starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: Unauthorized user is still created when logging in using OIDC #2933

New Issue
Closed
opened 2026-04-25 00:11:56 +02:00 by adam · 1 comment
adam commented 2026-04-25 00:11:56 +02:00
Owner
Copy Link
Copy Source

Originally created by @zodac-personal on GitHub (Aug 7, 2025).

What happened?

I'm setting up ABS with Authelia, and I'm testing the flow when a user with no valid admin or user group claim tries to log in. I get the 'Unauthorized' return screen as expected, but when I check the users on ABS itself, that unauthorized user still had an account created (and with the 'user' role, not even 'guest').

What did you expect to happen?

I expected no user to have been created, or at least created as a guest and then cleaned up.

Steps to reproduce the issue

  1. Set up OIDC authentication on ABS
  2. Set up a user on your IDP which is not a member of the admin or user groups
  3. Attempt to log in to ABS using OIDC
  4. Confirm user was unauthorized and unable to access ABS
  5. Using a valid ABS admin, check the listed Users, and confirm the unauthorized user was added

Audiobookshelf version

v2.27.0

How are you running audiobookshelf?

Docker

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

None

Logs

[2025-08-08 00:22:01.500] INFO: [User] openid: User not found, checking existing with userinfo.preferred_username "test"
[2025-08-08 00:22:01.501] INFO: [User] openid: Auto-registering user with sub "cca03bf3-6541-46ca-b0c7-b0ec5fc876aa" {
  email: 'test@email.com',
  email_verified: true,
  groups: [ 'standard_users' ],
  name: 'Test',
  preferred_username: 'test',
  rat: 1754569308,
  sub: 'cca03bf3-6541-46ca-b0c7-b0ec5fc876aa',
  updated_at: 1754569321
}
[2025-08-08 00:22:01.531] ERROR: [OidcAuth] openid callback error: No valid group found in userinfo: [
  "standard_users"
]
Error: No valid group found in userinfo: [
  "standard_users"
]
    at OidcAuthStrategy.setUserGroup (/app/server/auth/OidcAuthStrategy.js:195:13)
    at OidcAuthStrategy.verifyCallback (/app/server/auth/OidcAuthStrategy.js:130:18)
[2025-08-08 00:22:01.531] ERROR: "[Auth] No data in openid callback - Unauthorized"

Additional Notes

No response

Originally created by @zodac-personal on GitHub (Aug 7, 2025). ### What happened? I'm setting up ABS with Authelia, and I'm testing the flow when a user with no valid `admin` or `user` group claim tries to log in. I get the 'Unauthorized' return screen as expected, but when I check the users on ABS itself, that unauthorized user still had an account created (and with the 'user' role, not even 'guest'). ### What did you expect to happen? I expected no user to have been created, or at least created as a guest and then cleaned up. ### Steps to reproduce the issue 1. Set up OIDC authentication on ABS 2. Set up a user on your IDP which is **not** a member of the `admin` or `user` groups 3. Attempt to log in to ABS using OIDC 4. Confirm user was unauthorized and unable to access ABS 5. Using a valid ABS admin, check the listed Users, and confirm the unauthorized user was added ### Audiobookshelf version v2.27.0 ### How are you running audiobookshelf? Docker ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? None ### Logs ```shell [2025-08-08 00:22:01.500] INFO: [User] openid: User not found, checking existing with userinfo.preferred_username "test" [2025-08-08 00:22:01.501] INFO: [User] openid: Auto-registering user with sub "cca03bf3-6541-46ca-b0c7-b0ec5fc876aa" { email: 'test@email.com', email_verified: true, groups: [ 'standard_users' ], name: 'Test', preferred_username: 'test', rat: 1754569308, sub: 'cca03bf3-6541-46ca-b0c7-b0ec5fc876aa', updated_at: 1754569321 } [2025-08-08 00:22:01.531] ERROR: [OidcAuth] openid callback error: No valid group found in userinfo: [ "standard_users" ] Error: No valid group found in userinfo: [ "standard_users" ] at OidcAuthStrategy.setUserGroup (/app/server/auth/OidcAuthStrategy.js:195:13) at OidcAuthStrategy.verifyCallback (/app/server/auth/OidcAuthStrategy.js:130:18) [2025-08-08 00:22:01.531] ERROR: "[Auth] No data in openid callback - Unauthorized" ``` ### Additional Notes _No response_
adam added the bug label 2026-04-25 00:11:56 +02:00
adam closed this issue 2026-04-25 00:11:56 +02:00
adam commented 2026-04-25 00:11:57 +02:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Aug 11, 2025):

Fixed in v2.28.0.

@github-actions[bot] commented on GitHub (Aug 11, 2025): Fixed in [v2.28.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.28.0).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#2933
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?