OIDC Login issue

[Gary Maxwell]

In Concerto 3, we are now authenticating with OIDC without error however it appears that it is not logged in. Is there a list of claims that need to be met before a successful authentication? Or any other ideas?

-Gary

[Brian Michalski]

I spent a few days pretty boggled by this since OIDC seems to work well in the test environments I have available (Zoho, Gitlab) without any additional config.

Your hint about the list of claims is spot on. Concerto 3 expects claims to at least include email, and ideally given_name + first_name (fallback: name). We silently fail to create a user if those are missing. I naively assumed these were defaults supplied by all OIDC providers, but after some digging  I realized some providers (in particular CAS) require allowlisting before they release anything. Given how popular CAS was for Concerto 1 / 2, we should make sure it keeps working with Concerto 3.

I've pushed a fix which should provide a clearer error message when this happens and documented* the claims we expect in our V3 documentation.

Let me know how it goes,

~Brian M

* The tables looked nicer on my computer, I swear.

On Wed, Jul 15, 2026 at 9:57 AM Gary Maxwell <Maxw...@fortlewis.edu> wrote:

In Concerto 3, we are now authenticating with OIDC without error however it appears that it is not logged in. Is there a list of claims that need to be met before a successful authentication? Or any other ideas?

-Gary

--
You received this message because you are subscribed to the Google Groups "Concerto Digital Signage" group.
To unsubscribe from this group and stop receiving emails from it, send an email to concerto-digital-s...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/concerto-digital-signage/f262d5e6-70a5-4a1f-bed1-e98efbee7a8bn%40googlegroups.com.

[Gary Maxwell]

Hi Brian,

Sorry for the late response!

Users were not able to use OIDC to authenticate with accounts that already existed on Concerto. We were able to authenticate after the accounts were manually deleted . The users were re-added during the OIDC authentication.

We should be able to move forward now.

Thanks again for your help

-Gary

[Brian Michalski]

I'm glad to hear we were able to straighten this out!  The non-SSO -> SSO upgrade flow is something we should probably fix, but your workaround of deleting the existing accounts is a good path forward.

Thanks for helping us iron out the bugs here,

~Brian M

To view this discussion visit https://groups.google.com/d/msgid/concerto-digital-signage/0661db0a-e5c4-4cc4-9b7f-6ce4bb30ad64n%40googlegroups.com.