goauthentik / goauthentik/authentik
OAuth2/OpenID provider cannot overwrite sub with property mapping (user info endpoint?)
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
**Describe the bug**
Bit of background: For my Immich setup I am trying to have multiple SSO users share the same account. Since a few months, account linking in Immich is done on `sub`, breaking my setup. Linking used to be done on the user's email, which I had successfully overwritten for this specific application with a property mapping.
I believe Immich is fetching the userinfo endpoint to retrieve the `sub`: [Immich - auth.service.ts](https://github.com/immich-app/immich/blob/036676d50152779f3d0b11232039f8ed8cdba809/server/src/services/auth.service.ts#L228)
**To Reproduce**
Steps to reproduce the behavior:
1. Create Application provider
2. Create OAuth property mapping (see screenshot below)
3. Check preview in Provider settings => All seems ok
4. Try authenticating with an application that fetches userinfo rather than checks ID Token => Original subject value will be used instead of overwritten value
**Expected behavior**
Overwrite `sub` correctly on both ID Token and user info endpoint
**Screenshots**
My property mapping:

During preview, the sub value is overwritten:

**Version and Deployment (please complete the following information):**
- authentik version: 2024.6.3
- Deployment: docker-compose
**Additional context**
It seems to me that the ID token sub value may be overwritten, but not the userinfo endpoint. Can anyone confirm / fix?
This issue was previously discussed: https://github.com/goauthentik/authentik/issues/6106 - Some code was pushed and the issue got closed, yet it doesn't seem to work still for my use-case.
Contributor guide
Assessment
This issue has not been assessed yet.