feat(w3ds-oidc-connector): carry the eName and the eVault profile's email through any IdP

[coodos]

What

Testing Nextcloud → Rauthy → W3DS OIDC connector left Nextcloud with a 64-character hex user ID and no link to the eName. The cause isn't Rauthy-specific: every IdP between the connector and an app issues its own sub, so the eName stops at the IdP. Nextcloud's user_oidc then hashes that IdP sub into the user ID.

This makes the connector IdP-agnostic by relying only on standard OIDC claims:

• eName: still sub, and also preferred_username (the eName without @; lossless because eNames are UUIDs). IdPs pass preferred_username on to their own apps, so it is the documented carrier of the eName behind any IdP.
• Real email and name: read from the user's own eVault profile (User, falling back to ProfessionalProfile) and sent as email, name, given_name and family_name.
  • The read runs alongside signature verification, with the upstream timeout. Any failure yields no profile and never blocks the login.
  • The profile is attached only when the verified eName matches.
• email_verified is always false: the profile is self-asserted. The docs warn against linking accounts by email. For example, Rauthy's Auto-Link ignores email_verified, so turning it on would allow account takeover.
• Email follows the email scope. The portal's "requires an email" setting is kept as a compat override: it always sends an email, falling back to the @w3ds.invalid placeholder.
• Docs: a new "Using the eName behind your IdP" section, with the Nextcloud user_oidc settings (--unique-uid=0 --mapping-uid=preferred_username). Provider guides and the portal page are updated.

The Nextcloud side (a one-scan wallet confirmation for OIDC users) ships in ensombl/nextcloud-w3ds-login.

Testing

• w3ds-oidc-connector: 196/196 pass. tsc --noEmit is clean. New coverage:
  • profile reader: primary envelope, email fallback, placeholder names, token refresh on 401, failures and deadline all yield {}
  • scope-gated claims
  • end-to-end ID token and /userinfo carrying the profile claims

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 3e4bbbf9-18c2-4237-a03e-3c4929508209

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}