Document binding existing accounts when setting up SSO after creating local accounts #18

New Issue

2025-07-31T20:33:32Z

decentral1se commented

2025-07-31 20:33:32 +00:00

Magic hack: https://community.hedgedoc.org/t/how-to-bind-an-oauth2-user-to-an-ldap-user/1128/2

decentral1se commented

2025-07-31 20:46:02 +00:00

Actually it does already work but users lose all their history! Here's how to avoid that....

You might need to create a dummy test user first using your SSO login.

DONT use an email which clashes with an existing user. It will bind and delete all their history.

Then you'll be able to select that user in the db and see the profile / profileid entry.

abra app run <app> db bash
psql -U codimd
> select * from "Users";

For me (using rauthy), it was (with dummy values):

profileid    | bazbaz
profile      | {"id":"bazbaz","username":"decentral1se","displayName":"decentral1se","emails":["foo@bar.com"],"provider":"oauth2"}

This bazbaz is the ID value that is sent from my SSO provider. Check your SSO admin user management view.

Then, you update the user you want to bind and not lose history with those two fields.

UPDATE "Users" SET profile = '{"id":"bazbaz","username":"decentral1se","displayName":"decentral1se","emails":["foo@bar.com"],"provider":"oauth2"}' WHERE id = '...';
UPDATE "Users" SET profileid = 'bazbaz' WHERE id = '...';

Then log in with your SSO and you should still have your history + it binds.

Actually it does already work but users lose all their history! Here's how to avoid that.... You might need to create a dummy test user first using your SSO login. **DONT** use an email which clashes with an existing user. It will bind and delete all their history. Then you'll be able to select that user in the db and see the `profile` / `profileid` entry. ``` abra app run <app> db bash psql -U codimd > select * from "Users"; ``` For me (using `rauthy`), it was (with dummy values): ``` profileid | bazbaz profile | {"id":"bazbaz","username":"decentral1se","displayName":"decentral1se","emails":["foo@bar.com"],"provider":"oauth2"} ``` This `bazbaz` is the ID value that is sent from my SSO provider. Check your SSO admin user management view. Then, you update the user you want to bind and not lose history with those two fields. ``` UPDATE "Users" SET profile = '{"id":"bazbaz","username":"decentral1se","displayName":"decentral1se","emails":["foo@bar.com"],"provider":"oauth2"}' WHERE id = '...'; UPDATE "Users" SET profileid = 'bazbaz' WHERE id = '...'; ``` Then log in with your SSO and you should still have your history + it binds.

decentral1se referenced this issue from a commit

2025-07-31 20:50:44 +00:00

feat: support CMD_OAUTH2_USER_PROFILE_ID_ATTR

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coop-cloud/hedgedoc#18