Defguard with external SSO (Authelia) fails to receive OIDC "email" scope
- Dominant language
- Rust
- Stars
- 2.8k
- Forks
- 115
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 51
Description
**Describe the bug**
When setting up Authelia as external SSO, after successfully logging in in Authelia, defguard returns the error:
> Email not found in the information returned from provider. Make sure your provider is configured correctly and that you have granted the necessary permissions to retrieve such information.
**To Reproduce**
Steps to reproduce the behavior:
1. Set up Authelia es external OpenID provider (for setup see additional context)
2. Login in with Authelia account and get redirected to Defguard
3. See error message
**Expected behavior**
Authelia returns the OIDC "email" scope. I expect Defguard to recognize it.
**Version information**
- Defguard Core version: v1.5.2
**Additional context**
Defguard OpenID Settings:
```
Provider: custom
Base URL: https://auth.authelia-server.domain
Client ID: defguard
Client Secret: mySecretABC (non-hashed)
Display Name: Authelia
```
Authelia OIDC Configuration:
```
identity_providers:
oidc:
hmac_secret: 'myHMACSecretABC'
jwks:
- key: {{ secret "/secrets/IDENTITY_PROVIDERS_OIDC_JWKS" | mindent 10 "|" | msquote }}
cors:
endpoints:
- authorization
- token
- revocation
- introspection
- userinfo
clients:
- client_id: defguard
#client_secret (non-hashed): mySecretABC (non-hashed)
client_secret: 'mySecretABC (hashed)'
client_name: 'Defguard VPN'
token_endpoint_auth_method: client_secret_basic
redirect_uris:
- https://defguard-core-url.domain/auth/callback
- https://enrollment-url.domain/openid/callback
- https://enrollment-url.domain/openid/mfa/callback
scopes:
- openid
- email
- profile
grant_types:
- refresh_token
- authorization_code
```
**Screenshots**
Contributor guide
Assessment
This issue has not been assessed yet.