mirror of
https://github.com/fosrl/pangolin.git
synced 2026-05-21 01:11:38 -05:00
[GH-ISSUE #762] bug: OIDC authentication fails to fetch user details from UserInfo endpoint #1614
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/pangolin#1614
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Crowley723 on GitHub (May 22, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/762
Originally assigned to: @oschwartz10612 on GitHub.
Pangolin's OIDC authentication implementation only uses claims from the ID token and does not fetch additional user details from the provider's UserInfo endpoint when required claims are missing.
Expected Behavior:
When authenticating via OIDC, users should see their email address and full name in Pangolin, regardless of which claims the provider includes in the ID token.
Actual Behavior:
Users authenticated through OIDC providers that don't include email/name/groups claims in the ID token (like Authelia 4.39+) appear with their
subclaim (UUID) instead of their email address, and have blank name fields.Steps to Reproduce:
Additional Information:
I believe this issue is the same one fixed by this pr in Mealie.
Per the OIDC spec, it is not required for OIDC providers to return anything except for specific claims in the id_token given to the client after authentication. As such, if the client expects info about the user (such as email, username, etc) they may have to fetch said info from the provider's user info endpoint.
In the recent update for authelia (4.39), we stopped including this information (to achieve OIDC certification) by default which requires some clients to use the UserInfo endpoint. We provided a way for admins to continue using the old method but this is a band-aid fix.
Possible Solution:
As can be seen in the mealie pr, this should be a fairly straight forward fix, if the returned token doesn't contain the required information about the user, fetch it from the UserInfo endpoint instead.
@Crowley723 commented on GitHub (May 22, 2025):
I am blind apparently, this is likely the reason for the issue described in #671
@james-d-elliott commented on GitHub (May 22, 2025):
Just another note the most critical part of all of this, is subsection 5.7: https://openid.net/specs/openid-connect-core-1_0.html#ClaimStability
@github-actions[bot] commented on GitHub (Jun 6, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@Crowley723 commented on GitHub (Jun 6, 2025):
Definitely not stale.
@negabiggs commented on GitHub (Jun 9, 2025):
Also bumping this, attempting to work with discord as an OIDC provider, and username,email information is behind a UserInfo endpoint.
@PHLAK commented on GitHub (Nov 9, 2025):
This was a problem I noticed recently when setting up Authelia as an identity provider. Took me a while to realize it used the UUID instead of the email or user name.
@Vladimir-Va commented on GitHub (Nov 12, 2025):
Thanks for the topic. I also tried to set it up for a long time OIDC из Synology SSO Server without results.
In all clients it is usually sufficient to specify
/.well-known/openid-configurationbut this doesn't work in Pangoline.@ARandomGitHubUser commented on GitHub (Dec 10, 2025):
I spent some time looking into this. It appears that Arctic, the npm package used as an OAuth client in Pangolin, doesn't have built-in support for retrieving anything from the UserInfo endpoint. Arctic also does not appear to support a generic client implementation, which is what Pangolin really needs. You're "supposed" to use each of Arctic's providers individually; see https://github.com/pilcrowonpaper/arctic/issues/299#issuecomment-2814667357 and https://github.com/pilcrowonpaper/arctic/issues/310. This doesn't sound like it meet Pangolin's requirements.
Pangolin should probably switch to a more well-known client library, such as https://www.npmjs.com/package/openid-client.
openid-clientfully supports UserInfo. This library is used by Immich, another popular open-source project.I'm willing to take a deeper look into this, but I wanted to share what I've found so far and get some input from maintainers before I proceed further.
It also appears that because Discord only provides an OAuth 2 flow, not OIDC, Arctic will fail to process it (with a
Missing or invalid field: 'id_token'message). See https://github.com/pilcrowonpaper/arctic/issues/299Pangolin's own tag says
OAuth2/OIDC, so I think it's reasonable to assume that all OAuth2 providers should work, not just ones that return an OIDCid_token.