login error "Can not get identifier from provider"

[schklom]

When logging with Authelia recently, I get the error Can not get identifier from provider.

My config is

  'oidc_login_provider_url' => 'https://authelia.mydomain.com',
  'oidc_login_client_id' => 'nextcloud',
  'oidc_login_client_secret' => 'XXXXX',
  'oidc_login_auto_redirect' => false,
  'oidc_login_end_session_redirect' => false,
  'oidc_login_button_text' => 'Log in with Authelia',
  'oidc_login_hide_password_form' => false,
  'oidc_login_use_id_token' => true,
  'oidc_login_attributes' => 
  array (
    'id' => 'preferred_username',
    'name' => 'name',
    'mail' => 'email',
    'groups' => 'groups',
  ),
  'oidc_login_default_group' => 'oidc',
  'oidc_login_use_external_storage' => false,
  'oidc_login_scope' => 'openid profile email groups',
  'oidc_login_proxy_ldap' => false,
  'oidc_login_disable_registration' => false,
  'oidc_login_redir_fallback' => false,
  'oidc_login_tls_verify' => true,
  'oidc_create_groups' => true,
  'oidc_login_webdav_enabled' => false,
  'oidc_login_password_authentication' => false,
  'oidc_login_public_key_caching_time' => 86400,
  'oidc_login_min_time_between_jwks_requests' => 10,
  'oidc_login_well_known_caching_time' => 86400,
  'oidc_login_update_avatar' => false,
  'oidc_login_code_challenge_method' => 'S256'

and Authelia's config similar to https://www.authelia.com/integration/openid-connect/nextcloud/#authelia-1

      - client_id: nextcloud
        client_name: NextCloud
        client_secret: '$pbkdf2-XXXXX'
        public: false
        authorization_policy: two_factor
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://nextcloud.mydomain.com/apps/oidc_login/oidc'
        scopes:
          - openid
          - profile
          - email
          - groups
        userinfo_signed_response_alg: none
        pre_configured_consent_duration: '1 week'
        token_endpoint_auth_method: 'client_secret_basic'

I recently updated Nextcloud to 30.0.8.1.

OIDC login works well with other services, so I think the problem is here, but I could be wrong.

[jfoxwoosh]

I am also having the same issue. Only change I made was updating nextcloud container from 31.0.0 to 31.0.2 (linuxerserver.io v31.0.2-ls374).

[bkupidura]

Looks like this is caused by changes in Authelia.

https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter

We strongly recommend implementers use the standard process for obtaining the extra claims not generally intended to be included in the [ID Token](https://openid.net/specs/openid-connect-core-1_0.html#IDToken) by using the [Access Token](https://datatracker.ietf.org/doc/html/rfc6749#section-1.4) to obtain them from the [UserInfo Endpoint](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo).

[schklom]

Thanks! Adding the default claims policy to Nextcloud fixed it, but this might break later on because as they mention

This option only exists as a break-glass measure and is only offered on a best-effort basis.

[mercredo]

Thanks. Had the same problem. Adding this to authelias configuration.yaml solved it:

oidc:
   ...
    claims_policies:
      nextcloud_policy:
        id_token: ['groups', 'email', 'email_verified', 'alt_emails', 'preferred_username', 'name']
    clients:
      - client_id: 'nextcloud'
        client_name: 'NextCloud'        
        claims_policy: 'nextcloud_policy'
        ...

https://www.authelia.com/blog/4.39-release-notes#claims-policies

[redjumper]

Thanks! Adding the default claims policy to Nextcloud fixed it, but this might break later on because as they mention

This option only exists as a break-glass measure and is only offered on a best-effort basis.

After adding the default claims policy to nextcloud, I still get the error "Auto creating new users is disabled.”

