Migrate OIDC to ash_authentication identity_resource (UserIdentity) and unpin to 4.14+ #557

New issue

Open

opened 2026-07-11 16:37:15 +02:00 by simon · 0 comments

simon commented

2026-07-11 16:37:15 +02:00

Owner

Scope

run mix ash_authentication.upgrade; generate the UserIdentity resource + migration; migrate existing users.oidc_id data into user_identities; adapt the custom flows (register_with_oidc, link_oidc_id, OidcEmailCollision, LinkOidcAccountLive, OidcRoleSync); re-test against Rauthy/Authentik/Keycloak; then unpin ash_authentication. Security-critical — treat as its own feature, not a dependency bump.

ash_authentication is pinned to ~> 4.13.0 (see mix.exs comment) because 4.14 makes an identity_resource mandatory for OIDC strategies and emits a compile warning that has no suppression flag. Our custom design (oidc_id attribute + unique_oidc_id identity on Mv.Accounts.User, resolving sign-in by the sub claim, PR #192/#171) already satisfies 4.14's security intent, so there is no live gap — but the requirement will become hard in a future release. ## Scope run mix ash_authentication.upgrade; generate the UserIdentity resource + migration; migrate existing users.oidc_id data into user_identities; adapt the custom flows (register_with_oidc, link_oidc_id, OidcEmailCollision, LinkOidcAccountLive, OidcRoleSync); re-test against Rauthy/Authentik/Keycloak; then unpin ash_authentication. Security-critical — treat as its own feature, not a dependency bump.