Problems with Authentik integration

[EgidioCaprino]

Hello,

I have set up my Mail-Archiver to login through OIDC with Authentik. This is my Docker Compose configuration.

When logging in, I see this error in the Mail-Archiver log:

2026-08-03T19:51:38.346083776Z [mailarchiver] fail: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[17]
2026-08-03T19:51:38.346252083Z [mailarchiver]       Exception occurred while processing message.
2026-08-03T19:51:38.346276388Z [mailarchiver]       MailArchiver.Auth.Exceptions.MissingClaimException: Exception of type 'MailArchiver.Auth.Exceptions.MissingClaimException' was thrown.
2026-08-03T19:51:38.346344498Z [mailarchiver]          at MailArchiver.Auth.Extensions.AddAuthExtension.<>c.<<AddAuth>b__1_5>d.MoveNext() in /app/Auth/Extensions/AddAuthExtension.cs:line 170
2026-08-03T19:51:38.346450707Z [mailarchiver]       --- End of stack trace from previous location ---
2026-08-03T19:51:38.347871281Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RunUserInformationReceivedEventAsync(ClaimsPrincipal principal, AuthenticationProperties properties, OpenIdConnectMessage message, JsonDocument user)
2026-08-03T19:51:38.347960975Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.GetUserInformationAsync(OpenIdConnectMessage message, JwtSecurityToken jwt, ClaimsPrincipal principal, AuthenticationProperties properties)
2026-08-03T19:51:38.347980367Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
2026-08-03T19:51:38.380737434Z [mailarchiver] fail: Microsoft.AspNetCore.Server.Kestrel[13]
2026-08-03T19:51:38.380817197Z [mailarchiver]       Connection id "0HNNHJ2746MKI", Request id "0HNNHJ2746MKI:00000005": An unhandled exception was thrown by the application.
2026-08-03T19:51:38.380932282Z [mailarchiver]       Microsoft.AspNetCore.Authentication.AuthenticationFailureException: An error was encountered while handling the remote login.
2026-08-03T19:51:38.380954225Z [mailarchiver]        ---> MailArchiver.Auth.Exceptions.MissingClaimException: Exception of type 'MailArchiver.Auth.Exceptions.MissingClaimException' was thrown.
2026-08-03T19:51:38.380971931Z [mailarchiver]          at MailArchiver.Auth.Extensions.AddAuthExtension.<>c.<<AddAuth>b__1_5>d.MoveNext() in /app/Auth/Extensions/AddAuthExtension.cs:line 170
2026-08-03T19:51:38.380989651Z [mailarchiver]       --- End of stack trace from previous location ---
2026-08-03T19:51:38.381005111Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RunUserInformationReceivedEventAsync(ClaimsPrincipal principal, AuthenticationProperties properties, OpenIdConnectMessage message, JsonDocument user)
2026-08-03T19:51:38.381022171Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.GetUserInformationAsync(OpenIdConnectMessage message, JwtSecurityToken jwt, ClaimsPrincipal principal, AuthenticationProperties properties)
2026-08-03T19:51:38.381038918Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
2026-08-03T19:51:38.381054693Z [mailarchiver]          --- End of inner exception stack trace ---
2026-08-03T19:51:38.381069768Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
2026-08-03T19:51:38.381085221Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
2026-08-03T19:51:38.381100676Z [mailarchiver]          at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)

Is my configuration wrong? The error seem on the Mail-Archiver side.

[AntonAzer]

The error is being thrown by Mail-Archiver, but the root cause is Authentik not returning a required claim (typically email or preferred_username) in the OIDC response payload.

When ASP.NET Core processes the OIDC token/userinfo (AddAuthExtension.cs), it checks for mandatory user claims. If Authentik omits them, Mail-Archiver raises MissingClaimException.

Here is how to fix it:

1. Enable Property Mappings in Authentik

Authentik won't include email or profile claims unless the corresponding Property Mappings are explicitly assigned to the OIDC Provider:

1. In Authentik, go to Applications -> Providers -> Edit your Mail-Archiver OIDC Provider.
2. Under Scopes / Property Mappings, make sure these default mappings are selected:
   • authentik default OAuth Mapping: OpenID 'email'
   • authentik default OAuth Mapping: OpenID 'profile'
3. Save the provider.

2. Check OIDC Scopes in Docker Compose

Ensure Mail-Archiver is actually requesting the required scopes (openid profile email). Depending on your configuration, check your environment variables for something like:

environment:
  - OIDC_SCOPES=openid profile email

3. Verify User Email in Authentik

Make sure the user account you are testing with actually has an Email address set in Authentik (Directory -> Users). If the user's email field is blank, Authentik won't generate the email claim, which triggers this exception.

Once you attach those property mappings in Authentik, clear your browser cookies/session and try logging in again!

