unable to disable 'auto_provision'

[epifanio]

Hi,

I have enbled user_oidc - and i can log-in with my provider, but I need to create users manually and avoid user_oidc auto-provisioning.

I tried to create an user manually from the NextCloud Admin interface, and the set auto-provisioning to false in my config.php by adding:

  'user_oidc' => [
    'auto_provision' => false,
  ],

But then, when I try to log-in with my provider, user_oidc is refusing to log-in and prompt me to the following message:

Access forbidden

Failed to provision the user

Am I doing something wrong?

maybe somethinbg missing in the way how I configure user_oidc ?

I left empty the following section:

Attribute mapping

    User ID mapping

And I have the following as scope:

openid email profile

Thanks for any help!

--- edit ---

I see from the docs:

When soft_auto_provision is disabled
We refuse Oidc login of users that already exist in other backends

Does this means that if I manually create a user, I can not use OIDC login?
It looks like OIDC is not detecting that the user already exist .. I am probably missing something in the settings :(

[epifanio]

it was a mapping issue, I finally fixed it by setting "preferred_username" as username mapping from my log-in provider

• found some clue from the "well-known/openid-configuration" provider link

[classical]

it was a mapping issue, I finally fixed it by setting "preferred_username" as username mapping from my log-in provider

• found some clue from the "well-known/openid-configuration" provider link

Please show me more detail to fix it. I get the same issue also

[epifanio]

our OIDC provider is issuing the following info as claims_supported:

["aud","sub","iss","auth_time","name","given_name","family_name","preferred_username","email","acr"],

I had to change the nextcloud oid settings to mapp the Uid to preferred_username

in our config, shown via: ./occ user_oidc:provider provider_name
i now have: "mappingUid": "preferred_username",

Now if we add an user with the same username used in the provider, the user can log-in - this is ok but suboptimal, as we now need to know the username before adding the user ... ideally we want to use the email address - but not sure where to add it in the UI settings - our config is empty for the email settings: "mappingEmail": "",

[edward-ly]

Closing as the discussion seems to be resolved now. The email address should be provided through the email claim/scope which should be enabled by default.