Combining an OIDC and Local account?

[HeyItsJono]

In other self-hosted services you can tie an OIDC login to a local account. Currently, if I log in via OIDC in Shelfmark it automatically provisions a new account, there doesn't seem to be a way to link my local admin account with my Authentik OIDC login. It would be nice to have both linked, because that way if my OIDC provider goes down I can still log into Shelfmark via the local account.

[jmadden91]

I haven't tested this, but doesn't it already do this?

https://github.com/calibrain/shelfmark/blob/main/docs/oidc.md#account-linking

[HeyItsJono]

If it intends to, then in practice it doesn't actually seem to; I currently have to have 2 accounts (OIDC and Local).

[calibrain]

Hey, this should work, but there is a catch. its gated against an assert of email_verified: true, if that claim is missing or false in the idp, Shelfmark will silently skips email matching and provisions a new account instead (docs).

While I dont personally use OIDC so its hard to verify, you can try this :

0. Set DEBUG=true before, there's a log line that fires when linking is skipped for an unverified address.
1. In Authentik, confirm the user's email is marked verified and that email is in the requested scopes.
2. Delete the duplicate OIDC-provisioned account in Shelfmark.
3. Make sure your local admin account's email exactly matches the one Authentik asserts.
4. Log in via OIDC again it should now link to the local admin instead of creating a new user.