github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-11-09 00:22:38 -06:00
Code Issues 690 Packages Projects Releases 13 Wiki Activity

[GH-ISSUE #2022] OpenID fallback mapping does not match existing users (Authelia) #6526

New Issue
Closed
opened 2026-04-20 17:07:32 -05:00 by GiteaMirror · 8 comments
GiteaMirror commented 2026-04-20 17:07:32 -05:00
Owner
Copy Link
Copy Source

Originally created by @wolkenschieber on GitHub (Dec 23, 2025).
Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/2022

Description

When logging in via OpenID Connect using Authelia as the IAM provider, Vikunja creates a new user instead of mapping the login to an existing local user, even though USERNAMEFALLBACK and EMAILFALLBACK are enabled and the email address matches.

Environment
Vikunja: latest (Docker)
IAM: Authelia
Authentication: OpenID Connect

Authelia user configuration

user:
  disabled: false
  password: "Yes"
  email: user@example.com
  groups:
    - user

Authelia client configuration

- client_name: 'Vikunja'
  client_id: 'Yes'
  client_secret: 'Yes'
  public: false
  authorization_policy: 'one_factor'
  consent_mode: 'implicit'
  require_pkce: false
  redirect_uris:
    - 'https://vikunja.example.com/auth/openid/authelia'
  scopes:
    - 'openid'
    - 'profile'
    - 'email'
  response_types:
    - 'code'
  grant_types:
    - 'authorization_code'
  access_token_signed_response_alg: 'none'
  userinfo_signed_response_alg: 'none'
  token_endpoint_auth_method: 'client_secret_basic'

Vikunja OpenID configuration

VIKUNJA_AUTH_OPENID_ENABLED: false
VIKUNJA_AUTH_OPENID_REDIRECTURL: 'https://vikunja.example.com/auth/openid/'
VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_NAME: Authelia
VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_AUTHURL: https://authz.example.com
VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_CLIENTID: Yes
VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_CLIENTSECRET: Yes
VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_SCOPE: 'openid profile email'
VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_USERNAMEFALLBACK: true
VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_EMAILFALLBACK: true
VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_FORCEUSERINFO: true

Resulting users in database after OpenID login

┌────┬──────────┬──────────────────────┬────────┬───────────────────────────┬─────────┬──────────────────────┬──────────────────────┐
│ ID │ USERNAME │ EMAIL                │ STATUS │ ISSUER                    │ SUBJECT │ CREATED              │ UPDATED              │
├────┼──────────┼──────────────────────┼────────┼───────────────────────────┼─────────┼──────────────────────┼──────────────────────┤
│ 1  │ user1    │ user@example.com     │ Active │ local                     │         │ 2022-10-09T13:04:12Z │ 2025-12-22T21:02:37Z │
│ 19 │ user     │ user@example.com     │ Active │ https://authz.example.com │ Some    │ 2025-12-23T08:09:35Z │ 2025-12-23T08:09:35Z │
└────┴──────────┴──────────────────────┴────────┴───────────────────────────┴─────────┴──────────────────────┴──────────────────────┘

The email claim is present and identical for both users. FORCEUSERINFO is enabled. Both fallback options are enabled, but fallback matching is not applied and a new user is created instead.

Vikunja Version

v1.0.0-rc3

Browser and version

No response

Can you reproduce the bug on the Vikunja demo site?

