HELP: duplicated Users after logging via OIDC

[f18m]

Hey all,

First of all thanks for this Integration -- it makes SSO possible with HomeAssistant and that's lovely!
I'm using Authelia in my setup and I was able to configure this integration correctly. SSO works.
However I noticed I ended up with a duplication of users:

e.,g. the two "Francesco" should be actualyl the same user. The first one marked as "Proprietario = Owner" having username "f18m" is the original user I had in HA before setting this up.
The second "Francesco" marked as "Amministratori = Admin" is the user that this integration created in the OIDC login flow from my Authelia instance.

How can I reconcile these users together?

Thanks!!!

[christiaangoossens]

Activate user linking, delete the admin Francesco without the username and login again with OIDC. Afterwards disable user linking.

User linking will automatically link your user if the OIDC user has the same (exact case sensitive) username as your HA user

Note that it should be disabled after initial onboarding due to the risk of account takeover and only works on first login (or when the OIDC account is fully deleted)

[f18m]

hey @christiaangoossens ,
thanks for the fast answer!!
Actually I tried to follow your suggestion. After several attempts I'm still unable to get this done.
To make sure I didn't mess up config I

• removed from HA ui the config entry for OIDC integration
• added to my configuration.yaml the following entry:

auth_oidc:
  client_id: "homeassistant"
  discovery_url: "https://auth.redacteddomain.org/.well-known/openid-configuration"
  features:
    automatic_user_linking: true

(as I'm using Public client configuration I didn't put any client_secret)

• while I was connected to HA as the "wrong" Francesco, I tried to delete that same user: HA didn't give me any error but the user was not deleted. That makes sense because it was the same user I was connected with. So:

• I disconnected; reached the login page and selected "Login with local user" and entered the local "good" Francesco user credentials (username f18m). That worked. Then I deleted the "wrong" Francesco. This time this worked.

• then I disconnected again and reconnected via OIDC. I was expecting to get logged in as the "good" Francesco but no way. A new user was created, again without any HA username associated, no picture/profile-icon.

Now I fear the problem could be that:

• in Authelia my user is "francesco" with displayname set to "Francesco" (capital F)
• in HA my user is "f18m" with displayname set to "Francesco" (capital F)

Is user_linking working only if the Authelia username matches the HA username (f18m) ?
Can I bind somehow my Authelia "francesco" to my HA "f18m" user ?
Or can I rename my HA user f18m -> francesco ?

Thanks!

[f18m]

After some more experiments I think I found my way out.
For future readers what I did was:

• I found that there is a file named /usr/share/hassio/homeassistant/.storage/auth that contains apparently all info HA has about authentication (pretty simple structure)
• I renamed my old non-OIDC user "f18m" to "francesco" so it matched exactly my username in Authelia
• logged out and relogged via OIDC; that worked! I was logged via OIDC as my "francesco" user
• went to the HA User/Person panel and cleaned up all old entries

Btw I left an entry for a "LocalAdminNoOIDC" with a strong password I can use in case OIDC stops working.

[christiaangoossens]

The names do have to be an exact match. I would not recommend changing the HA files, it is much better to add a claim in Authelia with the 'HA username' and then configure the integration to use that. Regardless, make sure to remove the user linking again, it is a security risk.

If you remove the user linking line the users will stay the same/linked, it just prevents new Authelia accounts from also being linked to the same HA accounts.