OAUTH2_Client not reading userid claim #8675

New Issue

GiteaMirror · 2025-11-02T08:14:13-06:00

GiteaMirror commented

2025-11-02 08:14:13 -06:00

Originally created by @jasonvriends on GitHub (Mar 9, 2022).

Gitea Version

1.14.2

Git Version

No response

Operating System

No response

How are you running Gitea?

I am trying to setup OAUTH2_Client with Azure AD.

The only available options in the app.ini for claims for a userid are: userid, nickname, and email.

sud is prefilled in Azure with something that can't be changed and it looks like Gitea will use that if populated before userid.

nickname is empty on Azure AD.

Are we able to update the config to select another claim for userid?

Database

No response

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Description

No response

Screenshots

No response

Originally created by @jasonvriends on GitHub (Mar 9, 2022). ### Gitea Version 1.14.2 ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? I am trying to setup OAUTH2_Client with Azure AD. The only available options in the app.ini for claims for a userid are: userid, nickname, and email. sud is prefilled in Azure with something that can't be changed and it looks like Gitea will use that if populated before userid. nickname is empty on Azure AD. Are we able to update the config to select another claim for userid? ### Database _No response_ ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Description _No response_ ### Screenshots _No response_

GiteaMirror added the topic/authentication label 2025-11-02 08:14:13 -06:00

GiteaMirror commented

2025-11-02 08:14:13 -06:00

@techknowlogick commented on GitHub (Mar 9, 2022):

Gitea Version
1.14.2

please update your version of Gitea. The version you are using is no longer supported.

Edit: Reading through this, I'm unsure what you are attempting to do, as 1. you can't configure app.ini on try.gitea.io or setup oauth client config, that requires elevated permissions which aren't provided. and 2. you can't configure oauth clients via app.ini

@techknowlogick commented on GitHub (Mar 9, 2022): > Gitea Version > 1.14.2 please update your version of Gitea. The version you are using is no longer supported. Edit: Reading through this, I'm unsure what you are attempting to do, as 1. you can't configure app.ini on try.gitea.io or setup oauth client config, that requires elevated permissions which aren't provided. and 2. you can't configure oauth clients via app.ini

GiteaMirror commented

2025-11-02 08:14:14 -06:00

@jasonvriends commented on GitHub (Mar 11, 2022):

Hello. The app.ini file has three options

;[oauth2_client]
;; The source of the username for new oauth2 accounts:
;; userid = use the userid / sub attribute
;; nickname = use the nickname attribute
;; email = use the username part of the email attribute
;USERNAME = nickname

When using Azure AD

nickname = Display Name, which has a space and not valuable
email = works, displays the first part of the email, but doesn't work for our case
userid = rather than read the userid claim which is the first part of a userprincipalname it sets the userid to the Azure AD user objectid.

Goal is to have the userid be the first part of our UPN.

@jasonvriends commented on GitHub (Mar 11, 2022): Hello. The app.ini file has three options ;[oauth2_client] ;; The source of the username for new oauth2 accounts: ;; userid = use the userid / sub attribute ;; nickname = use the nickname attribute ;; email = use the username part of the email attribute ;USERNAME = nickname When using Azure AD * nickname = Display Name, which has a space and not valuable * email = works, displays the first part of the email, but doesn't work for our case * userid = rather than read the userid claim which is the first part of a userprincipalname it sets the userid to the Azure AD user objectid. Goal is to have the userid be the first part of our UPN.

GiteaMirror commented

2025-11-02 08:14:14 -06:00

@techknowlogick commented on GitHub (Mar 11, 2022):

oh, my apologies. I was thinking you were attempting to create new auth with app.ini. I've re-opened this to keep track of it.

@techknowlogick commented on GitHub (Mar 11, 2022): oh, my apologies. I was thinking you were attempting to create new auth with app.ini. I've re-opened this to keep track of it.

GiteaMirror commented

2025-11-02 08:14:14 -06:00

@jcollie commented on GitHub (May 5, 2023):

This bug is over a year old, but I'm seeing this on Gitea 1.19.3 - a user that has never logged into Gitea before gets their AzureAD ObjectID as their Username and their "Authentication Sign-In Name".

@jcollie commented on GitHub (May 5, 2023): This bug is over a year old, but I'm seeing this on Gitea 1.19.3 - a user that has never logged into Gitea before gets their AzureAD ObjectID as their Username and their "Authentication Sign-In Name".

GiteaMirror commented

2025-11-02 08:14:14 -06:00

@jcollie commented on GitHub (May 5, 2023):

Setting USERNAME = email under [oauth2_client] in app.ini gets me a reasonable value for a user's username (oddcly it doesn't include @domain.name) but the Authentication Sign-In Name is still set to the AzureAD ObjectID. I can live with that for now.

@jcollie commented on GitHub (May 5, 2023): Setting `USERNAME = email` under `[oauth2_client]` in `app.ini` gets me a reasonable value for a user's username (oddcly it doesn't include `@domain.name`) but the `Authentication Sign-In Name` is still set to the AzureAD ObjectID. I can live with that for now.

GiteaMirror commented

2025-11-02 08:14:15 -06:00

@shyaminayesh commented on GitHub (Aug 22, 2024):

do we have any update on this ?

@shyaminayesh commented on GitHub (Aug 22, 2024): do we have any update on this ?

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#8675