Reliable way to extract IdP from ID Token

[SimonTheLeg]

I was wondering if there is a reliable way to determine the IdP from an ID Token when having multiple IdPs connected to dex?

I know that the IdP-ID configured in dex gets packaged into the sub field (which I assume is to make the sub unique across multiple providers). However I noticed that it gets cut off after reaching a character-limit .

# base64 decoding of a `sub` field received from dex
❯ echo "CiRkMTgxOGFkNi1hNDg3LTRjMWQtOWNlYy1mZTgyODE3NDY5ZDgSFmRhcmtuZXNzLW15LW9sZC1mcmllbmQ" | base64 -d

$d1818ad6-a487-4c1d-9cec-fe82817469d8darkness-my-old-frie% 
# should be called "darkness-my-old-friend" not "...frie"

Since the other part of the sub field is coming directly from the IdP and therefore can vary in length: Is there a reliable way to determine the IdP-ID from an ID Token?

[nabokihms]

The sub claim is encoded with the base64url encoding. There are various tools to decode it. For example, in Golang there is a special base64 decoder for it - https://pkg.go.dev/encoding/base64#RawURLEncoding

[SimonTheLeg]

hi @nabokihms thank you for the answer. I understand now! Dex does not truncate it, it was just that base64 -d does not do raw-url-encoding and therefore swallowed the last character(s), which gave me the wrong impression.

For any later reader, the following works perfectly:

const sub = "CiRkMTgxOGFkNi1hNDg3LTRjMWQtOWNlYy1mZTgyODE3NDY5ZDgSFmRhcmtuZXNzLW15LW9sZC1mcmllbmQ"

dec, _ := base64.RawURLEncoding.DecodeString(sub)
fmt.Println(string(dec))

---

This leads to a small follow-up question from my side: Is there a way to cleverly separate the two parts of the sub field? without:

• knowing the length of the ID returned by the IdP and
• knowing the ID that is configured in dex's connectors.[].id field