starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: OIDC avanced permissions claim is ignored for admin accounts #3248

New Issue
Open
opened 2026-04-25 00:14:30 +02:00 by adam · 3 comments
adam commented 2026-04-25 00:14:30 +02:00
Owner
Copy Link
Copy Source

Originally created by @swarthy-roll on GitHub (Feb 28, 2026).

What happened?

When using advanced permissions claims to set account permissions, admin accounts are left with the default permissions instead of the custom permissions from the OIDC claim. This only impacts admin accounts; normal user account permissions are set correctly from the claim.

What did you expect to happen?

Permission values from the advanced permission claim should apply to admin accounts when applicable.

Steps to reproduce the issue

  1. login to ABS with OIDC using an admin account with a custom advanced permission claim from the IdP. The claim permissions should be elevated from the defaults.

The claim:

{
    "sub": "test@gmail.com", 
    "groups": [ "admin", "user", "media", "media-admin" ], 
    "abspermissions": { 
                         "canDownload": true, 
                         "canUpload": true, 
                         "canDelete": true, 
                         "canUpdate": true, 
                         "canAccessExplicitContent": true, 
                         "canAccessAllLibraries": true, 
                         "canAccessAllTags": true, 
                         "canCreateEReader": true, 
                         "tagsAreDenylist": false, 
                         "allowedLibraries": [], 
                         "allowedTags": [] 
                      }, 
    "email": "test@gmail.com", 
    "email_verified": true, 
    "name": "demo-name", 
    "given_name": "demo-name", 
    "preferred_username": "demo", 
    "nickname": "demo"
}

Audiobookshelf version

v2.32.1

How are you running audiobookshelf?

Docker

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

Firefox

Logs

2026-02-28 15:56:16.857 DEBUG [Auth] paramsToCookies: setting auth_method cookie to openid
2026-02-28 15:56:25.473 DEBUG [OidcAuth] openid callback userinfo= { "sub": "test@gmail.com", "groups": [ "admin", "user", "media", "media-admin" ], "abspermissions": { "canDownload": true, "canUpload": true, "canDelete": true, "canUpdate": true, "canAccessExplicitContent": true, "canAccessAllLibraries": true, "canAccessAllTags": true, "canCreateEReader": true, "tagsAreDenylist": false, "allowedLibraries": [], "allowedTags": [] }, "email": "test@gmail.com", "email_verified": true, "name": "demo-name", "given_name": "demo-name", "preferred_username": "demo", "nickname": "demo" }
2026-02-28 15:56:25.478 DEBUG [User] openid: User found by sub "test@gmail.com"
2026-02-28 15:56:25.478 INFO [OidcAuth] openid callback: Updating user "demo" type to "admin" from "user"
2026-02-28 15:56:25.483 DEBUG [Auth] handleLoginSuccessBasedOnCookie: isApiBased: false, auth_method: openid

Additional Notes

No response

Originally created by @swarthy-roll on GitHub (Feb 28, 2026). ### What happened? When using advanced permissions claims to set account permissions, admin accounts are left with the default permissions instead of the custom permissions from the OIDC claim. This only impacts admin accounts; normal user account permissions are set correctly from the claim. ### What did you expect to happen? Permission values from the advanced permission claim should apply to admin accounts when applicable. ### Steps to reproduce the issue 1. login to ABS with OIDC using an admin account with a custom advanced permission claim from the IdP. The claim permissions should be elevated from the defaults. The claim: ``` { "sub": "test@gmail.com", "groups": [ "admin", "user", "media", "media-admin" ], "abspermissions": { "canDownload": true, "canUpload": true, "canDelete": true, "canUpdate": true, "canAccessExplicitContent": true, "canAccessAllLibraries": true, "canAccessAllTags": true, "canCreateEReader": true, "tagsAreDenylist": false, "allowedLibraries": [], "allowedTags": [] }, "email": "test@gmail.com", "email_verified": true, "name": "demo-name", "given_name": "demo-name", "preferred_username": "demo", "nickname": "demo" } ``` ### Audiobookshelf version v2.32.1 ### How are you running audiobookshelf? Docker ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? Firefox ### Logs ```shell 2026-02-28 15:56:16.857 DEBUG [Auth] paramsToCookies: setting auth_method cookie to openid 2026-02-28 15:56:25.473 DEBUG [OidcAuth] openid callback userinfo= { "sub": "test@gmail.com", "groups": [ "admin", "user", "media", "media-admin" ], "abspermissions": { "canDownload": true, "canUpload": true, "canDelete": true, "canUpdate": true, "canAccessExplicitContent": true, "canAccessAllLibraries": true, "canAccessAllTags": true, "canCreateEReader": true, "tagsAreDenylist": false, "allowedLibraries": [], "allowedTags": [] }, "email": "test@gmail.com", "email_verified": true, "name": "demo-name", "given_name": "demo-name", "preferred_username": "demo", "nickname": "demo" } 2026-02-28 15:56:25.478 DEBUG [User] openid: User found by sub "test@gmail.com" 2026-02-28 15:56:25.478 INFO [OidcAuth] openid callback: Updating user "demo" type to "admin" from "user" 2026-02-28 15:56:25.483 DEBUG [Auth] handleLoginSuccessBasedOnCookie: isApiBased: false, auth_method: openid ``` ### Additional Notes _No response_
adam added the bug label 2026-04-25 00:14:30 +02:00
adam commented 2026-04-25 00:14:31 +02:00
Author
Owner
Copy Link
Copy Source

@nichwall commented on GitHub (Feb 28, 2026):

There are a few OIDC claims related issues opened, is this related to any of them? https://github.com/advplyr/audiobookshelf/issues?q=is%3Aissue%20state%3Aopen%20claims

There is also a PR for a lot of OIDC updates here https://github.com/advplyr/audiobookshelf/pull/5031

@nichwall commented on GitHub (Feb 28, 2026): There are a few OIDC claims related issues opened, is this related to any of them? https://github.com/advplyr/audiobookshelf/issues?q=is%3Aissue%20state%3Aopen%20claims There is also a PR for a lot of OIDC updates here https://github.com/advplyr/audiobookshelf/pull/5031
adam commented 2026-04-25 00:14:31 +02:00
Author
Owner
Copy Link
Copy Source

@swarthy-roll commented on GitHub (Feb 28, 2026):

I searched through all the OIDC issues before I created this issue and from what I can tell, this is not related to any of the existing issues. I haven't seen that PR yet, so I'll take a look. If it addresses this issue that'd be amazing!

@swarthy-roll commented on GitHub (Feb 28, 2026): I searched through all the OIDC issues before I created this issue and from what I can tell, this is not related to any of the existing issues. I haven't seen that PR yet, so I'll take a look. If it addresses this issue that'd be amazing!
adam commented 2026-04-25 00:14:31 +02:00
Author
Owner
Copy Link
Copy Source

@Sapd commented on GitHub (Apr 18, 2026):

This was not really considered during development of OIDC.

Could you describe your exact use cases?
But in the end also it a bit depends on what the architecture is, if admin accounts should be retractable in that way @advplyr

@Sapd commented on GitHub (Apr 18, 2026): This was not really considered during development of OIDC. Could you describe your exact use cases? But in the end also it a bit depends on what the architecture is, if admin accounts should be retractable in that way @advplyr
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3248
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?