v1.13.4

A fix for authentik logins, which have been refused since 1.12.0.

authentik logins (and other providers that mark every email unverified)

Since 1.12.0, rustguac refuses a login when the identity provider says the user's email is not verified (email_verified: false), because users are matched by email. authentik's default email scope mapping sends false for every user, so every authentik login has been refused with "Your identity provider has not verified your email address", and there was no way round it in rustguac.

There are two ways to fix it:

• On the authentik side (recommended): create a scope mapping for email that sends "email_verified": True, and select it on the rustguac provider in place of the default email mapping. The Authentik setup guide has it as a new step 2. Only do this if users can't change their own email in authentik (System > Settings > Allow users to change email, off by default).
• In rustguac: the new allow_unverified_email = true under [oidc] accepts these logins, for providers you can't change. It carries the same caveat: a user an admin added who has never logged in can be claimed by whoever the provider gives that email first. rustguac logs a warning at startup while it's on.

The refusal's log line now says what to change, and the login page asks the user to see an administrator. See How a login is matched to a user.

Thanks @Napsty for reporting it.

Upgrade note

• authentik users: apply one of the two fixes above. Upgrading alone doesn't change anything.