Hello. I have a situation were I need to manually remove a specific OIDC credential/provider from an identity through the API. I have tried both the

updateIdentity

and

patchIdentity

operations, but it seems they only allow me to add providers, not remove them. Is this simply missing from the API? Thanks in advance.

It should work with updateIdentity as that gives the option to modify the credentials. Can you share your request/payload/identity example here in this thread maybe?

The identity I'm testing with currently has a google oidc identifier on it. If I use the following payload, the credential will still persist:

{
  "credentials": {
    "oidc": {
      "config": {
        "providers": []
      }
    }
  },
  "schema_id": "user",
  "state": "active",
  "traits": {
    "name": {
      "last": "bar",
      "first": "foo"
    },
    "email": "<mailto:foo@bar.com|foo@bar.com>"
  }
}

Result:

{
	"id": "0bbc6e4b-fc87-45e8-960c-922e9d518bcd",
	"credentials": {
		"oidc": {
			"type": "oidc",
			"identifiers": [
				"google:123123123123"
			],
			"version": 0,
...

Hey Martin, could it be that you want to remove the only credential on the identity? An identity needs to have at least one credential

Hey. The identity I am testing with also has a password credential, so that should not be the case

I see. So if I create an identity with password/email and e.g. Github OIDC credentials and then try to remove the github oidc, I should be able to reproduce this?

Yes, correct.

Ok! To manage expectations: I probably wont get around to reproducing this until after the Ory Summit tomorrow

No worries. Thanks for looking into it 👍

Hi @magnificent-energy-493! I'm Martins colleague, I was just wondering if you got to test/verify this topic?

I have the same issue. Only solution I have found is to delete and recreate the identity without the oidc credential

@broad-rainbow-22760 Hello Per, sorry for the late reply - have been bogged down with other priorities until now. I did not get around to test it but AFAICT deleting and recreating the identity is the only way to do this as an admin. Feel free to create an issue on GitHub to track this for our maintainers though - and please include as much information on the use case as possible.

Our case is: User had only one credential which was oidc from a third party provider. The user lost access to the third party provider and now cannot log in any more.