OIDC login with Authelia fails with v24.05 about bookstack HOT 6 CLOSED

@timosbot Thanks for the information.

Your OIDC_DISPLAY_NAME_CLAIMS=bookstack option would appear to be the underlying cause from my view.
There is no bookstack claim being provided in the token. In this case BookStack would fall back to just using the ID for the new user display names, but as of the latest update it will attempt to fetch this from the userinfo endpoint instead.

Is there a reason OIDC_DISPLAY_NAME_CLAIMS is set to bookstack? Or should it maybe instead be name or preferred_username which are part of your token data?

from bookstack.

You are so correct thanks for your amazing help. Setting OIDC_DISPLAY_NAME_CLAIMS=preferred_username fixed it. You are awesome thanks soooo much.

from bookstack.

Hi @timosbot,
Looks like there's a couple of things going on here. Userinfo should only be used if not all expected details come back from the OIDC system in the token, and then for some reason that userinfo response is coming back invalid.

To help me understand what's going on, please could you:

• Set OIDC_DUMP_USER_DETAILS=true and then run a login, and confirm back the dumped data.
• Confirm what OIDC_* options you have set in your .env or docker environment and their values.

(Feel free to obfuscate values, but I need to be able to see the property names of things and know when a value is empty/false/null so please don't hide everything)

from bookstack.

Sure here is the dumped data with OIDC_DUMP_USER_DETAILS=true enabled:

{
    "amr": [
        "pwd",
        "sms",
        "mfa",
        "mca"
    ],
    "at_hash": "KL*************",
    "aud": [
        "7Uwq9t39**********"
    ],
    "auth_time": 1715628051,
    "azp": "7Uwq9t39**********",
    "client_id": "7Uwq9t39**********",
    "email": "******",
    "email_verified": true,
    "exp": 1715713756,
    "iat": 1715710156,
    "iss": "https:\/\/*****.*****.****",
    "jti": "2eb*****************",
    "name": "******",
    "preferred_username": "*******",
    "sub": "504********************"
}

There are my OIDC_* settings:

- OIDC_NAME=SSO
- OIDC_DISPLAY_NAME_CLAIMS=bookstack
- OIDC_CLIENT_ID=7U************
- OIDC_CLIENT_SECRET=E**************
- OIDC_ISSUER=https://*****.********.*******
- OIDC_ISSUER_DISCOVER=true
- OIDC_DUMP_USER_DETAILS=true

from bookstack.

Glad I could help, and happy to hear that solved it!

from bookstack.

You are so correct thanks for your amazing help. Setting OIDC_DISPLAY_NAME_CLAIMS=preferred_username fixed it. You are awesome thanks soooo much.

I had the same issue and this fixed it, thanks!

from bookstack.