No

Screenshots

No response

Originally created by @wolkenschieber on GitHub (Dec 23, 2025). Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/2022 ### Description When logging in via OpenID Connect using Authelia as the IAM provider, Vikunja creates a new user instead of mapping the login to an existing local user, even though `USERNAMEFALLBACK` and `EMAILFALLBACK` are enabled and the email address matches. **Environment** Vikunja: latest (Docker) IAM: Authelia Authentication: OpenID Connect **Authelia user configuration** ```yaml user: disabled: false password: "Yes" email: user@example.com groups: - user ``` **Authelia client configuration** ```yaml - client_name: 'Vikunja' client_id: 'Yes' client_secret: 'Yes' public: false authorization_policy: 'one_factor' consent_mode: 'implicit' require_pkce: false redirect_uris: - 'https://vikunja.example.com/auth/openid/authelia' scopes: - 'openid' - 'profile' - 'email' response_types: - 'code' grant_types: - 'authorization_code' access_token_signed_response_alg: 'none' userinfo_signed_response_alg: 'none' token_endpoint_auth_method: 'client_secret_basic' ``` **Vikunja OpenID configuration** ```yaml VIKUNJA_AUTH_OPENID_ENABLED: false VIKUNJA_AUTH_OPENID_REDIRECTURL: 'https://vikunja.example.com/auth/openid/' VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_NAME: Authelia VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_AUTHURL: https://authz.example.com VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_CLIENTID: Yes VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_CLIENTSECRET: Yes VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_SCOPE: 'openid profile email' VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_USERNAMEFALLBACK: true VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_EMAILFALLBACK: true VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHELIA_FORCEUSERINFO: true ``` **Resulting users in database after OpenID login** ``` ┌────┬──────────┬──────────────────────┬────────┬───────────────────────────┬─────────┬──────────────────────┬──────────────────────┐ │ ID │ USERNAME │ EMAIL │ STATUS │ ISSUER │ SUBJECT │ CREATED │ UPDATED │ ├────┼──────────┼──────────────────────┼────────┼───────────────────────────┼─────────┼──────────────────────┼──────────────────────┤ │ 1 │ user1 │ user@example.com │ Active │ local │ │ 2022-10-09T13:04:12Z │ 2025-12-22T21:02:37Z │ │ 19 │ user │ user@example.com │ Active │ https://authz.example.com │ Some │ 2025-12-23T08:09:35Z │ 2025-12-23T08:09:35Z │ └────┴──────────┴──────────────────────┴────────┴───────────────────────────┴─────────┴──────────────────────┴──────────────────────┘ ``` The email claim is present and identical for both users. FORCEUSERINFO is enabled. Both fallback options are enabled, but fallback matching is not applied and a new user is created instead. ### Vikunja Version v1.0.0-rc3 ### Browser and version _No response_ ### Can you reproduce the bug on the Vikunja demo site? No ### Screenshots _No response_
GiteaMirror added the area/api label 2026-04-20 17:07:32 -05:00
GiteaMirror commented 2026-04-20 17:07:34 -05:00
Author
Owner
Copy Link
Copy Source

@kolaente commented on GitHub (Dec 23, 2025):

But the username is different?

<!-- gh-comment-id:3685815590 --> @kolaente commented on GitHub (Dec 23, 2025): But the username is different?
GiteaMirror commented 2026-04-20 17:07:35 -05:00
Author
Owner
Copy Link
Copy Source

@wolkenschieber commented on GitHub (Dec 23, 2025):

Yes, username is different. I'm assuming configuration options are ORed?

<!-- gh-comment-id:3686113607 --> @wolkenschieber commented on GitHub (Dec 23, 2025): Yes, username is different. I'm assuming configuration options are ORed?
GiteaMirror commented 2026-04-20 17:07:36 -05:00
Author
Owner
Copy Link
Copy Source

@kolaente commented on GitHub (Dec 24, 2025):

No, both need to be true.

<!-- gh-comment-id:3689275829 --> @kolaente commented on GitHub (Dec 24, 2025): No, both need to be true.
GiteaMirror commented 2026-04-20 17:07:37 -05:00
Author
Owner
Copy Link
Copy Source

@kolaente commented on GitHub (Jan 8, 2026):

Closing as this seems to behave as expected, please ping if you think this is actually a bug

<!-- gh-comment-id:3723823322 --> @kolaente commented on GitHub (Jan 8, 2026): Closing as this seems to behave as expected, please ping if you think this is actually a bug
GiteaMirror commented 2026-04-20 17:07:37 -05:00
Author
Owner
Copy Link
Copy Source

@wolkenschieber commented on GitHub (Jan 12, 2026):

@kolaente I understand that OIDC users are identified by (issuer, subject). However, with EMAILFALLBACK=true / USERNAMEFALLBACK=true, Vikunja still creates a duplicate user even when a local user with the same verified email already exists.

This makes the fallback options misleading and ineffective when migrating from local auth to OIDC. Either fallback mapping should link an existing local user in this case, or the documentation should clearly state that fallback mapping never applies across issuers.

This seems like a bug or at least a documentation issue rather than working as expected.

<!-- gh-comment-id:3740336875 --> @wolkenschieber commented on GitHub (Jan 12, 2026): @kolaente I understand that OIDC users are identified by (issuer, subject). However, with `EMAILFALLBACK=true` / `USERNAMEFALLBACK=true`, Vikunja still creates a duplicate user even when a local user with the same verified email already exists. This makes the fallback options misleading and ineffective when migrating from local auth to OIDC. Either fallback mapping should link an existing local user in this case, or the documentation should clearly state that fallback mapping never applies across issuers. This seems like a bug or at least a documentation issue rather than _working as expected_.
GiteaMirror commented 2026-04-20 17:07:39 -05:00
Author
Owner
Copy Link
Copy Source

@kolaente commented on GitHub (Jan 14, 2026):

I've explained this more in the docs here: https://vikunja.io/docs/openid/

<!-- gh-comment-id:3751877982 --> @kolaente commented on GitHub (Jan 14, 2026): I've explained this more in the docs here: https://vikunja.io/docs/openid/
GiteaMirror commented 2026-04-20 17:07:39 -05:00
Author
Owner
Copy Link
Copy Source

@Jishin85 commented on GitHub (Feb 6, 2026):

@kolaente I've tried the whole day to set up USERNAMEFALLBACK and EMAILFALLBACK to true and, while every other variable was picked up correctly, those two weren't.
The only way I was able to set them was via config.yml, so there is likely something not working with the env variables at this time.

