Method createOidcUser

server-source-code/internal/handler/oidc.go:836–888

(ctx context.Context, info *oidc.UserInfo)

var usernameSanitize = regexp.MustCompile(`[^a-zA-Z0-9._-]`)

func (h *OidcHandler) createOidcUser(ctx context.Context, info *oidc.UserInfo) *models.User {
	baseUsername := usernameSanitize.ReplaceAllString(strings.Split(info.Email, "@")[0], "")
	if len(baseUsername) > 32 {
		baseUsername = baseUsername[:32]
	}
	username := baseUsername
	counter := 1
	for {
		_, err := h.users.GetByUsername(ctx, username)
		if err != nil && errors.Is(err, pgx.ErrNoRows) {
			break
		}
		username = baseUsername + fmt.Sprintf("%d", counter)
		counter++
		if counter > 1000 {
			username = baseUsername + uuid.New().String()[:8]
			break
		}
	}
	role := h.mapGroupsToRole(info.Groups)
	if h.log != nil && len(info.Groups) == 0 && h.oidcSyncRoles() {
		h.log.Warn("oidc no groups in token for new user", "email", info.Email, "hint", "Create a Scope Mapping in Authentik to add 'groups' claim")
	}
	// If no admin/superadmin exists yet, promote the first auto-created user to superadmin.
	adminCount, _ := h.users.CountAdmins(ctx)
	if adminCount == 0 {
		role = "superadmin"
		if h.log != nil {
			h.log.Info("oidc first user promoted to superadmin", "email", info.Email)
		}
	}
	issuerHost := extractHost(h.oidcIssuerURL())
	u := &models.User{
		ID:           uuid.New().String(),
		Username:     username,
		Email:        strings.ToLower(info.Email),
		Role:         role,
		IsActive:     true,
		FirstName:    strPtr(info.GivenName),
		LastName:     strPtr(info.FamilyName),
		OidcSub:      &info.Sub,
		OidcProvider: &issuerHost,
		AvatarURL:    strPtr(info.Picture),
	}
	if err := h.users.CreateOidcUser(ctx, u, info.Sub, issuerHost, strPtr(info.Picture)); err != nil {
		if h.log != nil {
			h.log.Error("oidc create user failed", "error", err, "email", info.Email)
		}
		return nil
	}
	AutoSubscribeIfHosted(h.cfg != nil && h.cfg.AdminMode, h.users, h.log, u)
	return u
}