Mirrors/photoprism
1
0
Fork 0
mirror of https://github.com/photoprism/photoprism.git synced 2026-07-17 16:49:04 +00:00
Code Issues Projects Releases Wiki Activity

OIDC: Drop residual cluster-OIDC gate on provisioned account email

Browse source
This commit is contained in:
Michael Mayer 2026-06-10 02:13:27 +00:00
parent a8849d111d
commit 14edf40abd
1 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
internal/api/oidc_redirect.go
View file

@ -386,10 +386,11 @@ func OIDCRedirect(router *gin.RouterGroup) {
user.Details().BirthYear = birthDate.Year()
}
// Set email when verified, not from cluster OIDC, and not held by a
// different account. The email is informational (not an auth identifier),
// so cluster OIDC omits it and a clash never blocks provisioning.
if bool(userInfo.EmailVerified) && !conf.ClusterOIDC() && entity.UserEmailAvailable(userInfo.Email, user.UserUID) {
// Set email only when the IdP marks it verified and no other account
// holds it. The email is informational (not an auth identifier), so a
// clash never blocks provisioning; the Portal OP forwards real
// verification state, so unverified cluster emails are simply not stored.
if bool(userInfo.EmailVerified) && entity.UserEmailAvailable(userInfo.Email, user.UserUID) {
user.UserEmail = clean.Email(userInfo.Email)
user.VerifiedAt = entity.TimeStamp()
}