Self-hosted: /api/setup with create_pat: true creates an account with an empty domain, breaking single-account mode

[alex-allani]

On a brand new setup, I've created a main account and then setup google idp. However, when I connect with any of the google account (with custom domain), it creates a new tenant instead of having a single tenant. I tried with two google accounts from my workspace, and each of them creates a tenant.

I've seen that if I set the owner email and password inside the config.yaml, and then setup manually the idp, it doesn't create one account / user. But this removes the possibility to setup the first user programatically and the IdP as shown here: https://docs.netbird.io/selfhosted/automated-setup

Do you know what can cause that?

Also I've tried to check with claude if there was some issues, here are the outputs:

Version: v0.76.3, combined netbird-server binary, embedded Dex IdP, Postgres store

What happens

Bootstrap a fresh instance via POST /api/setup (create_pat: true, NB_SETUP_PAT_ENABLED=true) rather than the auth.owner: config key, add an external IdP, then log in with two Google users — each gets its own account/tenant instead of joining the existing one.

select domain, domain_category, is_domain_primary_account from accounts shows the setup-created account as ('', '', false). Bootstrapping with auth.owner: instead (so the first account is created by the first login) gives ('netbird.selfhosted', 'private', true) and everyone shares one account.

Why

Dex JWTs carry no wt_account_domain* claims (shared/auth/jwt/extractor.go:104-112), so tenant grouping depends entirely on single-account mode, auto-enabled by ResolveDomains (management/internals/server/server.go:411).

1. SetupService.SetupOwner provisions the account by calling GetAccountIDByUserID directly with a bare auth.UserAuth{UserId, Email, Name} (management/server/instance/setup_service.go:114), bypassing GetAccountIDFromUserAuth and thus single-account mode → the account is stored with domain=''.
2. updateUserAuthWithSingleMode (management/server/account.go:1573) then overwrites the configured domain with that empty one at line 1595. isDomainValid("") fails, and getAccountIDWithAuthorizationClaims falls through to "create a new account" for every unknown sub.

It is self-latching: singleAccountMode is computed once at boot as accountsCounter <= 1 (management/server/account.go:242), so once a second account exists and the server restarts, single-account mode is off permanently.

Note the account is only created at setup time because a PAT was requested — without create_pat, SetupOwner creates just the Dex user and the account is created correctly on first login.

Suggested fix

Apply the single-account-mode domain when SetupOwner provisions the account, and don't let updateUserAuthWithSingleMode replace a valid singleAccountModeDomain with an empty stored domain.

Workaround

Before the first external-IdP login:

UPDATE accounts SET domain='netbird.selfhosted', domain_category='private', is_domain_primary_account=true;

netbird.selfhosted specifically — ResolveDomains also derives dnsDomain from this value, so a real domain would change every peer's DNS suffix.

Repro test (drop into management/server/, uses the existing createManager helper)

package server

import (
	"context"
	"testing"

	"github.com/stretchr/testify/require"

	"github.com/netbirdio/netbird/management/server/store"
	"github.com/netbirdio/netbird/shared/auth"
)

// fresh install: ResolveDomains -> "netbird.selfhosted",
// BuildManager -> singleAccountMode = true (accountsCounter <= 1)
func freshManager(t *testing.T) *DefaultAccountManager {
	t.Helper()
	m, _, err := createManager(t)
	require.NoError(t, err)
	m.singleAccountMode = true
	m.singleAccountModeDomain = "netbird.selfhosted"
	return m
}

// Dex-issued JWT: no wt_account_domain / wt_account_domain_category claims
func login(t *testing.T, m *DefaultAccountManager, sub, email string) string {
	t.Helper()
	accountID, _, err := m.GetAccountIDFromUserAuth(context.Background(), auth.UserAuth{
		UserId: sub, Email: email, Name: email,
	})
	require.NoError(t, err)
	return accountID
}

// auth.owner in config, no /api/setup: first account created by the login path.
func TestSetupDomain_OwnerInConfig(t *testing.T) {
	m := freshManager(t)

	ownerAcc := login(t, m, "local-owner-sub", "admin@example.com")

	dom, cat, err := m.Store.GetAccountDomainAndCategory(context.Background(), store.LockingStrengthNone, ownerAcc)
	require.NoError(t, err)
	t.Logf("account created by first login: domain=%q category=%q", dom, cat)

	require.Equal(t, ownerAcc, login(t, m, "google-sub-1", "alice@example.com"))
	require.Equal(t, ownerAcc, login(t, m, "google-sub-2", "bob@example.com"))
}

// /api/setup with create_pat=true: SetupOwner calls GetAccountIDByUserID directly.
func TestSetupDomain_SetupEndpoint(t *testing.T) {
	m := freshManager(t)

	// exactly what management/server/instance/setup_service.go:114 does
	setupAcc, err := m.GetAccountIDByUserID(context.Background(), auth.UserAuth{
		UserId: "local-owner-sub", Email: "admin@example.com", Name: "First user",
	})
	require.NoError(t, err)

	dom, cat, err := m.Store.GetAccountDomainAndCategory(context.Background(), store.LockingStrengthNone, setupAcc)
	require.NoError(t, err)
	t.Logf("account created by /api/setup: domain=%q category=%q", dom, cat)

	g1 := login(t, m, "google-sub-1", "alice@example.com")
	g2 := login(t, m, "google-sub-2", "bob@example.com")

	// currently passes -- each user lands in its own account
	require.NotEqual(t, setupAcc, g1)
	require.NotEqual(t, g1, g2)
}

Output on v0.76.3:

--- PASS: TestSetupDomain_OwnerInConfig
    account created by first login: domain="netbird.selfhosted" category="private"
    owner=d9vd14oas7n5485813f0 google1=d9vd14oas7n5485813f0 google2=d9vd14oas7n5485813f0
--- PASS: TestSetupDomain_SetupEndpoint
    account created by /api/setup: domain="" category=""
    setup=d9vd150as7n5485813h0 google1=d9vd150as7n5485813j0 google2=d9vd150as7n5485813l0

The second test asserts the current (buggy) behaviour so it passes today — flipping the NotEquals to Equal turns it into a failing regression test.