sub claim missing in oauth2 response

Hi,

I am currently using Nextcloud's OAuth2 feature with Grafana 11.2.0 on Nextcloud 29.0.6, thanks to this post.

However, the solution did not work out of the box. To make OAuth2 work with Grafana 11.2.0, I had to add the following to my grafana.ini:

[auth]
oauth_allow_insecure_email_lookup = true

From what I can tell, the issue originated in Grafana 10.1.0.
I noticed this warning in the grafana.log, which seems to be at the root of the problem:

logger=auth.client.generic_oauth t=2024-09-13T12:38:07.799870302+02:00 level=warn msg="Missing sub claim, oauth authentication without a sub claim is deprecated and will be rejected in future versions."

Based on my understanding, including a sub claim in the JSON response should resolve the warning in Grafana.

Additionally, there’s another log entry related to a missing id_token, though this only appears when debug output is enabled. I'm not sure if it's related to the sub claim warning.
Here's the message:

logger=oauth.generic_oauth t=2024-09-13T15:36:20.40985338+02:00 level=debug msg="Getting user info"
logger=oauth.generic_oauth t=2024-09-13T15:36:20.410037767+02:00 level=debug msg="Extracting user info from OAuth token"
logger=oauth.generic_oauth t=2024-09-13T15:36:20.410114196+02:00 level=debug msg="No id_token found" token="unsupported value type"

To continue using Nextcloud as an OAuth2 provider for Grafana, the oauth2 app in Nextcloud must include a valid sub claim.

Start by locating the Nextcloud OAuth2 app entry point that builds the JSON response returned to Grafana, then inspect any nearby OAuth2 response tests. Confirm how the response is produced and whether the requested valid sub claim is covered; done means the provider response includes that claim for Grafana authentication.