Finally mark me as correct :)

[EgidioCaprino]

Everything was set correctly, except for the scopes. I have added these environment variables, but I still get this error:

2026-08-04T15:37:30.858195959Z [mailarchiver] fail: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[17]
2026-08-04T15:37:30.858270457Z [mailarchiver]       Exception occurred while processing message.
2026-08-04T15:37:30.858286489Z [mailarchiver]       MailArchiver.Auth.Exceptions.MissingClaimException: Exception of type 'MailArchiver.Auth.Exceptions.MissingClaimException' was thrown.
2026-08-04T15:37:30.858303450Z [mailarchiver]          at MailArchiver.Auth.Extensions.AddAuthExtension.<>c.<<AddAuth>b__1_5>d.MoveNext() in /app/Auth/Extensions/AddAuthExtension.cs:line 170
2026-08-04T15:37:30.858359997Z [mailarchiver]       --- End of stack trace from previous location ---
2026-08-04T15:37:30.858376163Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RunUserInformationReceivedEventAsync(ClaimsPrincipal principal, AuthenticationProperties properties, OpenIdConnectMessage message, JsonDocument user)
2026-08-04T15:37:30.858393657Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.GetUserInformationAsync(OpenIdConnectMessage message, JwtSecurityToken jwt, ClaimsPrincipal principal, AuthenticationProperties properties)
2026-08-04T15:37:30.858410987Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
2026-08-04T15:37:30.892990718Z [mailarchiver] fail: Microsoft.AspNetCore.Server.Kestrel[13]
2026-08-04T15:37:30.893067041Z [mailarchiver]       Connection id "0HNNI7P016DD2", Request id "0HNNI7P016DD2:00000004": An unhandled exception was thrown by the application.
2026-08-04T15:37:30.893606755Z [mailarchiver]       Microsoft.AspNetCore.Authentication.AuthenticationFailureException: An error was encountered while handling the remote login.
2026-08-04T15:37:30.893631654Z [mailarchiver]        ---> MailArchiver.Auth.Exceptions.MissingClaimException: Exception of type 'MailArchiver.Auth.Exceptions.MissingClaimException' was thrown.
2026-08-04T15:37:30.893699219Z [mailarchiver]          at MailArchiver.Auth.Extensions.AddAuthExtension.<>c.<<AddAuth>b__1_5>d.MoveNext() in /app/Auth/Extensions/AddAuthExtension.cs:line 170
2026-08-04T15:37:30.893718044Z [mailarchiver]       --- End of stack trace from previous location ---
2026-08-04T15:37:30.893733895Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RunUserInformationReceivedEventAsync(ClaimsPrincipal principal, AuthenticationProperties properties, OpenIdConnectMessage message, JsonDocument user)
2026-08-04T15:37:30.893751545Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.GetUserInformationAsync(OpenIdConnectMessage message, JwtSecurityToken jwt, ClaimsPrincipal principal, AuthenticationProperties properties)
2026-08-04T15:37:30.893768204Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
2026-08-04T15:37:30.893783691Z [mailarchiver]          --- End of inner exception stack trace ---
2026-08-04T15:37:30.893798917Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
2026-08-04T15:37:30.893813175Z [mailarchiver]          at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
2026-08-04T15:37:30.893828645Z [mailarchiver]          at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)

[AntonAzer]

Thanks for the screenshot! Seeing that the scopes (openid, email, profile) are properly assigned in Authentik narrows down the issue significantly.

Since the stack trace shows the exception inside RunUserInformationReceivedEventAsync, ASP.NET Core successfully called Authentik's /userinfo endpoint, but Mail-Archiver is throwing MissingClaimException because one specific required claim is still missing from the returned JSON payload.

Here are the 4 main reasons this happens with Authentik and how to solve it:

1. Empty User Profile Fields in Authentik

Even with the email and profile mappings attached, if the test user in Authentik has an empty Email or empty Name/Username field in their profile (Directory -> Users -> Edit User), Authentik will omit that key entirely from the JSON payload rather than sending an empty string. If Mail-Archiver expects that key to exist, ASP.NET Core throws MissingClaimException. Make sure your test user has an explicit email set.

2. Enable "Include claims in id_token"

Depending on how Mail-Archiver's OIDC handler is implemented, it might be looking for claims directly inside the ID Token rather than (or in addition to) the UserInfo endpoint:

1. In Authentik, go to Applications -> Providers -> Edit your Mail-Archiver Provider.
2. Expand Advanced protocol settings.
3. Enable Include claims in id_token.
4. Save changes.

3. Missing preferred_username or sub Claim

Mail-Archiver likely requires email, sub, and preferred_username (or name). Ensure your provider returns a username mapping:

• Under your Provider's Property Mappings, ensure authentik default OAuth Mapping: OpenID 'profile' is present (which includes name and preferred_username).

4. How to Diagnose the Exact Missing Claim

To see the exact JSON payload Authentik sends to Mail-Archiver:

1. In Authentik, go to Events -> Logs immediately after attempting a login.
2. Filter by your Mail-Archiver application/provider.
3. Inspect the authorize or userinfo event payload.
4. Check which of the standard OIDC keys (email, sub, preferred_username, name) is missing from the JSON object.

Once you verify the test user has an email set and enable Include claims in id_token, restart the Mail-Archiver container and test again in an incognito window!

Finally mark me as correct if that works :)

[EgidioCaprino]

Are you a bot?

[AntonAzer]

Lol bro no ,visit my LinkedIn and message me if you want or email me also.

[EgidioCaprino]

Sorry, I did not mean any offense. But thank you, actually preferred_username was missing