Drop-OSS/drop
1
0
Fork 0
mirror of https://github.com/Drop-OSS/drop.git synced 2026-07-25 04:15:36 -04:00
Code Issues 77 Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #223] Failed to sign in: "Invalid username claim in OIDC response: preferred_username". #114

New Issue
Closed
opened 2026-02-17 17:06:11 -05:00 by yindo · 9 comments
yindo commented 2026-02-17 17:06:11 -05:00
Owner
Copy Link
Copy Source

Originally created by @mattiaginoble on GitHub (Aug 30, 2025).
Original GitHub issue: https://github.com/Drop-OSS/drop/issues/223

I just added OIDC login via Cloudflare and my Google account (same email as the account I already created during the initial setup), but I'm getting this error. Did I enter the environment variables incorrectly? Thanks

I have included everything that was in the documentation at Doc

I have not included:
OIDC_ADMIN_GROUP
OIDC_WELLKNOWN

Originally created by @mattiaginoble on GitHub (Aug 30, 2025). Original GitHub issue: https://github.com/Drop-OSS/drop/issues/223 I just added OIDC login via Cloudflare and my Google account (same email as the account I already created during the initial setup), but I'm getting this error. Did I enter the environment variables incorrectly? Thanks I have included everything that was in the documentation at [Doc](https://docs.droposs.org/docs/authentication/oidc) I have not included: OIDC_ADMIN_GROUP OIDC_WELLKNOWN
yindo added the support label 2026-02-17 17:06:11 -05:00
yindo closed this issue 2026-02-17 17:06:11 -05:00
yindo commented 2026-02-17 17:06:11 -05:00
Author
Owner
Copy Link
Copy Source

@DecDuck commented on GitHub (Aug 30, 2025):

The default OIDC_USERNAME_CLAIM is designed for Authentik, if you're not using that, you'll have to set it.

@DecDuck commented on GitHub (Aug 30, 2025): The default OIDC_USERNAME_CLAIM is designed for Authentik, if you're not using that, you'll have to set it.
yindo commented 2026-02-17 17:06:11 -05:00
Author
Owner
Copy Link
Copy Source

@mattiaginoble commented on GitHub (Aug 31, 2025):

Thanks for your reply. I'm not using Authentik, but I am using Cloudflare Zero Trust for all my containers. Will support for this be added?

@mattiaginoble commented on GitHub (Aug 31, 2025): Thanks for your reply. I'm not using Authentik, but I am using Cloudflare Zero Trust for all my containers. Will support for this be added?
yindo commented 2026-02-17 17:06:11 -05:00
Author
Owner
Copy Link
Copy Source

@DecDuck commented on GitHub (Aug 31, 2025):

Can you try using OIDC_USERNAME_CLAIM=oidc_fields.preferred_username?

@DecDuck commented on GitHub (Aug 31, 2025): Can you try using `OIDC_USERNAME_CLAIM=oidc_fields.preferred_username`?
yindo commented 2026-02-17 17:06:11 -05:00
Author
Owner
Copy Link
Copy Source

@mattiaginoble commented on GitHub (Sep 1, 2025):

Added OIDC_USERNAME_CLAIM=oidc_fields.preferred_username to the environment variables, but I always get the same error.

I tried to add OIDC_USERNAME_CLAIM=email, it works now.
It created a new account for me with my Google email address (the same email address I used previously).

@mattiaginoble commented on GitHub (Sep 1, 2025): Added `OIDC_USERNAME_CLAIM=oidc_fields.preferred_username` to the environment variables, but I always get the same error. I tried to add `OIDC_USERNAME_CLAIM=email`, it works now. It created a new account for me with my Google email address (the same email address I used previously).
yindo commented 2026-02-17 17:06:11 -05:00
Author
Owner
Copy Link
Copy Source

@DecDuck commented on GitHub (Sep 2, 2025):

Alright, glad you got it working. I'll have to look more into how to actually get the username field from Cloudflare though.

@DecDuck commented on GitHub (Sep 2, 2025): Alright, glad you got it working. I'll have to look more into how to actually get the username field from Cloudflare though.
yindo commented 2026-02-17 17:06:11 -05:00
Author
Owner
Copy Link
Copy Source

@mattiaginoble commented on GitHub (Sep 2, 2025):

Thanks to you, it's a great project anyway, you've made a lot of progress.

@mattiaginoble commented on GitHub (Sep 2, 2025): Thanks to you, it's a great project anyway, you've made a lot of progress.
yindo commented 2026-02-17 17:06:11 -05:00
Author
Owner
Copy Link
Copy Source

@InsertDisc commented on GitHub (Oct 23, 2025):

If OIDC_USERNME_CLAIM=email worked then what are the chances OIDC_USERNME_CLAIM=preferred_username would work since those two are at the same level in the token?

@InsertDisc commented on GitHub (Oct 23, 2025): If OIDC_USERNME_CLAIM=email worked then what are the chances OIDC_USERNME_CLAIM=preferred_username would work since those two are at the same level in the token?
yindo commented 2026-02-17 17:06:11 -05:00
Author
Owner
Copy Link
Copy Source

@DecDuck commented on GitHub (Oct 23, 2025):

I mean, try it and see. I believe that's the default but it's been a while since I wrote the OIDC code.

@DecDuck commented on GitHub (Oct 23, 2025): I mean, try it and see. I believe that's the default but it's been a while since I wrote the OIDC code.
yindo changed title from Failed to sign in: "Invalid username claim in OIDC response: preferred_username". to [GH-ISSUE #223] Failed to sign in: "Invalid username claim in OIDC response: preferred_username". 2026-06-05 14:21:30 -04:00
yindo commented 2026-06-07 16:00:09 -04:00
Author
Owner
Copy Link
Copy Source

@TigerC10 commented on GitHub (Jun 7, 2026):

I mean, try it and see. I believe that's the default but it's been a while since I wrote the OIDC code.

The Google oauth IdP doesn't return a preferred_username claim, so Cloudflare OIDC can't include it.

<!-- gh-comment-id:4643789415 --> @TigerC10 commented on GitHub (Jun 7, 2026): > I mean, try it and see. I believe that's the default but it's been a while since I wrote the OIDC code. The Google oauth IdP doesn't return a preferred_username claim, so Cloudflare OIDC can't include it.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
duplicate
feature
feature
good first issue
needs-triage
pull-request
Mirrored from GitHub Pull Request
 qol
support
No Label support
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Drop-OSS/drop#114
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?