[RickyRomero]

Thanks. Had the same problem. Adding this to authelias configuration.yaml solved it:

oidc:
...
claims_policies:
nextcloud_policy:
id_token: ['groups', 'email', 'email_verified', 'alt_emails', 'preferred_username', 'name']
clients:
- client_id: 'nextcloud'
client_name: 'NextCloud'
claims_policy: 'nextcloud_policy'
...
https://www.authelia.com/blog/4.39-release-notes#claims-policies

@mercredo This section from Authelia's docs isn't encouraging though.

This option only exists as a break-glass measure and is only offered on a best-effort basis.

@pulsejet Are you able to weigh in here? The solution suggested above looks like a stopgap designed for services that won't or can't be updated to support a UserInfo endpoint.

[RockyRen618]

I see everyone is using Keycloak, I'm using casdoor, is there any configuration example?

[eyJhb]

So, I just stumbled upon this thread, as I had the exact same issue and looking a at the docs, it seems quite obvious why we are all having this issue with Authelia :)

Most likely we have all set oidc_login_use_id_token to true, because that's what the Authelia guide said for Netxcloud, until three months ago (see here authelia/authelia@111344e#diff-3f4a1b33ed26a7ff1424ee5fcbdaed7239cc56743f14839f9d70816ddf7d0dd5 , which was changed three months ago).

-    'oidc_login_use_id_token' => true,
+    'oidc_login_use_id_token' => false,

So instead of setting these claims up, instead just REMOVE the line that specifies oidc_login_use_id_token, as the default value is false. The logic is found here

nextcloud-oidc-login/lib/Provider/OpenIDConnectClient.php

Lines 132 to 138 in b8a4aa8

	if ($this->config->getSystemValue('oidc_login_use_id_token', false)) {
	// Get user information from ID Token
	$profile = $this->getIdTokenPayload();
	} else {
	// Get user information from OIDC
	$profile = $this->requestUserInfo();
	}

, which in tern calls the UserInfo endpoint

nextcloud-oidc-login/3rdparty/jumbojett/openid-connect-php/src/OpenIDConnectClient.php

Lines 1350 to 1377 in b8a4aa8

	public function requestUserInfo($attribute = null) {
	$user_info_endpoint = $this->getProviderConfigValue('userinfo_endpoint');
	$schema = 'openid';
	$user_info_endpoint .= '?schema=' . $schema;
	//The accessToken has to be sent in the Authorization header.
	// Accept json to indicate response type
	$headers = ["Authorization: Bearer {$this->accessToken}",
	'Accept: application/json'];
	$user_json = json_decode($this->fetchURL($user_info_endpoint,null,$headers));
	if ($this->getResponseCode() <> 200) {
	throw new OpenIDConnectClientException('The communication to retrieve user data has failed with status code '.$this->getResponseCode());
	}
	$this->userInfo = $user_json;
	if($attribute === null) {
	return $this->userInfo;
	}
	if (property_exists($this->userInfo, $attribute)) {
	return $this->userInfo->$attribute;
	}
	return null;
	}

So I'm fairly confident, that if that's removed, things should start working again :)

I was going to try and implement the UserInfo endpoint things, till I realised it already was :p

[panoskpv]

So, I just stumbled upon this thread, as I had the exact same issue and looking a at the docs, it seems quite obvious why we are all having this issue with Authelia :)

Most likely we have all set oidc_login_use_id_token to true, because that's what the Authelia guide said for Netxcloud, until three months ago (see here authelia/authelia@111344e#diff-3f4a1b33ed26a7ff1424ee5fcbdaed7239cc56743f14839f9d70816ddf7d0dd5 , which was changed three months ago).

