Potential bug: Pangolin auto-deletes a user created via PocketID #1426

New Issue

MrUnknownDE · 2026-04-05T19:27:56+02:00

MrUnknownDE commented

2026-04-05 19:27:56 +02:00

Originally created by @kmanwar89 on 6/1/2025

Hi,

I'm working to migrate all auth to PocketID + Pangolin. While testing tonight, I kept running into a situation where I could get through PocketID's auth, but then wouldn't have access to a resource in Pangolin. What I discovered after lots of iterations was that the user I created in Pangolin, per the documentation, it would get deleted after I logged in through PocketID. I would then have to manually re-create the user in Pangolin to restore access.

I'd like to avoid posting a screencast exposing my personal setup, but I'd be happy to do a screen share over Webex/Zoom/Discord if one of the developers wants to reach out and see the issue live. Until then, here's the steps I followed to reproduce this issue - I'll do my best to make sure I didn't leave out any details. This operates under the assumption the Pangolin --> PocketID integration is already created, and "auto-provision of users" is turned on

NOTE: I think the auto-provision might be one of the causes, as this doesn't appear to actually work, and the PocketID documentation states it's only supported in Pangolin Professional, but the Pangolin documentation states there is feature parity, so that's a bit confusing. More work TBD

Create an external user in Pangolin, called "testuser" with PocketID as the OIDC provider. Set the role to "Members"
Do the following three things in PocketID:
a. Create the same user in PocketID; same username, test@123.com as an email, for instance
b. Create a user group for non-admin users called "users". Assign the user created in 2a. to this group
c. Generate a login code for the test user. Open an incognito/private browsing window, and use this to login to the PocketID auth panel. Add a passkey (I'm using a Yubikey on a Linux laptop as a test machine).

At this point, a separate, matching user exists in both systems

In Pangolin, make sure there is a test resource that has authentication enabled, and has access allowed to the "Members" role set in step 1 above.
On the test machine, close out all browsers, and open a new incognito browser. Navigate to any resource in Pangolin that is secured by authentication, and proceed through the login flow using PocketID + passkey. At this point, I had my Pangolin window open on the Access Control --> Users tab on my main machine to watch its status.
Upon successfully completing the auth flow through PocketID to a resource in Pangolin, refresh the page with Pangolin's users page; the testuser created will be missing!

Now that I've written this all out, I'll test the theory if the auto-provision of users is what is actually breaking it, but I wanted to bring this to the dev's attention. Thank you all for the work you've been doing, and hopefully the multiple issues I've raised will help continue to improve the product. Thank you!

Edit I disabled the auto-provision setting in the Server Admin/IdP and it indeed stopped deleting the created user. Is this a bug, or intended behavior?

*Originally created by @kmanwar89 on 6/1/2025* Hi, I'm working to migrate all auth to PocketID + Pangolin. While testing tonight, I kept running into a situation where I could get through PocketID's auth, but then wouldn't have access to a resource in Pangolin. What I discovered after lots of iterations was that the user I created in Pangolin, per the [documentation](https://docs.fossorial.io/Pangolin/Identity%20Providers/Providers/pocket-id), it would get deleted after I logged in through PocketID. I would then have to manually re-create the user in Pangolin to restore access. I'd like to avoid posting a screencast exposing my personal setup, but I'd be happy to do a screen share over Webex/Zoom/Discord if one of the developers wants to reach out and see the issue live. Until then, here's the steps I followed to reproduce this issue - I'll do my best to make sure I didn't leave out any details. This operates under the assumption the Pangolin --> PocketID integration is already created, and "auto-provision of users" is turned **on** * NOTE: I think the auto-provision *might* be one of the causes, as this doesn't appear to actually work, and the PocketID [documentation](https://pocket-id.org/docs/client-examples/pangolin) states it's only supported in Pangolin Professional, but the Pangolin documentation states there is feature parity, so that's a bit confusing. More work TBD 1. Create an external user in Pangolin, called "testuser" with PocketID as the OIDC provider. Set the role to "Members" 2. Do the following three things in PocketID: a. Create the same user in PocketID; same username, test@123.com as an email, for instance b. Create a user group for non-admin users called "users". Assign the user created in 2a. to this group c. Generate a login code for the test user. Open an incognito/private browsing window, and use this to login to the PocketID auth panel. Add a passkey (I'm using a Yubikey on a Linux laptop as a test machine). **At this point, a separate, matching user exists in both systems** 4. In Pangolin, make sure there is a test resource that has authentication enabled, and has access allowed to the "Members" role set in step 1 above. 5. On the test machine, close out all browsers, and open a new incognito browser. Navigate to any resource in Pangolin that is secured by authentication, and proceed through the login flow using PocketID + passkey. At this point, I had my Pangolin window open on the Access Control --> Users tab on my main machine to watch its status. 6. Upon successfully completing the auth flow through PocketID to a resource in Pangolin, refresh the page with Pangolin's users page; the testuser created will be *missing*! Now that I've written this all out, I'll test the theory if the auto-provision of users is what is actually breaking it, but I wanted to bring this to the dev's attention. Thank you all for the work you've been doing, and hopefully the multiple issues I've raised will help continue to improve the product. Thank you! *Edit* I disabled the auto-provision setting in the Server Admin/IdP and it indeed stopped deleting the created user. Is this a bug, or intended behavior?

MrUnknownDE closed this issue

2026-04-05 19:27:56 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1426