fix(oauth2): verify user id exists

Signed-off-by: Philip Molares <philip.molares@udo.edu>

lib/web/auth/oauth2/index.js

@@ -62,6 +62,11 @@ function parseProfile (data) {
   const displayName = extractProfileAttribute(data, config.oauth2.userProfileDisplayNameAttr)
   const email = extractProfileAttribute(data, config.oauth2.userProfileEmailAttr)
 
+  if (id === undefined && username === undefined) {
+    logger.error('oauth2 auth failed: id and username are undefined')
+    throw new Error('User ID or Username required')
+  }
+
   return {
     id: id || username,
     username,

public/docs/release-notes.md

@@ -9,6 +9,7 @@ If you use SAML authentication, please make sure to update your SAML configurati
 See: https://docs.hedgedoc.org/configuration/#saml-login `CMD_SAML_ATTRIBUTE_USERNAME` or `CMD_SAML_ATTRIBUTE_EMAIL`  
 
 ### Bugfixes
+- Check if a valid user id is present when using OAuth2
 - Abort SAML login if NameID is undefined instead of logging in with a user named "undefined"
 - Set default values for username and email attribute mapping in SAML configuration