Merge branch '18326-cuda-docs' refs #18326

[arvados.git] / lib / controller / localdb / login_oidc.go

diff --git a/lib/controller/localdb/login_oidc.go b/lib/controller/localdb/login_oidc.go
index 61dc5c816b35661f39c4a800ab17f1bf55325f06..e076f7e1289c2b7ad48c6b7fb7e8782fd85ff1ce 100644 (file)
--- a/lib/controller/localdb/login_oidc.go
+++ b/lib/controller/localdb/login_oidc.go
@@ -177,12 +177,19 @@ func (ctrl *oidcLoginController) getAuthInfo(ctx context.Context, token *oauth2.
        } else if verified, _ := claims[ctrl.EmailVerifiedClaim].(bool); verified || ctrl.EmailVerifiedClaim == "" {
                // Fall back to this info if the People API call
                // (below) doesn't return a primary && verified email.
-               name, _ := claims["name"].(string)
-               if names := strings.Fields(strings.TrimSpace(name)); len(names) > 1 {
-                       ret.FirstName = strings.Join(names[0:len(names)-1], " ")
-                       ret.LastName = names[len(names)-1]
-               } else if len(names) > 0 {
-                       ret.FirstName = names[0]
+               givenName, _ := claims["given_name"].(string)
+               familyName, _ := claims["family_name"].(string)
+               if givenName != "" && familyName != "" {
+                       ret.FirstName = givenName
+                       ret.LastName = familyName
+               } else {
+                       name, _ := claims["name"].(string)
+                       if names := strings.Fields(strings.TrimSpace(name)); len(names) > 1 {
+                               ret.FirstName = strings.Join(names[0:len(names)-1], " ")
+                               ret.LastName = names[len(names)-1]
+                       } else if len(names) > 0 {
+                               ret.FirstName = names[0]
+                       }
                }
                ret.Email, _ = claims[ctrl.EmailClaim].(string)
        }
@@ -401,11 +408,8 @@ func (ta *oidcTokenAuthorizer) registerToken(ctx context.Context, tok string) er
                // cached positive result
                aca := cached.(arvados.APIClientAuthorization)
                var expiring bool
-               if aca.ExpiresAt != "" {
-                       t, err := time.Parse(time.RFC3339Nano, aca.ExpiresAt)
-                       if err != nil {
-                               return fmt.Errorf("error parsing expires_at value: %w", err)
-                       }
+               if !aca.ExpiresAt.IsZero() {
+                       t := aca.ExpiresAt
                        expiring = t.Before(time.Now().Add(time.Minute))
                }
                if !expiring {
@@ -498,7 +502,7 @@ func (ta *oidcTokenAuthorizer) registerToken(ctx context.Context, tok string) er
        if err != nil {
                return err
        }
-       aca.ExpiresAt = exp.Format(time.RFC3339Nano)
+       aca.ExpiresAt = exp
        ta.cache.Add(tok, aca)
        return nil
 }