🐛 Bug Report: Custom Claims with same key overrides previous defined values #625

New Issue

OVERLORD · 2026-02-04T20:41:10+03:00

OVERLORD commented

2026-02-04 20:41:10 +03:00

Originally created by @etho201 on GitHub (Jan 26, 2026).

Reproduction steps

If a user belongs to multiple groups, and you assign a custom claim to each group, the key-value pairs seem to conflict when the same key (but different value) is defined in more than one group.

For example:
I have Pocket-ID configured with both OCIS and OpenCloud. OpenCloud is a fork of OCIS so the way it is configured with OIDC is nearly identical. The difference is you have a group called ocisAdmin, and a group called opencloudAdmin. For the ocisAdmin group you are to add a custom claim key-value pair called roles:ocisAdmin, and for the opencloudAdmin group you are to add a custom claim key-value pair called roles:opencloudAdmin.

After doing this, if you click on `OIDC Data Preview" you will only see one of the values (probably whichever one was added most recently).

The only way around this is to instead define the custom claims at the user level instead, and it needs to be defined in a very specific way. So if I want my admin user to have a key called roles with two values: ocisAdmin and opencloudAdmin, I need to define it within an array list. The key is roles, the value needs to be defined as ["ocisAdmin", "opencloudAdmin"].

I'm happy to have found a workaround, but I think it would be far more elegant if Pocket ID could simply combine any key-value pairs that have the same key into an array list, rather than wiping out the previously defined key-value pair.

Expected behavior

I expected that if I define a key-value pair in a group, if the key is the same as another key defined in a different group, the user profile assigned to those groups would have both values for that key.

Actual Behavior

I define a key-value pair in a group, if the key is the same as another key defined in a different group, the user profile assigned to those groups only has the latest value for that key (as verified in the OIDC Data Preview).

Pocket ID Version

v2.2.0

Database

SQLite

OS and Environment

Docker on Armbian 25.11.2 jammy

Log Output

No response

Originally created by @etho201 on GitHub (Jan 26, 2026). ### Reproduction steps If a user belongs to multiple groups, and you assign a custom claim to each group, the key-value pairs seem to conflict when the same key (but different value) is defined in more than one group. For example: I have Pocket-ID configured with both OCIS and OpenCloud. OpenCloud is a fork of OCIS so the way it is configured with OIDC is nearly identical. The difference is you have a group called `ocisAdmin`, and a group called `opencloudAdmin`. For the `ocisAdmin` group you are to add a custom claim key-value pair called `roles:ocisAdmin`, and for the `opencloudAdmin` group you are to add a custom claim key-value pair called `roles:opencloudAdmin`. After doing this, if you click on `OIDC Data Preview" you will only see one of the values (probably whichever one was added most recently). The only way around this is to instead define the custom claims at the user level instead, and it needs to be defined in a very specific way. So if I want my admin user to have a key called `roles` with two values: `ocisAdmin` and `opencloudAdmin`, I need to define it within an array list. The key is `roles`, the value needs to be defined as `["ocisAdmin", "opencloudAdmin"]`. I'm happy to have found a workaround, but I think it would be far more elegant if Pocket ID could simply combine any key-value pairs that have the same key into an array list, rather than wiping out the previously defined key-value pair. ### Expected behavior I expected that if I define a key-value pair in a group, if the key is the same as another key defined in a different group, the user profile assigned to those groups would have both values for that key. ### Actual Behavior I define a key-value pair in a group, if the key is the same as another key defined in a different group, the user profile assigned to those groups only has the latest value for that key (as verified in the OIDC Data Preview). ### Pocket ID Version v2.2.0 ### Database SQLite ### OS and Environment Docker on Armbian 25.11.2 jammy ### Log Output _No response_

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#625