This repository has no description
configs.services.pad: key Zitadel users by sub, not preferred_username
HedgeDoc looks up users only by profileid, in one table with the GitHub
logins, whose profileid is the numeric GitHub user id. Without
userProfileIdAttr it is the username, which anyone chooses when
registering at id.lassul.us: a Zitadel user named after someone's GitHub
id logged in as that GitHub user, and a renamed or deleted username
handed its pad account to the next user taking the name. sub is the
Zitadel user id, which Zitadel generates and never reuses.
Existing Zitadel accounts in HedgeDoc are keyed by their login name and
need their profileid changed to the Zitadel user id.
author
Hermes
committer
lassulus
date
(Oct 18, 2026, 9:57 AM CEST)
commit
34a15640
34a156406d1d134ebd952a53f124cd208ec74d6e
parent
64a93820
64a93820ea2be63810979744e5b25c916fba486b
+2
+2
configs/services/pad/default.nix
+2
configs/services/pad/default.nix
···
38
38
tokenURL = "https://id.lassul.us/oauth/v2/token";
39
39
userProfileURL = "https://id.lassul.us/oidc/v1/userinfo";
40
40
scope = "openid email profile";
41
+
# sub, not the freely chosen username: HedgeDoc shares one user table with GitHub logins.
42
+
userProfileIdAttr = "sub";
41
43
userProfileUsernameAttr = "preferred_username";
42
44
userProfileDisplayNameAttr = "name";
43
45
userProfileEmailAttr = "email";