add configurable username claim

oauthenticator/azuread.py

@@ -51,6 +51,7 @@ class AzureAdOAuthenticator(OAuthenticator):
     login_handler = AzureAdLoginHandler
 
     tenant_id = Unicode(config=True)
+    username_claim = Unicode(config=True)
 
     def get_tenant(self):
         if hasattr(self, 'tenant_id') and self.tenant_id:
@@ -64,6 +65,16 @@ def get_tenant(self):
             app_log.info('ID4: {0}'.format(tenant_id))
             return tenant_id
 
+    def get_username_claim(self):
+        """
+        The claim to map to the jupyter username, such as `upn` or `unique_name`
+        See https://docs.microsoft.com/en-gb/azure/active-directory/develop/id-tokens
+        """
+        if hasattr(self, 'username_claim') and self.username_claim:
+            app_log.info('ID5: {0}'.format(self.username_claim))
+            return self.username_claim
+        return 'oid'
+
     async def authenticate(self, handler, data=None):
         code = handler.get_argument("code")
         http_client = AsyncHTTPClient()
@@ -101,7 +112,7 @@ async def authenticate(self, handler, data=None):
         id_token = resp_json['id_token']
         decoded = jwt.decode(id_token, verify=False)
 
-        userdict = {"name": decoded['name']}
+        userdict = {"name": decoded[self.get_username_claim()]}
         userdict["auth_state"] = auth_state = {}
         auth_state['access_token'] = access_token
         # results in a decoded JWT for the user data

oauthenticator/tests/test_azuread.py

@@ -2,10 +2,12 @@
 from ..azuread import AzureAdOAuthenticator
 
 _t_id = 'XXX-XXX-XXXX'
+_t_username_claim = 'upn'
 
 
 class Config(object):
     tenant_id = _t_id
+    username_claim = _t_username_claim
 
 
 def test_gettenant_with_tenant_id():
@@ -20,3 +22,17 @@ def test_gettenant_with_tenant_id():
 def test_gettenant_from_env():
     t_id = AzureAdOAuthenticator.get_tenant(object)
     assert t_id.default_value == "some_random_id"
+
+
+def test_username_claim_config():
+    t_username_claim = AzureAdOAuthenticator.get_username_claim(Config())
+    assert t_username_claim == _t_username_claim
+
+
+def test_username_claim_default():
+
+    class Config(object):
+        tenant_id = _t_id
+
+    t_username_claim = AzureAdOAuthenticator.get_username_claim(Config())
+    assert t_username_claim == 'oid'