With GOTIFY_OIDC_LINK_BY_USERNAME=true, the first OIDC login whose username claim matches an existing local user binds that OIDC identity to the user.
The account owner is never asked to confirm the linking. This is okay when the admin controls both the identity provider and gotify (the use case the setting is meant for), but a misconfiguration or an untrusted username mapping in the IdP allows taking over a local account without the owner's involvement.
Possible solutions:
- Allow linking the OIDC identity only when an existing session of the local user exists. Maybe a button in a settings page (link with OIDC).
- Prompt for password of the user account before linking the OIDC identity to the local user.
Originally privately reported by @lenny-ts
With GOTIFY_OIDC_LINK_BY_USERNAME=true, the first OIDC login whose username claim matches an existing local user binds that OIDC identity to the user.
The account owner is never asked to confirm the linking. This is okay when the admin controls both the identity provider and gotify (the use case the setting is meant for), but a misconfiguration or an untrusted username mapping in the IdP allows taking over a local account without the owner's involvement.
Possible solutions:
Originally privately reported by @lenny-ts