nextcloud / nextcloud/user_oidc

Only pull subject attribute in OpenID logins?

Open
#1,043 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

fix in progress
Dominant language
PHP
Stars
181
Forks
60
Avg merge
7h 34m
Merged PRs (30d)
26

Description

It's possible I'm just stupid here, but I've configured NextCloud to authenticate against an on-premise IdP of ours (WHMCS), and while it technically works, the only attribute that gets pulled over is 'subject' (a random 16 character string), and not 'email' or 'first_name' or anything like that. Having reviewed the IdP documentation and done some validation in Postman, it seems like the 'sub' attribute is included in the id_token but the other attributes have to be queried from the user info endpoint (in this case, https://ouridurl.com/whmcs/user-info.php). That endpoint is listed in the well-known configuration that I set in the OpenID config in NextCloud.

When I generate my own access_token and query the user info endpoint (format: https://ouridurl.com/whmcs/user-info.php?access_token=myaccesstokengoeshere) it works and I'm able to see the user's other attributes. But, NextCloud never absorbs those attributes, so I'm stuck with new users whose 'name' is a random 16 character ID string that I can't edit and an empty email field that I also cannot edit.

I'm not sure if this is a bug or if I'm doing something wrong here but would love some assistance if anyone knows what's going on here. Thanks!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No file, test, or entry point is named. Start by tracing the OpenID login flow and its handling of the id_token, access token, and configured user-info endpoint, then reproduce the reported configuration. Done means supported user attributes such as name and email are imported rather than only the subject identifier.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.