public/headscale
1
0 Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-11-04 12:39:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

types: drop a stored OIDC email the login no longer vouches for

Browse Source
This commit is contained in:
Kristoffer Dalby committed 2026-10-28 18:28:23 +00:00
1 parent 5d7c1a7d14
commit 148fc208f9
4 files changed
+62 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/ref/oidc.md
+5 -4
View File
@@ -127,12 +127,13 @@ are configured, a user needs to pass all of them.
### Control email verification
Headscale uses the `email` claim from the identity provider to synchronize the email address to its user profile. By
default, a user's email address is only synchronized when the identity provider reports the email address as verified
via the `email_verified: true` claim.
Headscale synchronizes the `email` claim from the identity provider to its user profile on each OIDC login. By default,
the profile uses the email only when the latest login reports `email_verified: true`. An absent, unverified, or
malformed email clears the previously stored address.
Unverified emails may be allowed in case an identity provider does not send the `email_verified` claim or email
verification is not required. In that case, a user's email address is always synchronized to the user profile.
verification is not required. With `email_verified_required: false`, the latest login's email is stored without
requiring verification. An absent or malformed email still clears the previously stored address.
```yaml hl_lines="5"
oidc: