goauthentik / goauthentik/authentik

OAuth2/OpenID provider cannot overwrite sub with property mapping (user info endpoint?)

Open
#10,959 4 comments 1 reaction 0 assignees View on GitHub
bug status/reviewing
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Describe the bug**
Bit of background: For my Immich setup I am trying to have multiple SSO users share the same account. Since a few months, account linking in Immich is done on `sub`, breaking my setup. Linking used to be done on the user's email, which I had successfully overwritten for this specific application with a property mapping.

I believe Immich is fetching the userinfo endpoint to retrieve the `sub`: [Immich - auth.service.ts](https://github.com/immich-app/immich/blob/036676d50152779f3d0b11232039f8ed8cdba809/server/src/services/auth.service.ts#L228)

**To Reproduce**
Steps to reproduce the behavior:

1. Create Application provider
2. Create OAuth property mapping (see screenshot below)
3. Check preview in Provider settings => All seems ok
4. Try authenticating with an application that fetches userinfo rather than checks ID Token => Original subject value will be used instead of overwritten value

**Expected behavior**
Overwrite `sub` correctly on both ID Token and user info endpoint

**Screenshots**
My property mapping:
![image](https://github.com/user-attachments/assets/8bf8b88e-3057-4aa0-92bf-e9e5b58be47f)

During preview, the sub value is overwritten:
![image](https://github.com/user-attachments/assets/ede3003e-2d1a-4953-a634-5d3e93340d92)

**Version and Deployment (please complete the following information):**

- authentik version: 2024.6.3
- Deployment: docker-compose

**Additional context**
It seems to me that the ID token sub value may be overwritten, but not the userinfo endpoint. Can anyone confirm / fix?
This issue was previously discussed: https://github.com/goauthentik/authentik/issues/6106 - Some code was pushed and the issue got closed, yet it doesn't seem to work still for my use-case.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.