3 people 06c451da40 fix(auth): link OIDC users by email when username fallback misses (#4012) ...

Both `usernamefallback` + `emailfallback` on: lookup required username
AND email match, so local user with different username never linked,
duplicate account created. Now verified-email-only lookup always tried
last.

Fixes #2022

## How to verify

1. Create a local user `localuser` with email `me@example.com`.
2. Configure an OIDC provider with `usernamefallback: true` and
`emailfallback: true`. In the IdP, create a user whose email is
`me@example.com` (sent with `email_verified: true`) and whose
username/sub is different from `localuser`.
3. Log in to Vikunja through that OIDC provider.
4. **Expected:** You are logged in as `localuser`, and `vikunja user
list` shows no new user for the provider's issuer.

**Before this PR:** a second user with a random or IdP-provided username
was created.

---------

Co-authored-by: kolaente <k@knt.li>

2026-09-24 06:27:43 +00:00

..

cron.go

…

logout_test.go

…

logout.go

…

main_test.go

…

openid_test.go

fix(auth): link OIDC users by email when username fallback misses (#4012)

2026-09-24 06:27:43 +00:00

openid.go

fix(auth): link OIDC users by email when username fallback misses (#4012)

2026-09-24 06:27:43 +00:00

providers_test.go

fix(openid): pin token endpoint auth method instead of probing (#3607)

2026-08-27 12:43:11 +00:00

providers.go

fix(openid): pin token endpoint auth method instead of probing (#3607)

2026-08-27 12:43:11 +00:00

status_test.go

feat(auth): add OpenID provider availability monitoring and retry logic (#3145)

2026-07-10 17:52:01 +02:00

status.go

feat(auth): add OpenID provider availability monitoring and retry logic (#3145)

2026-07-10 17:52:01 +02:00