nextcloud / nextcloud/user_oidc

Unable to map nested claim

Open
#1,100 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature request priority: normal
Dominant language
PHP
Stars
181
Forks
60
Avg merge
7h 34m
Merged PRs (30d)
26

Description

Hi there 👋

I'm currently using Nextcloud 30.0.8 with the user_oidc app version 7.1.0. I'm trying to use OpenID Connect for user login and synchronization via EasyVerein as an Identity Provider.

In my configuration, I have added the scopes: openid myself custom
Extra Claims: empty

I have defined for example the following in the mapping:
displayName: custom.nickname

However, the displayName field is not populated correctly in Nextcloud. I have increased the log level to 0 and confirmed via the logs what the returned token contains. Here's a sanitized version of the relevant part of the ID token:

{
  "sub": "XXXXXXXX",
  "name": "OpenID Test",
  "username": "XXXX@domain.tld",
  "email": "XXXX@domain.tld",
  "custom": {
    "nickname": "Spitzname"
  },
  ...
}

As you can see, the nickname is present in a nested custom claim. According to the docs, the plugin allows specifying claim paths like custom.nickname, but this does not seem to work in practice (or is unsupported for nested claims?).

Other top-level mappings such as email and sub work perfectly.

❓ Question
Is there currently a supported way to map nested claims (like custom.nickname) to fields such as displayName in Nextcloud?

If not, is this a known limitation or something that could be supported in future releases?

Thanks in advance – and thanks for maintaining this useful plugin 🙌

Best regards,

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the documented custom.nickname mapping with the sanitized ID-token shape and review the linked user_oidc documentation for claim-path behavior. Confirm whether displayName is populated; if not, establish the supported behavior or the needed nested-claim support and verify it with a focused test.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.