OIDC login with Authelia fails with v24.05

[timosbot]

Describe the Bug

After updating to version 25.5 via the Linuxserver docker image the login with OIDC using Authelia fails with the following error: "Userinfo endpoint response validation failed with error: No valid subject value found in userinfo data"

Steps to Reproduce

1. Use Authelia for OIDC
2. Try to login to Bookstack

Expected Behaviour

The login should just work.

Screenshots or Additional Context

The Authelia config has not been modified between version v24.05 and v24.02. Version v24.02 worked just fine.

Browser Details

Firefox

Exact BookStack Version

v24.05

[ssddanbrown]

Hi @timosbot, Looks like there's a couple of things going on here. Userinfo should only be used if not all expected details come back from the OIDC system in the token, and then for some reason that userinfo response is coming back invalid.

To help me understand what's going on, please could you:

• Set OIDC_DUMP_USER_DETAILS=true and then run a login, and confirm back the dumped data.
• Confirm what OIDC_* options you have set in your .env or docker environment and their values.

(Feel free to obfuscate values, but I need to be able to see the property names of things and know when a value is empty/false/null so please don't hide everything)

[timosbot]

Sure here is the dumped data with OIDC_DUMP_USER_DETAILS=true enabled:

{
    "amr": [
        "pwd",
        "sms",
        "mfa",
        "mca"
    ],
    "at_hash": "KL*************",
    "aud": [
        "7Uwq9t39**********"
    ],
    "auth_time": 1715628051,
    "azp": "7Uwq9t39**********",
    "client_id": "7Uwq9t39**********",
    "email": "******",
    "email_verified": true,
    "exp": 1715713756,
    "iat": 1715710156,
    "iss": "https:\/\/*****.*****.****",
    "jti": "2eb*****************",
    "name": "******",
    "preferred_username": "*******",
    "sub": "504********************"
}

There are my OIDC_* settings:

- OIDC_NAME=SSO
- OIDC_DISPLAY_NAME_CLAIMS=bookstack
- OIDC_CLIENT_ID=7U************
- OIDC_CLIENT_SECRET=E**************
- OIDC_ISSUER=https://*****.********.*******
- OIDC_ISSUER_DISCOVER=true
- OIDC_DUMP_USER_DETAILS=true

[ssddanbrown]

@timosbot Thanks for the information.

Your OIDC_DISPLAY_NAME_CLAIMS=bookstack option would appear to be the underlying cause from my view. There is no bookstack claim being provided in the token. In this case BookStack would fall back to just using the ID for the new user display names, but as of the latest update it will attempt to fetch this from the userinfo endpoint instead.

Is there a reason OIDC_DISPLAY_NAME_CLAIMS is set to bookstack? Or should it maybe instead be name or preferred_username which are part of your token data?

[timosbot]

You are so correct thanks for your amazing help. Setting OIDC_DISPLAY_NAME_CLAIMS=preferred_username fixed it. You are awesome thanks soooo much.

[ssddanbrown]

Glad I could help, and happy to hear that solved it!

[bodycount28]

You are so correct thanks for your amazing help. Setting OIDC_DISPLAY_NAME_CLAIMS=preferred_username fixed it. You are awesome thanks soooo much.

I had the same issue and this fixed it, thanks!