bug: OIDC authentication fails to fetch user details from UserInfo endpoint #1465

New Issue

MrUnknownDE · 2026-04-05T19:29:08+02:00

MrUnknownDE commented

2026-04-05 19:29:08 +02:00

Originally created by @Crowley723 on 5/22/2025

Pangolin's OIDC authentication implementation only uses claims from the ID token and does not fetch additional user details from the provider's UserInfo endpoint when required claims are missing.

Expected Behavior:
When authenticating via OIDC, users should see their email address and full name in Pangolin, regardless of which claims the provider includes in the ID token.

Actual Behavior:
Users authenticated through OIDC providers that don't include email/name/groups claims in the ID token (like Authelia 4.39+) appear with their sub claim (UUID) instead of their email address, and have blank name fields.

Steps to Reproduce:

Configure Authelia to act as an OIDC provider.
Configure Pangolin as an OIDC client for Authelia.
Attempt login with Pangolin.
See UUID instead of email once logged into Pangolin.

Additional Information:
I believe this issue is the same one fixed by this pr in Mealie.

Per the OIDC spec, it is not required for OIDC providers to return anything except for specific claims in the id_token given to the client after authentication. As such, if the client expects info about the user (such as email, username, etc) they may have to fetch said info from the provider's user info endpoint.

In the recent update for authelia (4.39), we stopped including this information (to achieve OIDC certification) by default which requires some clients to use the UserInfo endpoint. We provided a way for admins to continue using the old method but this is a band-aid fix.

Possible Solution:
As can be seen in the mealie pr, this should be a fairly straight forward fix, if the returned token doesn't contain the required information about the user, fetch it from the UserInfo endpoint instead.

*Originally created by @Crowley723 on 5/22/2025* Pangolin's OIDC authentication implementation only uses claims from the ID token and does not fetch additional user details from the provider's UserInfo endpoint when required claims are missing. **Expected Behavior:** When authenticating via OIDC, users should see their email address and full name in Pangolin, regardless of which claims the provider includes in the ID token. **Actual Behavior:** Users authenticated through OIDC providers that don't include email/name/groups claims in the ID token (like Authelia 4.39+) appear with their `sub` claim (UUID) instead of their email address, and have blank name fields. **Steps to Reproduce:** 1. Configure Authelia to act as an OIDC provider. 2. Configure Pangolin as an OIDC client for Authelia. 3. Attempt login with Pangolin. 4. See UUID instead of email once logged into Pangolin. **Additional Information:** I believe this issue is the same one fixed by [this pr](https://github.com/mealie-recipes/mealie/pull/5228) in Mealie. Per the OIDC spec, it is not required for OIDC providers to return anything except for [specific claims](https://openid.net/specs/openid-connect-core-1_0.html#IDToken) in the id_token given to the client after authentication. As such, if the client expects info about the user (such as email, username, etc) they may have to fetch said info from the provider's user info endpoint. In the recent update for authelia (4.39), we stopped including this information (to achieve OIDC certification) by default which requires some clients to use the [UserInfo](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo) endpoint. We [provided a way](https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter) for admins to continue using the old method but this is a band-aid fix. **Possible Solution:** As can be seen in the mealie pr, this should be a fairly straight forward fix, if the returned token doesn't contain the required information about the user, fetch it from the UserInfo endpoint instead.

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating potential bug potential bug potential bug potential bug potential bug potential bug potential bug potential bug potential bug potential bug

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1465