[PR #5429] [MERGED] Add optional OIDC avatar fetching from the ``picture`` claim #6492

New Issue

OVERLORD · 2026-02-05T10:33:45+03:00

OVERLORD commented

2026-02-05 10:33:45 +03:00

📋 Pull Request Information

Original PR: https://github.com/BookStackApp/BookStack/pull/5429
Author: @rubentalstra
Created: 1/20/2025
Status: ✅ Merged
Merged: 5/24/2025
Merged by: @ssddanbrown

Base: development ← Head: development

📝 Commits (1)

da82e70 Add optional OIDC avatar fetching from the “picture” claim

📊 Changes

4 files changed (+46 additions, -4 deletions)

View changed files

📝 app/Access/Oidc/OidcService.php (+7 -1)
📝 app/Access/Oidc/OidcUserDetails.php (+2 -0)
📝 app/Config/oidc.php (+3 -0)
📝 app/Uploads/UserAvatars.php (+34 -3)

📄 Description

This update enables BookStack to optionally fetch user avatars from the OIDC picture claim. The implementation:

closes: https://github.com/BookStackApp/BookStack/issues/4271

Introduces a fetch_avatars config flag in config/oidc.php to toggle avatar retrieval.
Uses UserAvatars->assignToUserFromUrl($user, $picture, $accessToken) to support both public and private (Bearer token-protected) endpoints.
Fetches the picture claim from the user’s ID token or userinfo response, if provided.
Works with various OIDC providers (Google, Okta, Keycloak, Azure, etc.), provided they include or allow retrieving a valid picture URL.
Includes SSRF protection notes, advising users to only enable this if they trust the domains in the picture field.

This approach does not break existing behavior; avatar fetching is off by default. If enabled, BookStack will try to update a user’s avatar upon login, using the token to authenticate if necessary.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/BookStackApp/BookStack/pull/5429 **Author:** [@rubentalstra](https://github.com/rubentalstra) **Created:** 1/20/2025 **Status:** ✅ Merged **Merged:** 5/24/2025 **Merged by:** [@ssddanbrown](https://github.com/ssddanbrown) **Base:** `development` ← **Head:** `development` --- ### 📝 Commits (1) - [`da82e70`](https://github.com/BookStackApp/BookStack/commit/da82e70ca3cdd075f7ae148cb2f58fddb0d93627) Add optional OIDC avatar fetching from the “picture” claim ### 📊 Changes **4 files changed** (+46 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `app/Access/Oidc/OidcService.php` (+7 -1) 📝 `app/Access/Oidc/OidcUserDetails.php` (+2 -0) 📝 `app/Config/oidc.php` (+3 -0) 📝 `app/Uploads/UserAvatars.php` (+34 -3) </details> ### 📄 Description This update enables BookStack to **optionally** fetch user avatars from the OIDC `picture` claim. The implementation: - closes: https://github.com/BookStackApp/BookStack/issues/4271 1. Introduces a `fetch_avatars` config flag in `config/oidc.php` to toggle avatar retrieval. 2. Uses `UserAvatars->assignToUserFromUrl($user, $picture, $accessToken)` to support **both** public and **private** (Bearer token-protected) endpoints. 3. Fetches the `picture` claim from the user’s ID token or userinfo response, if provided. 4. Works with various OIDC providers (Google, Okta, Keycloak, Azure, etc.), provided they include or allow retrieving a valid `picture` URL. 5. Includes SSRF protection notes, advising users to only enable this if they trust the domains in the `picture` field. This approach does **not** break existing behavior; avatar fetching is off by default. If enabled, BookStack will try to update a user’s avatar upon login, using the token to authenticate if necessary. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-05 10:33:45 +03:00

OVERLORD closed this issue

2026-02-05 10:33:48 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#6492

[PR #5429] [MERGED] Add optional OIDC avatar fetching from the ``picture`` claim #6492

📋 Pull Request Information

📝 Commits (1)

📊 Changes

📄 Description

[PR #5429] [MERGED] Add optional OIDC avatar fetching from the ```picture``` claim #6492