<!-- gh-comment-id:3861739615 --> @Jishin85 commented on GitHub (Feb 6, 2026): @kolaente I've tried the whole day to set up USERNAMEFALLBACK and EMAILFALLBACK to true and, while every other variable was picked up correctly, those two weren't. The only way I was able to set them was via config.yml, so there is likely something not working with the env variables at this time.
GiteaMirror commented 2026-04-20 17:07:40 -05:00
Author
Owner
Copy Link
Copy Source

@baragoon commented on GitHub (Apr 18, 2026):

same problem with authelia, tried with ENV and config.yml, usernamefallback and emailfallback are set, but OIDC user is created with different name but the same email. vikunja:2.3.0

┌────┬──────────────────────┬───────────────────────────┬────────┬───────────────────────────┬──────────────────────────────────────┬───────────────────────────┬───────────────────────────┐
│ ID │       USERNAME       │           EMAIL           │ STATUS │          ISSUER           │               SUBJECT                │          CREATED          │          UPDATED          │
├────┼──────────────────────┼───────────────────────────┼────────┼───────────────────────────┼──────────────────────────────────────┼───────────────────────────┼───────────────────────────┤
│ 5  │ repeatedly-aware-emu │ xxxxxx.xxxxxxxx@gmail.com │ Active │ https://auth.xxxxxxxx.com │ ae729b86-783f-4905-a576-b7053a86a9c4 │ 2026-04-18T10:08:40+03:00 │ 2026-04-18T10:08:40+03:00 │
│ 1  │ username             │ xxxxxx.xxxxxxxx@gmail.com │ Active │ local                     │                                      │ 2026-04-17T22:18:52+03:00 │ 2026-04-18T08:06:11+03:00 │
└────┴──────────────────────┴───────────────────────────┴────────┴───────────────────────────┴──────────────────────────────────────┴───────────────────────────┴───────────────────────────┘

auth:
  openid:
    enabled: true
    providers:
      oidc:
        name: OIDC
        authurl: https://auth.xxxxxxxx.com
        clientid: xxx-xxx
        clientsecret: xxx-xxx-xxx~C
        emailfallback: true
        forceuserinfo: true
        scope: openid profile email
        usernamefallback: true
<!-- gh-comment-id:4273104718 --> @baragoon commented on GitHub (Apr 18, 2026): same problem with authelia, tried with ENV and config.yml, usernamefallback and emailfallback are set, but OIDC user is created with different name but the same email. vikunja:2.3.0 ``` ┌────┬──────────────────────┬───────────────────────────┬────────┬───────────────────────────┬──────────────────────────────────────┬───────────────────────────┬───────────────────────────┐ │ ID │ USERNAME │ EMAIL │ STATUS │ ISSUER │ SUBJECT │ CREATED │ UPDATED │ ├────┼──────────────────────┼───────────────────────────┼────────┼───────────────────────────┼──────────────────────────────────────┼───────────────────────────┼───────────────────────────┤ │ 5 │ repeatedly-aware-emu │ xxxxxx.xxxxxxxx@gmail.com │ Active │ https://auth.xxxxxxxx.com │ ae729b86-783f-4905-a576-b7053a86a9c4 │ 2026-04-18T10:08:40+03:00 │ 2026-04-18T10:08:40+03:00 │ │ 1 │ username │ xxxxxx.xxxxxxxx@gmail.com │ Active │ local │ │ 2026-04-17T22:18:52+03:00 │ 2026-04-18T08:06:11+03:00 │ └────┴──────────────────────┴───────────────────────────┴────────┴───────────────────────────┴──────────────────────────────────────┴───────────────────────────┴───────────────────────────┘ ``` ``` auth: openid: enabled: true providers: oidc: name: OIDC authurl: https://auth.xxxxxxxx.com clientid: xxx-xxx clientsecret: xxx-xxx-xxx~C emailfallback: true forceuserinfo: true scope: openid profile email usernamefallback: true ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 pull-request
Mirrored from GitHub Pull Request
 pull-request
Mirrored from GitHub Pull Request
 pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No labels area/api
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#6526