nextcloud / nextcloud/user_oidc
Only pull subject attribute in OpenID logins?
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 181
- Forks
- 60
- Avg merge
- 7h 34m
- Merged PRs (30d)
- 26
Description
It's possible I'm just stupid here, but I've configured NextCloud to authenticate against an on-premise IdP of ours (WHMCS), and while it technically works, the only attribute that gets pulled over is 'subject' (a random 16 character string), and not 'email' or 'first_name' or anything like that. Having reviewed the IdP documentation and done some validation in Postman, it seems like the 'sub' attribute is included in the id_token but the other attributes have to be queried from the user info endpoint (in this case, https://ouridurl.com/whmcs/user-info.php). That endpoint is listed in the well-known configuration that I set in the OpenID config in NextCloud.
When I generate my own access_token and query the user info endpoint (format: https://ouridurl.com/whmcs/user-info.php?access_token=myaccesstokengoeshere) it works and I'm able to see the user's other attributes. But, NextCloud never absorbs those attributes, so I'm stuck with new users whose 'name' is a random 16 character ID string that I can't edit and an empty email field that I also cannot edit.
I'm not sure if this is a bug or if I'm doing something wrong here but would love some assistance if anyone knows what's going on here. Thanks!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named. Start by tracing the OpenID login flow and its handling of the id_token, access token, and configured user-info endpoint, then reproduce the reported configuration. Done means supported user attributes such as name and email are imported rather than only the subject identifier.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100