Failed to sign in: "Invalid username claim in OIDC response: preferred_username".

[mattiaginoble]

I just added OIDC login via Cloudflare and my Google account (same email as the account I already created during the initial setup), but I'm getting this error. Did I enter the environment variables incorrectly? Thanks

I have included everything that was in the documentation at Doc

I have not included:
OIDC_ADMIN_GROUP
OIDC_WELLKNOWN

[DecDuck]

The default OIDC_USERNAME_CLAIM is designed for Authentik, if you're not using that, you'll have to set it.

[mattiaginoble]

Thanks for your reply. I'm not using Authentik, but I am using Cloudflare Zero Trust for all my containers. Will support for this be added?

[DecDuck]

Can you try using OIDC_USERNAME_CLAIM=oidc_fields.preferred_username?

[mattiaginoble]

Added OIDC_USERNAME_CLAIM=oidc_fields.preferred_username to the environment variables, but I always get the same error.

I tried to add OIDC_USERNAME_CLAIM=email, it works now.
It created a new account for me with my Google email address (the same email address I used previously).

[DecDuck]

Alright, glad you got it working. I'll have to look more into how to actually get the username field from Cloudflare though.

[mattiaginoble]

Thanks to you, it's a great project anyway, you've made a lot of progress.

[InsertDisc]

If OIDC_USERNME_CLAIM=email worked then what are the chances OIDC_USERNME_CLAIM=preferred_username would work since those two are at the same level in the token?

[DecDuck]

I mean, try it and see. I believe that's the default but it's been a while since I wrote the OIDC code.

[TigerC10]

I mean, try it and see. I believe that's the default but it's been a while since I wrote the OIDC code.

The Google oauth IdP doesn't return a preferred_username claim, so Cloudflare OIDC can't include it.

[DecDuck]

Check other claims, and see what can be used as your username. There may be some docs on it for Google IdP.