starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: Multiple duplicate users created when using OIDC and web/mobile. #2481

New Issue
Closed
opened 2026-04-25 00:07:35 +02:00 by adam · 8 comments
adam commented 2026-04-25 00:07:35 +02:00
Owner
Copy Link
Copy Source

Originally created by @Tomos-Evans on GitHub (Jan 11, 2025).

What happened?

I have ABS configured to use Authelia as an OIDC provider, and have the option set to automatically create accounts on ABS when a new user signs in with Authelia.

When I log in on the android app and again through the web interface (using the same Authelia account) I get two different users created in ABS.

These users have the same name, etc, but are different acounts with their own history.
This makes it impossible to use from both the mobile app and the browser as I loose track of where I am.

What did you expect to happen?

I would expect only one user to be created, and it be used by both the mobile app and the web interface.

Steps to reproduce the issue

  1. Setup ABS with Authelia and set it to auto create accounts on sign in
  2. Sign in using authelia from the android app
  3. Sign in using authelia from the web interface
  4. Check the "users" section and see that there are two users with the same name.

Audiobookshelf version

2.13.4

How are you running audiobookshelf?

Docker

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

None

Logs

No response

Additional Notes

No response

Originally created by @Tomos-Evans on GitHub (Jan 11, 2025). ### What happened? I have ABS configured to use Authelia as an OIDC provider, and have the option set to automatically create accounts on ABS when a new user signs in with Authelia. When I log in on the android app and again through the web interface (using the same Authelia account) I get two different users created in ABS. These users have the same name, etc, but are different acounts with their own history. This makes it impossible to use from both the mobile app and the browser as I loose track of where I am. ### What did you expect to happen? I would expect only one user to be created, and it be used by both the mobile app and the web interface. ### Steps to reproduce the issue 1. Setup ABS with Authelia and set it to auto create accounts on sign in 2. Sign in using authelia from the android app 3. Sign in using authelia from the web interface 4. Check the "users" section and see that there are two users with the same name. ### Audiobookshelf version 2.13.4 ### How are you running audiobookshelf? Docker ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? None ### Logs _No response_ ### Additional Notes _No response_
adam added the bug label 2026-04-25 00:07:35 +02:00
adam closed this issue 2026-04-25 00:07:35 +02:00
adam commented 2026-04-25 00:07:35 +02:00
Author
Owner
Copy Link
Copy Source

@nichwall commented on GitHub (Jan 11, 2025):

Does this still happen on a later server version? The newest server version at the time of writing is 2.17.7

@nichwall commented on GitHub (Jan 11, 2025): Does this still happen on a later server version? The newest server version at the time of writing is 2.17.7
adam commented 2026-04-25 00:07:36 +02:00
Author
Owner
Copy Link
Copy Source

@Tomos-Evans commented on GitHub (Jan 11, 2025):

I am having a separate issue with OIDC on 2.17.7 that I am still trying to bottom out so am not able to get to the point of logging in on that version.

For awareness, on 2.17.7 the callback sent to the OIDC provider is /undefined/auth/openid/callback rather than the expected /auth/openid/callback so the auth provider rejects it as an invalid redirect URI.

@Tomos-Evans commented on GitHub (Jan 11, 2025): I am having a separate issue with OIDC on 2.17.7 that I am still trying to bottom out so am not able to get to the point of logging in on that version. For awareness, on 2.17.7 the callback sent to the OIDC provider is `/undefined/auth/openid/callback` rather than the expected `/auth/openid/callback` so the auth provider rejects it as an invalid redirect URI.
adam commented 2026-04-25 00:07:36 +02:00
Author
Owner
Copy Link
Copy Source

@Tomos-Evans commented on GitHub (Jan 11, 2025):

Would you like me to make a separate issue for this problem?

@Tomos-Evans commented on GitHub (Jan 11, 2025): Would you like me to make a separate issue for this problem?
adam commented 2026-04-25 00:07:36 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Jan 12, 2025):

What are you using for this setting
image

@advplyr commented on GitHub (Jan 12, 2025): What are you using for this setting ![image](https://github.com/user-attachments/assets/6406a9da-830d-4495-8793-85cd7a21badf)
adam commented 2026-04-25 00:07:37 +02:00
Author
Owner
Copy Link
Copy Source

@Tomos-Evans commented on GitHub (Jan 12, 2025):

well now I feel stupid! Works as expected. Sorry for wasting time.

