[Feature Request] Define custom field for user name with OIDC

[hermann1514]

What is your question?

Hi,
i use PocketID for my SSO and OIDC Configuration.

I have configured mail-archive now with the following settings:

  # OIDC Configuration
  - OAuth__Enabled=true
  - OAuth__Authority=https://xxxx.xxxxx.xxxxx./.well-known/openid-configuration
  - OAuth__ClientId=<secret>
  - OAuth__ClientSecret=<secret>
  - OAuth__ClientScopes__0=openid
  - OAuth__ClientScopes__1=profile
  - OAuth__ClientScopes__2=email

But when i login, the login page from mailarchive is reloaded and no login to mailarchive.

Is there an error in my configuration?

Must i add an callback URL in PocketID?

Thx.
Regards
Hermann

Application Version

2512.1

[s1t5]

I have no experience with pocketid, but in ms entry as well as authelia you have to configure the callback url (https://your-mail-archiver-domain/oidc-signin-completed), like shown in my example here: https://github.com/s1t5/mail-archiver/blob/main/doc/OIDC_Implementation.md

[hermann1514]

Thanks for the info. Unfortunately, that didn’t work either. Any other ideas?

[hermann1514]

Hi, I changed one more setting, specifically the OAuth__Authority. I now entered only the URL without “.well-known/openid-configuration”. Since then, the login works.

However, the user must first be activated by the admin, and the username ends up being first name, last name, and a string — which is the “sub” attribute from PocketID.

Is it possible to use the “preferred_username” or the email address as the username instead?

It might also be helpful if users were activated automatically.

Thanks.

[Hawolex]

I now entered only t

Can you show what you have in your "OAuth": section in the appsetting.jason file?
I have issues to get PocketID to work after authentication

[fbloemhof]

@Hawolex

Just got it working with PocketID.

  "OAuth": {
    "Enabled": true,
    "Authority": "https://pocketid.fqdn/",
    "ClientId": "{redacted}",
    "ClientSecret": "{redacted}",
    "ClientScopes": [
      "openid",
      "profile",
      "email",
      "groups"
    ],
    "DisablePasswordLogin": false,
    "AutoRedirect": false,
    "AdminEmails": [
        "{redacted}"
        ]
  },

I am using Nginx Proxy Manager, had to add following config to get it working:

proxy_busy_buffers_size 512k;
proxy_buffers 4 512k;
proxy_buffer_size 256k;

[Hawolex]

TY @fbloemhof

The added values to Ngnix helped my aswell.

[s1t5]

@fbloemhof thank you! I'll add this to the documentation