I confirm that
Feature Description
When using OIDC with AMP, I would like to be able to authenticate an existing AMP user by matching the OIDC email claim against the email address already assigned to that AMP account.
At the moment, setting:
OIDC Username Claim = email
does not work because AMP tries to use the full email address as the username and rejects it with:
Usernames may not contain the @ character.
Example:
Existing AMP user:
- Username:
maciej
- Email:
maciej@example.com
OIDC provider returns:
email = maciej@example.com
Expected behaviour:
AMP should find the existing user by the matching email address and authenticate that account, while keeping the existing AMP username, roles, permissions and instance access unchanged.
In other words:
OIDC email claim -> match existing AMP user by Email field -> login to that existing account
It would be useful to have a separate option such as:
OIDC Account Matching Claim = email
independent from OIDC Username Claim.
For security, this could require an exact and unique email match and preferably a verified email claim.
My OIDC provider is Cloudflare Access, but this would also be useful with other OIDC providers where email is the primary user identity.
I confirm that
Feature Description
When using OIDC with AMP, I would like to be able to authenticate an existing AMP user by matching the OIDC
emailclaim against the email address already assigned to that AMP account.At the moment, setting:
OIDC Username Claim = emaildoes not work because AMP tries to use the full email address as the username and rejects it with:
Usernames may not contain the @ character.Example:
Existing AMP user:
maciejmaciej@example.comOIDC provider returns:
email = maciej@example.comExpected behaviour:
AMP should find the existing user by the matching email address and authenticate that account, while keeping the existing AMP username, roles, permissions and instance access unchanged.
In other words:
OIDC email claim -> match existing AMP user by Email field -> login to that existing accountIt would be useful to have a separate option such as:
OIDC Account Matching Claim = emailindependent from
OIDC Username Claim.For security, this could require an exact and unique email match and preferably a verified email claim.
My OIDC provider is Cloudflare Access, but this would also be useful with other OIDC providers where email is the primary user identity.