Taking into account the chance that email will be used as a stand-in for subject, for transition to OIDC

2 files changed, 20 insertions, 5 deletions

diff --git a/src/main/resources/db/sqlfiddle/schema.sql b/src/main/resources/db/sqlfiddle/schema.sql
index 4a80e26..b8a7607 100644
--- a/src/main/resources/db/sqlfiddle/schema.sql
+++ b/src/main/resources/db/sqlfiddle/schema.sql
@@ -429,6 +429,8 @@ CREATE INDEX user_fiddles_user_schema_query_id ON user_fiddles USING btree (user
 
 CREATE UNIQUE INDEX user_identities ON users USING btree (issuer,subject);
 
+CREATE UNIQUE INDEX user_email ON users USING btree (email);
+
 
 --
 -- Name: db_type_ref; Type: FK CONSTRAINT; Schema: public; Owner: postgres
diff --git a/src/main/resources/script/oidc.js b/src/main/resources/script/oidc.js
index 3d2500e..a6556bd 100644
--- a/src/main/resources/script/oidc.js
+++ b/src/main/resources/script/oidc.js
@@ -81,11 +81,24 @@
 
                 // if the user isn't found in our local user cache, create a record for them
                 if (user === null) {
-                    openidm.create("system/fiddles/users", null, {
-                        "issuer" : claims.iss,
-                        "subject" : claims.sub,
-                        "email" : claims.email
-                    });
+
+                    // "email" is a poor-man's subject, standing in for the real value we might be missing
+                    user = openidm.read("system/fiddles/users/" + claims.iss + ":" + claims.email);
+
+                    if (user === null) {
+                        openidm.create("system/fiddles/users", null, {
+                            "issuer" : claims.iss,
+                            "subject" : claims.sub,
+                            "email" : claims.email
+                        });
+                    } else {
+                        openidm.update("system/fiddles/users/" + user._id, null, {
+                            "issuer" : claims.iss,
+                            "subject" : claims.sub,
+                            "email" : claims.email
+                        });
+                    }
+
                 }