Why doesn't my user link? (Username capitalization)

[habandy]

Hi there,
Congratulations to the major release. 🥳

I've removed the manual configuration step in the HA configuration.yaml.
This should cause features.automatic_user_linking to be set to false by default, right?
Is there some way to link the new OIDC user with the existing local user?
Temporary i helped myself by switching the credentials in the homeassistant/.storage/auth file.

[christiaangoossens]

I guess I can't help you with editing the file as that's fully up to the default HA code. Login is handled using a separate credential object that contains the user subject (sub). If user linking is on, the username of an existing user is matched in the second stage if there is no subject match. If there is a username match, the subject credential is added to that user. If not, a new user is created.

In v1 if you use the UI config method there is an entire screen in the setup dedicated to user linking. If you use YAML or migrate, you can keep the config exactly the same as it was.

[christiaangoossens]

User linking being a security issue doesn't have anything to do with guessing usernames btw, but with the fact that many OIDC providers allow users to change their username. Subject never changes.

[habandy]

I saw in the credential file of HA there was only the claim "username" stored.
With the OIDC and my pocket-id setup there was a unique id stored as claim in the HA credentials file.
So yeah, thats totally a HA thing and maybe also an setup thing on my end with pocket-id. Maybe it needs proper setup.

I used the UI config method and selected the option to link the account, but i guess that didnt work because of the mismatching claims.
Deleting the user and reconfigure the integration did not help.

P.S: I'm using HA in a container, so not the barebone installation. Not sure if that changes a thing here.

[christiaangoossens]

I don't think its useful to look at the storage itself, you don't need to match anything there. Just make sure you have fully deleted the OIDC user (not just the person entity) and that you have turned on 'user linking'. After that, if your username in HA exactly matches (including capitalisation) the configured username claim it will link. After that you can turn user linking off.

[habandy]

I finally found the cause of my issue.

My username in Pocket ID was written with uppercase letters, for example Username123.
Pocket ID provided the claim preferred_username: Username123, but Home Assistant stores usernames in lowercase, for example username123.
Because of this mismatch, Home Assistant could not match the claim with the existing user account and created a new user instead.
Changing the username in Pocket ID to lowercase solved the problem.

[christiaangoossens]

Yeah, username matching is capitalization sensitive. Requests have been made in the past to change that, but as some providers allow having both 'User1' and 'user1' at the same time that would be unsafe. Glad you solved your issue.