Bookstack OIDC fail to login with a empty groups claims #4855

New Issue

OVERLORD · 2026-02-05T09:21:09+03:00

OVERLORD commented

2026-02-05 09:21:09 +03:00

Originally created by @Misaka-L on GitHub (Jul 5, 2024).

Describe the Bug

If the roles field in the response of the OIDC system is a empty array and user try to login without exist user in bookstack, they will get this error:

Steps to Reproduce

Return a empty groups claims in OIDC user response
Try to login without exist user in bookstack
Throw error

Expected Behaviour

User login success and create a new bookstack account with a default role if the groups claims is empty (it should can be config by editing .env or web ui?).

Screenshots or Additional Context

OIDC User info dump

{
    "sub": "****",
    "name": "****",
    "picture": null,
    "updated_at": 1719400164865,
    "username": "****",
    "created_at": 1719398180979,
    "email": "****@****.com",
    "email_verified": true,
    "roles": [],
    "at_hash": "****",
    "aud": "ja7i8qdjfsn6asiwlce4o",
    "exp": 1720193283,
    "iat": 1720189683,
    "iss": "https://****/oidc"
}

.env

AUTH_METHOD=oidc

AUTH_AUTO_INITIATE=true

OIDC_NAME=****
OIDC_DISPLAY_NAME_CLAIMS=name

OIDC_CLIENT_ID=****
OIDC_CLIENT_SECRET=****

OIDC_ISSUER=https://****/oidc

OIDC_END_SESSION_ENDPOINT=true
OIDC_ISSUER_DISCOVER=true

OIDC_USER_TO_GROUPS=true
OIDC_GROUPS_CLAIM=roles
OIDC_ADDITIONAL_SCOPES=roles
OIDC_REMOVE_FROM_GROUPS=true

OIDC_DUMP_USER_DETAILS=false

Browser Details

Microsoft Edge 127.0.2651.15 Beta (64-bit) on Windows 11 24H2 (26120.961)

Exact BookStack Version

v24.05.2

Originally created by @Misaka-L on GitHub (Jul 5, 2024). ### Describe the Bug If the `roles` field in the response of the OIDC system is a empty array and user try to login without exist user in bookstack, they will get this error: ![5df29eb4ce027e79cbcea686dab12f99](https://github.com/BookStackApp/BookStack/assets/42287372/a6a5fc30-eb70-40ce-a946-6afd3359e302) ### Steps to Reproduce 1. Return a empty groups claims in OIDC user response 2. Try to login without exist user in bookstack 3. Throw error ### Expected Behaviour User login success and create a new bookstack account with a default role if the groups claims is empty (it should can be config by editing `.env` or web ui?). ### Screenshots or Additional Context **OIDC User info dump** ```json { "sub": "****", "name": "****", "picture": null, "updated_at": 1719400164865, "username": "****", "created_at": 1719398180979, "email": "****@****.com", "email_verified": true, "roles": [], "at_hash": "****", "aud": "ja7i8qdjfsn6asiwlce4o", "exp": 1720193283, "iat": 1720189683, "iss": "https://****/oidc" } ``` **.env** ```env AUTH_METHOD=oidc AUTH_AUTO_INITIATE=true OIDC_NAME=**** OIDC_DISPLAY_NAME_CLAIMS=name OIDC_CLIENT_ID=**** OIDC_CLIENT_SECRET=**** OIDC_ISSUER=https://****/oidc OIDC_END_SESSION_ENDPOINT=true OIDC_ISSUER_DISCOVER=true OIDC_USER_TO_GROUPS=true OIDC_GROUPS_CLAIM=roles OIDC_ADDITIONAL_SCOPES=roles OIDC_REMOVE_FROM_GROUPS=true OIDC_DUMP_USER_DETAILS=false ``` ![5df29eb4ce027e79cbcea686dab12f99](https://github.com/BookStackApp/BookStack/assets/42287372/a6a5fc30-eb70-40ce-a946-6afd3359e302) ### Browser Details Microsoft Edge 127.0.2651.15 Beta (64-bit) on Windows 11 24H2 (26120.961) ### Exact BookStack Version v24.05.2

OVERLORD added the 🐛 Bug 🚪 Authentication 🏭 Back-End labels 2026-02-05 09:21:09 +03:00

OVERLORD closed this issue

2026-02-05 09:21:13 +03:00

OVERLORD commented

2026-02-05 09:21:16 +03:00

@ssddanbrown commented on GitHub (Jul 14, 2024):

Thanks for reporting @Misaka-L.
I could confirm that BookStack was not differentiating between non-provided and an empty groups list in the OIDC ID token data, and therefore would default to calling the userinfo endpoint upon an empty group list in an attempt to gain more information.

I'm not sure why the userinfo call was failing for you though, I did double check this against a live OIDC system to ensure the userinfo part works as expected, which it does from my test.

Otherwise, I've addressed the providing of empty groups in commit 767699a066, so the userinfo won't be called if a valid empty group list is provided, and this will be part of the next patch release.

@ssddanbrown commented on GitHub (Jul 14, 2024): Thanks for reporting @Misaka-L. I could confirm that BookStack was not differentiating between non-provided and an empty groups list in the OIDC ID token data, and therefore would default to calling the userinfo endpoint upon an empty group list in an attempt to gain more information. I'm not sure why the userinfo call was failing for you though, I did double check this against a live OIDC system to ensure the userinfo part works as expected, which it does from my test. Otherwise, I've addressed the providing of empty groups in commit 767699a0664c13fea1293654578f571ec4a08fa3, so the userinfo won't be called if a valid empty group list is provided, and this will be part of the next patch release.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#4855