID, for instance, uses UPN, which might just be the email address.

vaultwarden/src/sso.rs

Line 291 in d6a3d53

let user_name = id_claims.preferred_username().or(user_info.preferred_username()).map(|un| un.to_string());

The OIDC spec indicates the field "name" as more fitting for a display name:
https://openid.net/specs/openid-connect-core-1_0.html#Claims

So we could either:

• Use the "name" claim in the code, with "preferred_username" as a fallback
• Make a config field to set the claim to be used for username definition

Feel free to comment you insights on this idea.

[kittygaming99]

This makes a lot more sense considering that's what the OIDC spec suggests. The current implementation can cause issues with multiple providers. For example, using Google as an IdP causes the WebUI to display the user's email address as the display name instead of the string from the OIDC name claim. This is because Google's OIDC implementation doesn't issue a preferred_username claim, and they don't allow you to map custom claims to work around it. A simple implementation of what you've suggested, @RaphaelRoumezin , could look like this:

let user_name = id_claims
    .name()
    .and_then(|n| n.get(None))
    .map(|n| n.to_string())
    .or_else(|| {
        user_info
            .name()
            .and_then(|n| n.get(None))
            .map(|n| n.to_string())
    })
    .or_else(|| {
        id_claims
            .preferred_username()
            .or(user_info.preferred_username())
            .map(|un| un.to_string())
    });

[RaphaelRoumezin]

I understand why they chose to use preferred_username, as an identifying username is more likely to be persistent across IdPs, rather than a display name which might not be mandatory for all users. Though I would agree, it's a shame Vaultwarden doesn't even try to use the name claim.
Nonetheless, the claim used should probably be configurable by the admins, to adapt to their own IdP.

I haven't seen if there already is one, but I might just make a PR for it in the future.

[kittygaming99]

Yes, you make a good point. Perhaps a configuration option to map a claim to the display name in the admin panel is a better solution.