AzureAd Oauth: Fix strictMode to reject users without an assigned role (#48474)

* AzureAd Oauth: Fix strictMode to reject users without an assigned role

Signed-off-by: kyschouv <kyschouv@microsoft.com>

* AzureAd OAuth: Add test for strictMode auth when no role claims are returned

Signed-off-by: kyschouv <kyschouv@microsoft.com>

pkg/login/social/azuread_oauth.go

@@ -124,6 +124,10 @@ func extractEmail(claims azureClaims) string {
 
 func extractRole(claims azureClaims, autoAssignRole string, strictMode bool) models.RoleType {
 	if len(claims.Roles) == 0 {
+		if strictMode {
+			return models.RoleType("")
+		}
+
 		return models.RoleType(autoAssignRole)
 	}
 

pkg/login/social/azuread_oauth_test.go

@@ -296,6 +296,22 @@ func TestSocialAzureAD_UserInfo(t *testing.T) {
 			want:    nil,
 			wantErr: true,
 		},
+		{
+			name: "Fetch empty role when strict attribute role is true and no role claims returned",
+			fields: fields{
+				roleAttributeStrict: true,
+			},
+			claims: &azureClaims{
+				Email:             "me@example.com",
+				PreferredUsername: "",
+				Roles:             []string{},
+				Groups:            []string{},
+				Name:              "My Name",
+				ID:                "1234",
+			},
+			want:    nil,
+			wantErr: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {