OIDC login with Authelia fails with v24.05 #4770

New Issue

OVERLORD · 2026-02-05T09:14:34+03:00

OVERLORD commented

2026-02-05 09:14:34 +03:00

Originally created by @timosbot on GitHub (May 13, 2024).

Describe the Bug

After updating to version 25.5 via the Linuxserver docker image the login with OIDC using Authelia fails with the following error: "Userinfo endpoint response validation failed with error: No valid subject value found in userinfo data"

Steps to Reproduce

Use Authelia for OIDC
Try to login to Bookstack

Expected Behaviour

The login should just work.

Screenshots or Additional Context

The Authelia config has not been modified between version v24.05 and v24.02. Version v24.02 worked just fine.

Browser Details

Firefox

Exact BookStack Version

v24.05

Originally created by @timosbot on GitHub (May 13, 2024). ### Describe the Bug After updating to version 25.5 via the Linuxserver docker image the login with OIDC using Authelia fails with the following error: "Userinfo endpoint response validation failed with error: No valid subject value found in userinfo data" ### Steps to Reproduce 1. Use Authelia for OIDC 2. Try to login to Bookstack ### Expected Behaviour The login should just work. ### Screenshots or Additional Context ![image](https://github.com/BookStackApp/BookStack/assets/59708237/172ef6d1-8499-44f5-862d-8226adbb9df3) The Authelia config has not been modified between version v24.05 and v24.02. Version v24.02 worked just fine. ### Browser Details Firefox ### Exact BookStack Version v24.05

OVERLORD added the 🐛 Bug label 2026-02-05 09:14:34 +03:00

OVERLORD closed this issue

2026-02-05 09:14:35 +03:00

OVERLORD commented

2026-02-05 09:14:40 +03:00

@ssddanbrown commented on GitHub (May 14, 2024):

Hi @timosbot,
Looks like there's a couple of things going on here. Userinfo should only be used if not all expected details come back from the OIDC system in the token, and then for some reason that userinfo response is coming back invalid.

To help me understand what's going on, please could you:

Set OIDC_DUMP_USER_DETAILS=true and then run a login, and confirm back the dumped data.
Confirm what OIDC_* options you have set in your .env or docker environment and their values.

(Feel free to obfuscate values, but I need to be able to see the property names of things and know when a value is empty/false/null so please don't hide everything)

@ssddanbrown commented on GitHub (May 14, 2024): Hi @timosbot, Looks like there's a couple of things going on here. Userinfo should only be used if not all expected details come back from the OIDC system in the token, and then for some reason that userinfo response is coming back invalid. To help me understand what's going on, please could you: - Set `OIDC_DUMP_USER_DETAILS=true` and then run a login, and confirm back the dumped data. - Confirm what `OIDC_*` options you have set in your `.env` or docker environment and their values. (Feel free to obfuscate values, but I need to be able to see the property names of things and know when a value is empty/false/null so please don't hide everything)

OVERLORD commented

2026-02-05 09:14:41 +03:00

@timosbot commented on GitHub (May 14, 2024):

Sure here is the dumped data with OIDC_DUMP_USER_DETAILS=true enabled:

{
    "amr": [
        "pwd",
        "sms",
        "mfa",
        "mca"
    ],
    "at_hash": "KL*************",
    "aud": [
        "7Uwq9t39**********"
    ],
    "auth_time": 1715628051,
    "azp": "7Uwq9t39**********",
    "client_id": "7Uwq9t39**********",
    "email": "******",
    "email_verified": true,
    "exp": 1715713756,
    "iat": 1715710156,
    "iss": "https:\/\/*****.*****.****",
    "jti": "2eb*****************",
    "name": "******",
    "preferred_username": "*******",
    "sub": "504********************"
}

There are my OIDC_* settings:

- OIDC_NAME=SSO
- OIDC_DISPLAY_NAME_CLAIMS=bookstack
- OIDC_CLIENT_ID=7U************
- OIDC_CLIENT_SECRET=E**************
- OIDC_ISSUER=https://*****.********.*******
- OIDC_ISSUER_DISCOVER=true
- OIDC_DUMP_USER_DETAILS=true

@timosbot commented on GitHub (May 14, 2024): Sure here is the dumped data with `OIDC_DUMP_USER_DETAILS=true` enabled: ```json { "amr": [ "pwd", "sms", "mfa", "mca" ], "at_hash": "KL*************", "aud": [ "7Uwq9t39**********" ], "auth_time": 1715628051, "azp": "7Uwq9t39**********", "client_id": "7Uwq9t39**********", "email": "******", "email_verified": true, "exp": 1715713756, "iat": 1715710156, "iss": "https:\/\/*****.*****.****", "jti": "2eb*****************", "name": "******", "preferred_username": "*******", "sub": "504********************" } ``` There are my `OIDC_*` settings: ```yaml - OIDC_NAME=SSO - OIDC_DISPLAY_NAME_CLAIMS=bookstack - OIDC_CLIENT_ID=7U************ - OIDC_CLIENT_SECRET=E************** - OIDC_ISSUER=https://*****.********.******* - OIDC_ISSUER_DISCOVER=true - OIDC_DUMP_USER_DETAILS=true ```

OVERLORD commented

2026-02-05 09:14:43 +03:00

@ssddanbrown commented on GitHub (May 14, 2024):

@timosbot Thanks for the information.

Your OIDC_DISPLAY_NAME_CLAIMS=bookstack option would appear to be the underlying cause from my view.
There is no bookstack claim being provided in the token. In this case BookStack would fall back to just using the ID for the new user display names, but as of the latest update it will attempt to fetch this from the userinfo endpoint instead.

Is there a reason OIDC_DISPLAY_NAME_CLAIMS is set to bookstack? Or should it maybe instead be name or preferred_username which are part of your token data?

@ssddanbrown commented on GitHub (May 14, 2024): @timosbot Thanks for the information. Your `OIDC_DISPLAY_NAME_CLAIMS=bookstack` option would appear to be the underlying cause from my view. There is no `bookstack` claim being provided in the token. In this case BookStack would fall back to just using the ID for the new user display names, but as of the latest update it will attempt to fetch this from the userinfo endpoint instead. Is there a reason `OIDC_DISPLAY_NAME_CLAIMS` is set to `bookstack`? Or should it maybe instead be `name` or `preferred_username` which are part of your token data?

OVERLORD commented

2026-02-05 09:14:44 +03:00

@timosbot commented on GitHub (May 14, 2024):

You are so correct thanks for your amazing help. Setting OIDC_DISPLAY_NAME_CLAIMS=preferred_username fixed it. You are awesome thanks soooo much.

@timosbot commented on GitHub (May 14, 2024): You are so correct thanks for your amazing help. Setting OIDC_DISPLAY_NAME_CLAIMS=preferred_username fixed it. You are awesome thanks soooo much.

OVERLORD commented

2026-02-05 09:14:46 +03:00

@ssddanbrown commented on GitHub (May 14, 2024):

Glad I could help, and happy to hear that solved it!

@ssddanbrown commented on GitHub (May 14, 2024): Glad I could help, and happy to hear that solved it!

OVERLORD commented

2026-02-05 09:14:47 +03:00

@bodycount28 commented on GitHub (May 14, 2024):

You are so correct thanks for your amazing help. Setting OIDC_DISPLAY_NAME_CLAIMS=preferred_username fixed it. You are awesome thanks soooo much.

I had the same issue and this fixed it, thanks!

@bodycount28 commented on GitHub (May 14, 2024): > You are so correct thanks for your amazing help. Setting OIDC_DISPLAY_NAME_CLAIMS=preferred_username fixed it. You are awesome thanks soooo much. I had the same issue and this fixed it, thanks!

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#4770