Keycloak integration breaks on upgrade to >=5.1.1.2

[viktorbard]

Describe the issue

After upgrading weblate image from 5.1.1.1 to >=5.1.1.2 all users are getting Could not complete registration. The supplied e-mail address is already in use for another account when signing in with our keycloak integration.

I already tried

• I've read and searched the documentation.
• I've searched for similar issues in this repository.

Steps to reproduce the behavior

1. Log in to Weblate with Keycloak as OIDC provider
2. Bump Weblate image from 5.1.1.1 to 5.1.1.2
3. Try signing in to Weblate again with Keycloak

Expected behavior

Able to map login to existing user, not trying to create a new user.

Screenshots

Login view:

Audit log:

Exception traceback

No response

Additional context

No response

[nijel]

It upgrades social-auth-core to 4.5.0, see https://github.com/python-social-auth/social-core/releases/tag/4.5.0. The Keycloak change looks harmless: python-social-auth/social-core#815

[viktorbard]

Thanks for the links. I agree that they look harmless but after some more investigation we found that default ID-key had changed from username to email for us.

We tried setting SOCIAL_AUTH_KEYCLOAK_ID_KEY=username and WEBLATE_SOCIAL_AUTH_KEYCLOAK_ID_KEY=username to override but it didn't work. We ended up changing uid from username to email in the database then auth worked after upgrade.

Looking at those changes though, it looks like default should still be username...

[nijel]

Duplicate of python-social-auth/social-core#854