Make avatar claim configurable

[redant777]

Describe your use-case which is not covered by existing documentation.

We need a confirmation of when the avatar is received. During user auth (scopes/claims/etc) or as a separate API call?

Reference any relevant documentation, other materials or issues/pull requests that can be used for inspiration.

No response

Are you interested in contributing to the documentation?

No response

[michael-doubez]

avatar could be one of the claims received but it depends on your provider.
Currently there is no way to provide claims other than the standard or configured one.

[michael-doubez]

Hum. I missed the PR about avatar URL - need documentation indeed

[redant777]

Is there a way to disable avatar gathering? This is what we see into Jenkins

[itsvshreyas]

Even we have the same issue. Is there a way to handle this when we are using Azure AD for SSO with OIDC? Thanks.

[redant777]

Hi @michael-doubez. Please suggest how we can disable gathering the avatar since we are using Azure AD for SSO with OIDC. Thanks

[michael-doubez]

@redant777 It seems the avatar claim is not configurable.

[franciscojpalma-uxxi]

I can reproduce a related issue with Microsoft Entra ID (Azure AD) and the latest version of the plugin.

Environment

Jenkins:
OpenID Connect Authentication Plugin: 4.690.v5821cf665e43
Identity Provider: Microsoft Entra ID (OIDC)

After a successful login, the user's avatar is broken.

I investigated the issue and found the following:

The id_token does not contain a picture claim.
The user is created correctly and the name/email are populated from the token.
However, an OicAvatarProperty is created automatically with the following value:
https://graph.microsoft.com/v1.0/me/photo/$value

I verified this from the Jenkins Script Console:

import hudson.model.User
import org.jenkinsci.plugins.oic.OicAvatarProperty

def u = User.get("", false)
def p = u.getProperty(OicAvatarProperty)

println p
println "Avatar URL: ${p?.avatarUrl}"

Output:

Avatar URL: https://graph.microsoft.com/v1.0/me/photo/$value

The problem is that this URL cannot be used directly as an source because Microsoft Graph requires an Authorization: Bearer <access_token> header. As a result, the browser receives a 401 Unauthorized response and Jenkins displays a broken avatar image.

My id_token contains the following relevant claims:

{
"name": "...",
"preferred_username": "...",
"email": "...",
"roles": ["..."]
}

There is no picture claim in the token.

Is the plugin intentionally generating the Microsoft Graph photo URL for Entra ID users? If so, would it be possible to:

ignore Microsoft Graph avatar URLs that require authentication,
make avatar synchronization optional,
or provide a way to disable OicAvatarProperty creation?

I'd be happy to test a fix if needed.

[itsvshreyas]

Hi @michael-doubez , A feature has been added in #782 to support configurable avatar claims, ignore Microsoft Graph protected avatar URLs by default, and provide an explicit opt-in setting to allow them when needed.