nextcloud / nextcloud/user_oidc
Unable to map nested claim
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 181
- Forks
- 60
- Avg merge
- 7h 34m
- Merged PRs (30d)
- 26
Description
Hi there 👋
I'm currently using Nextcloud 30.0.8 with the user_oidc app version 7.1.0. I'm trying to use OpenID Connect for user login and synchronization via EasyVerein as an Identity Provider.
In my configuration, I have added the scopes: openid myself custom
Extra Claims: empty
I have defined for example the following in the mapping:
displayName: custom.nickname
However, the displayName field is not populated correctly in Nextcloud. I have increased the log level to 0 and confirmed via the logs what the returned token contains. Here's a sanitized version of the relevant part of the ID token:
{
"sub": "XXXXXXXX",
"name": "OpenID Test",
"username": "XXXX@domain.tld",
"email": "XXXX@domain.tld",
"custom": {
"nickname": "Spitzname"
},
...
}
As you can see, the nickname is present in a nested custom claim. According to the docs, the plugin allows specifying claim paths like custom.nickname, but this does not seem to work in practice (or is unsupported for nested claims?).
Other top-level mappings such as email and sub work perfectly.
❓ Question
Is there currently a supported way to map nested claims (like custom.nickname) to fields such as displayName in Nextcloud?
If not, is this a known limitation or something that could be supported in future releases?
Thanks in advance – and thanks for maintaining this useful plugin 🙌
Best regards,
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the documented custom.nickname mapping with the sanitized ID-token shape and review the linked user_oidc documentation for claim-path behavior. Confirm whether displayName is populated; if not, establish the supported behavior or the needed nested-claim support and verify it with a focused test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100