What causes "errors.oidc.no-account" in Kareadita/Kavita?

Enable automatic account creation in OIDC settings if new users should self-register.

Kareadita/Kavita · error · KavitaException

errors.oidc.no-account

errors.oidc.no-account

Error message

errors.oidc.no-account

What it means

Thrown as KavitaException with key 'errors.oidc.no-account' by OpenIdConnectEventsHelper.OidcClaimsPrincipalConverter when OidcService.LoginOrCreate returns null — the provider's identity could not be matched to an existing user and a new account could not be created. HandleTicketReceived catches it and redirects the browser to /login?skipAutoLogin=true&error=... rather than surfacing a 500.

Source

Thrown at Kavita.Server/Helpers/OpenIdConnectEventsHelper.cs:143

            ctx.HandleResponse();
        }
    }

    /// <summary>
    /// Called after the redirect from the OIDC provider, tries matching the user and update the principal
    /// to have the correct claims and properties. This is required to later auto refresh; and ensure .NET knows which
    /// Kavita roles the user has
    /// </summary>
    /// <param name="ctx"></param>
    private static async Task OidcClaimsPrincipalConverter(TicketReceivedContext ctx)
    {
        if (ctx.Principal == null) return;

        var oidcService = ctx.HttpContext.RequestServices.GetRequiredService<IOidcService>();
        var user = await oidcService.LoginOrCreate(ctx.Request, ctx.Principal);
        if (user == null)
        {
            throw new KavitaException("errors.oidc.no-account");
        }

        var claims = await OidcService.ConstructNewClaimsList(ctx.HttpContext.RequestServices, ctx.Principal, user);

        var identity = new ClaimsIdentity(claims, ctx.Scheme.Name);
        var principal = new ClaimsPrincipal(identity);

        ctx.HttpContext.User = principal;
        ctx.Principal = principal;

        ctx.Success();
    }

}

View on GitHub (pinned to 9c3e540000)

Solutions

Enable automatic account creation in OIDC settings if new users should self-register.
Pre-create the Kavita account with the same email the provider sends.
Ensure the provider emits a stable subject id and an email claim; require email verification only if the provider enforces it.
Resolve the 'errors.oidc.email-in-use' / missing-email cases shown earlier in OidcService.LoginOrCreate.

Defensive patterns

Strategy: validation

Validate before calling

if (await oidcService.LoginOrCreate(request, principal, ct) is null)
    return Redirect(loginWithNoAccountError);

Try / catch

try { await OidcClaimsPrincipalConverter(ctx); }
catch (KavitaException ex)
{ ctx.Response.Redirect(login + "?error=" + Uri.EscapeDataString(ex.Message)); ctx.HandleResponse(); }

Prevention

Enable auto-account-creation in OIDC settings if users self-register.
Pre-create accounts matching provider emails.
Ensure the provider sends a stable subject id and email claim.

When it happens

Trigger: OIDC login completes but LoginOrCreate cannot match (no matching oidc id / email) and account creation is disabled or fails. Common sub-causes: missing 'sub' (caught earlier as missing-external-id), email already in use by an OIDC account, email not verified when required, or account-creation gated off.

Common situations: First login by a user whose email is not in Kavita and 'create accounts on login' is off; provider does not send an email claim; email claim matches a user already owned by another OIDC id.

Related errors

AI-assisted analysis of Kareadita/Kavita@9c3e540000 (2026-08-13). Data as JSON: /api/errors/785286e0f58cf757. Report an issue: GitHub.