I will follow the other issue you linked for the OIDC issue (after I check that i'm not being equally stupid with that issue too!)

Thanks

@Tomos-Evans commented on GitHub (Jan 12, 2025): well now I feel stupid! Works as expected. Sorry for wasting time. I will follow the other issue you linked for the OIDC issue (after I check that i'm not being equally stupid with that issue too!) Thanks
adam commented 2026-04-25 00:07:37 +02:00
Author
Owner
Copy Link
Copy Source

@mikiher commented on GitHub (Jan 12, 2025):

I am having a separate issue with OIDC on 2.17.7 that I am still trying to bottom out so am not able to get to the point of logging in on that version.

For awareness, on 2.17.7 the callback sent to the OIDC provider is /undefined/auth/openid/callback rather than the expected /auth/openid/callback so the auth provider rejects it as an invalid redirect URI.

@Tomos-Evans I'd like to understand this issue better. Can I ask you to please open a separate issue for this?
I also understand from this issue that you recently migrated your server from 2.13.4 to the latest version (2.17.7). In the new issue, can you also share the log file around where you upgraded the server version ? I'm particularly interested in the 2.17.4 migration.

@mikiher commented on GitHub (Jan 12, 2025): > I am having a separate issue with OIDC on 2.17.7 that I am still trying to bottom out so am not able to get to the point of logging in on that version. > > For awareness, on 2.17.7 the callback sent to the OIDC provider is `/undefined/auth/openid/callback` rather than the expected `/auth/openid/callback` so the auth provider rejects it as an invalid redirect URI. @Tomos-Evans I'd like to understand this issue better. Can I ask you to please open a separate issue for this? I also understand from this issue that you recently migrated your server from 2.13.4 to the latest version (2.17.7). In the new issue, can you also share the log file around where you upgraded the server version ? I'm particularly interested in the 2.17.4 migration.
adam commented 2026-04-25 00:07:37 +02:00
Author
Owner
Copy Link
Copy Source

@Tomos-Evans commented on GitHub (Jan 18, 2025):

Sorry the original logs have been blown away, but I just tried again from 2.13.4 to 2.17.7 and had the same /undefined/auth/openid/callback issue. Logs said that the use-subfolder-for-oidc-redirect-uris migration had been applied, but it didnt work.

Based on your mention of 2.17.4 I upgraded to 2.17.3 (worked perfectly)
I then stepped through each release until I was on 2.17.7 and all worked - so I am a little confused. Seems like it was an issue with the jump between 3.13.4 and latest, and stepping through sequentially.

Either way, upgrading more regularly seems like a good idea so I will try to keep up to date withthe releases

@Tomos-Evans commented on GitHub (Jan 18, 2025): Sorry the original logs have been blown away, but I just tried again from 2.13.4 to 2.17.7 and had the same /undefined/auth/openid/callback issue. Logs said that the `use-subfolder-for-oidc-redirect-uris` migration had been applied, but it didnt work. Based on your mention of 2.17.4 I upgraded to 2.17.3 (worked perfectly) I then stepped through each release until I was on 2.17.7 and all worked - so I am a little confused. Seems like it was an issue with the jump between 3.13.4 and latest, and stepping through sequentially. Either way, upgrading more regularly seems like a good idea so I will try to keep up to date withthe releases
adam commented 2026-04-25 00:07:37 +02:00
Author
Owner
Copy Link
Copy Source

@mikiher commented on GitHub (Jan 18, 2025):

Can you paste the exact log lines from the second attempt to migrate from 2.13.4 to 2.17.7, that pertain to the 2.17.4 migration? I'd like to see exactly what the log output was (I understand it succeeded, but I want to see which messages were printed).

Can you please also paste the similar log lines for your next update attempt from 2.17.3 to 2.17.4?

@mikiher commented on GitHub (Jan 18, 2025): Can you paste the exact log lines from the second attempt to migrate from 2.13.4 to 2.17.7, that pertain to the 2.17.4 migration? I'd like to see exactly what the log output was (I understand it succeeded, but I want to see which messages were printed). Can you please also paste the similar log lines for your next update attempt from 2.17.3 to 2.17.4?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#2481
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?