mirror of
https://github.com/advplyr/audiobookshelf.git
synced 2026-05-30 23:40:40 +02:00
[Bug]: OIDC Group Claim validation prevents using standard ZITADEL role claim #3035
Assignees
adam (Adam Melkus)
Clear assignees
adam (Adam Melkus)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/audiobookshelf#3035
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @bannert1337 on GitHub (Oct 12, 2025).
What happened?
When configuring OpenID Connect (OIDC) with ZITADEL as the identity provider, I am unable to use the standard claim for user roles. ZITADEL provides user roles within a claim named
urn:zitadel:iam:org:project:roles.When I enter this claim name into the "Group Claim" field in the Audiobookshelf OIDC settings, the UI immediately flags it as an error with the message:
Group Claim: Invalid claim name.This prevents me from mapping ZITADEL roles to Audiobookshelf user groups, which is a critical part of the OIDC integration. The validation appears to be too strict, likely disallowing colons (
:) in the claim name.What did you expect to happen?
I expected the "Group Claim" field to accept
urn:zitadel:iam:org:project:rolesas a valid OIDC claim name. Namespaced claims using URNs (which include colons) are a standard practice in OIDC and should be supported.The setting should be saved without a validation error, allowing Audiobookshelf to correctly parse the roles from the ID token during the login flow.
Steps to reproduce the issue
urn:zitadel:iam:org:project:roles).Settings>Users>Authentication.OpenID Connectas the authentication provider and fill in the required details (Issuer URL, Client ID, Client Secret).urn:zitadel:iam:org:project:rolesinto the input field.Group Claim: Invalid claim nameappear immediately.Audiobookshelf version
v2.30.0
How are you running audiobookshelf?
Docker
What OS is your Audiobookshelf server hosted from?
Linux
If the issue is being seen in the UI, what browsers are you seeing the problem on?
None
Logs
Additional Notes
This issue effectively blocks integration with OIDC providers that use standard namespaced claims. A temporary workaround is to use ZITADEL's "Actions" feature to create a custom, non-namespaced claim (e.g.,
groups) and map the roles to it, but this adds unnecessary complexity. The ideal solution would be for Audiobookshelf to relax the validation on this field to support the full character set allowed in OIDC claim names.Additionally, it is worth noting that the value of the
urn:zitadel:iam:org:project:rolesclaim is a JSON object, not a flat array of strings. It would be helpful if the documentation could clarify how Audiobookshelf expects to parse group/role claims (e.g., as a flat array of strings, or if it can handle nested objects).@Sapd commented on GitHub (Oct 17, 2025):
The regex here https://github.com/advplyr/audiobookshelf/blob/a87ea327151fcb7ec67ce981bb6a44878a9ab343/client/pages/config/authentication.vue#L308-L313
must be made less strict and include : then
@Vito0912 commented on GitHub (Oct 17, 2025):
If it's just the frontend, you could create your own request until this maybe get's fixed
@Maxklos commented on GitHub (Feb 12, 2026):
I have the same problem. Can you please provide the workaround Zitadel Action to remap the claims from urn:zitadel:iam:org:project:roles (JSON) to groups (list)? The PR works great but still struggles with the JSON translation
@Sapd commented on GitHub (Feb 12, 2026):
@Maxklos can you please give me a full example of the response (also additional docs link are also helpful)
Edit: did you test my PR already? Please comment under it for further support with that PR
@Maxklos commented on GitHub (Feb 12, 2026):
I commented on the PR with the log output: https://github.com/advplyr/audiobookshelf/pull/5031#issuecomment-3889777188 . @bannert1337 mentioned
A temporary workaround is to use ZITADEL's "Actions" feature to create a custom, non-namespaced claim (e.g., groups) and map the roles to it, but this adds unnecessary complexity.I wanted to test the JS code for the action to further test Zitadel in combination with ABS. I intended to split the conversation into the topic of the JSON bug (comment below your PR) and the Zitadel Action (comment here).@tfmm commented on GitHub (Feb 19, 2026):
Sorry for the mild hijack, feel free to delete if this is not ok.
@Maxklos I'm trying to setup ABS in Zitadel, and was wondering if you could share your Zitadel-side config. The settings I've tried don't appreciate mixing http(s) and audiobookshelf protocols. Thanks!
@Maxklos commented on GitHub (Feb 21, 2026):
With this PR it's simple. On Zitadel Side: Application Type: Web & Response Types: Code. Set Everything up in the ABS SSO Settings and you are basically good to go. If you want different users to have different ABS roles, you have to set "Roles" in the Project settings and give every user the "Authorizations" Level you want. Zitadel & Audiobookshelf ONLY work together if you use the PR Linked. But with the fantastic work of Sapd it's a breath. Oh and I serve ABS via Pangolin/Newt, with that as a reverse Proxy HTTPS is not an issue. Where exactly do you have troubles? You are welcome to e-mail me if you still struggle.