• 'oidc_login_use_id_token' => true,

• 'oidc_login_use_id_token' => false,

So instead of setting these claims up, instead just REMOVE the line that specifies oidc_login_use_id_token, as the default value is false. The logic is found here

nextcloud-oidc-login/lib/Provider/OpenIDConnectClient.php

Lines 132 to 138 in b8a4aa8
if ($this->config->getSystemValue('oidc_login_use_id_token', false)) {
// Get user information from ID Token
$profile = $this->getIdTokenPayload();
} else {
// Get user information from OIDC
$profile = $this->requestUserInfo();
}
, which in tern calls the UserInfo endpoint

nextcloud-oidc-login/3rdparty/jumbojett/openid-connect-php/src/OpenIDConnectClient.php

Lines 1350 to 1377 in b8a4aa8
public function requestUserInfo($attribute = null) {

 $user_info_endpoint = $this->getProviderConfigValue('userinfo_endpoint'); 
 $schema = 'openid'; 

 $user_info_endpoint .= '?schema=' . $schema; 

 //The accessToken has to be sent in the Authorization header. 
 // Accept json to indicate response type 
 $headers = ["Authorization: Bearer {$this->accessToken}", 
     'Accept: application/json']; 

 $user_json = json_decode($this->fetchURL($user_info_endpoint,null,$headers)); 
 if ($this->getResponseCode() <> 200) { 
     throw new OpenIDConnectClientException('The communication to retrieve user data has failed with status code '.$this->getResponseCode()); 
 } 
 $this->userInfo = $user_json; 

 if($attribute === null) { 
     return $this->userInfo; 
 } 

 if (property_exists($this->userInfo, $attribute)) { 
     return $this->userInfo->$attribute; 
 } 

 return null; 

}

So I'm fairly confident, that if that's removed, things should start working again :)

I was going to try and implement the UserInfo endpoint things, till I realised it already was :p

I would like to thank you SO much for the info. Totaly works

[fredbaty]

So, I just stumbled upon this thread, as I had the exact same issue and looking a at the docs, it seems quite obvious why we are all having this issue with Authelia :)

Most likely we have all set oidc_login_use_id_token to true, because that's what the Authelia guide said for Netxcloud, until three months ago (see here authelia/authelia@111344e#diff-3f4a1b33ed26a7ff1424ee5fcbdaed7239cc56743f14839f9d70816ddf7d0dd5 , which was changed three months ago).

• 'oidc_login_use_id_token' => true,

• 'oidc_login_use_id_token' => false,

So instead of setting these claims up, instead just REMOVE the line that specifies oidc_login_use_id_token, as the default value is false. The logic is found here

nextcloud-oidc-login/lib/Provider/OpenIDConnectClient.php

Lines 132 to 138 in b8a4aa8
if ($this->config->getSystemValue('oidc_login_use_id_token', false)) {
// Get user information from ID Token
$profile = $this->getIdTokenPayload();
} else {
// Get user information from OIDC
$profile = $this->requestUserInfo();
}
, which in tern calls the UserInfo endpoint

nextcloud-oidc-login/3rdparty/jumbojett/openid-connect-php/src/OpenIDConnectClient.php

Lines 1350 to 1377 in b8a4aa8
public function requestUserInfo($attribute = null) {

 $user_info_endpoint = $this->getProviderConfigValue('userinfo_endpoint'); 
 $schema = 'openid'; 

 $user_info_endpoint .= '?schema=' . $schema; 

 //The accessToken has to be sent in the Authorization header. 
 // Accept json to indicate response type 
 $headers = ["Authorization: Bearer {$this->accessToken}", 
     'Accept: application/json']; 

 $user_json = json_decode($this->fetchURL($user_info_endpoint,null,$headers)); 
 if ($this->getResponseCode() <> 200) { 
     throw new OpenIDConnectClientException('The communication to retrieve user data has failed with status code '.$this->getResponseCode()); 
 } 
 $this->userInfo = $user_json; 

 if($attribute === null) { 
     return $this->userInfo; 
 } 

 if (property_exists($this->userInfo, $attribute)) { 
     return $this->userInfo->$attribute; 
 } 

 return null; 

}

So I'm fairly confident, that if that's removed, things should start working again :)

I was going to try and implement the UserInfo endpoint things, till I realised it already was :p

THANK YOU. This has been driving me mad. You have succeeded where Claude had failed... Much appreciated.