Hello all, I am using Kratos and GitLab oidc is the only way to login signup/signup method enabled. When I use it with GitLab.com: everyhting work as expected with the following configuration:

oidc:
  enabled: true
  config:
    providers:
      - id: gitlab
        provider: gitlab
        client_id: REDACTED
        client_secret: REDACTED
        mapper_url: file:///etc/config/kratos/oidc.gitlab.jsonnet
        scope:
          - openid
          - email

Output in logs (it works!):

mapper_jsonnet_output={
  "identity": {
    "traits": {
      "email": "REDACTED",
      "full_name": "REDACTED",
      "picture": "REDACTED",
      "username": "REDACTED",
      "website": "REDACTED"
    }
  }
}

But, when I try to use a GitLab self-hosted, same version than Gitlab.com, it doesn't have the same behavior. This is my configuration:

oidc:
  enabled: true
  config:
    providers:
      - id: gitlab_REDACTED
        provider: generic
        issuer_url: <https://gitlab.REDACTED>
        client_id: REDACTED
        client_secret: REDACTED
        mapper_url: file:///etc/config/kratos/oidc.REDACTED.jsonnet
        scope:
          - openid
          - email

In this case, it doesn't work. Even with a user with several data in the self hosted version (nickname, website, picture, ...). Only email seems to be found in claim. Here is the output in logs:

mapper_jsonnet_output={   
"identity": {                       
      "traits": {                      
         "email": "REDACTED"
      }                                
   }                                   
}

In both case, my mapper jsonnet configuration is the same:

local claims = {
  email_verified: false,
} + std.extVar('claims');

{
  identity: {
    traits: {
      // Allowing unverified email addresses enables account
      // enumeration attacks, especially if the value is used for
      // e.g. verification or as a password login identifier.
      //
      // Therefore we only return the email if it (a) exists and (b) is marked verified
      // by GitLab.
      [if "email" in claims && claims.email_verified then "email" else null]: claims.email,
      [if "nickname" in claims then "username" else null]: claims.nickname,
      [if "name" in claims then "full_name" else null]: claims.name,
      [if "website" in claims then "website" else null]: claims.website,
      [if "picture" in claims then "picture" else null]: claims.picture,
    },
  },
}

I tried with several user account on the self hosted version and several self-hosted versions. • Does anyone have ideas of why there are different behavior ? • Does anyone know how I can display for debug all claims avaibles in the jsonnet mapper ?

Hah great 🙂 yes a lot of OIDC providers do have some custom behaviour, glad you figured it out