Authelia OIDC Passkey issue and username with random chars at the end

[Minkulai]

Hello people! I hope I'm not too invasive or annoying with my post!

I don't know how to explain but my issue is that using Authelia as OIDC is giving me the below 2 issues:

1. My OIDC users are getting their names different from what they are configured on OIDC config file (eg. displayname__395e91da or _f471ec47)

2. If I authenticate my OIDC with Passkey it will give me "502 Bad Gateway", but using 6 digit code is fine

I tried to search for same issues, I guess I'm not that good at it since I didn't find any, please feel free to point me at those!!
Ah - and if there's any log or config I need to share to help me understand.

[s1t5]

During the initial login via an OIDC identity provider (e.g., Microsoft Entra ID, Authelia), the local username is composed from two values provided by the identity provider:

{display_name}_{first 8 characters of user ID}

The system appends a unique suffix to the display name to avoid name collisions. This is intentional behavior and is documented under “OIDC Implementation” → “User Provisioning Flow”.

The second point sounds very much like a reverse proxy issue. Are you using one in your setup?

[Minkulai]

For the first part - Thank you for providing this info and related link so I can read more about it!

For the second part - I do indeed use a reverse proxy, nginx proxy manager to be precise. I use the same for other Authelia OIDC apps and none of them required extra steps for passkey auth, they accept my logins even with that and not only with 6 digit code.

And thank you again, I really appreciated your time on this!

[s1t5]

No additional configuration should be required for MailArchiver, except for those described here. In principle, it doesn't matter for the MailArchiver whether authentication with the OIDC provider is done via passkey, normal login, or any other method.

[Minkulai]

I'm not sure if any other person had the same issue, or if there's sort of combination (mail-archiver + npm + authelia + passkey), however as mentioned the issue is only appearing when I use passkey (eg if I select 6code method, it's going through super smooth on same browser without clearning caches, or different browser, or incognito, or even different machine) and that is why it's a bit odd to me.

I can try to extract logs from all 3 services plus network logs from F12 if that would help.

Perhpas it's just a skill issue and I missconfigured something. I could also share the compose, env, and auth config if necessary.

[Minkulai]

Revmoving the logs I sent, I don't think they were relevant. See the Marked Answer.

[Minkulai]

I don't know if it's due to the latest updates or not, but adding the below bits in NPM fixed the issue with passkey. Digging around I found out that the passkeys carry much larger payload, but mail-archiver was the first one that gave me that bad gateway issue.
Perhaps might be worth adding a note/hint somewhere in the guides for Authelia if passkey is used in combo with NPM.

This is the advanced setting I added to the entry:

proxy_buffer_size 256k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
large_client_header_buffers 4 256k;