Kareadita/Kavita · error · KavitaException

errors.oidc.syncing-user

Error message

errors.oidc.syncing-user

What it means

Thrown in SetDefaults (note: this runs only when settings.SyncUserSettings is false, per the early return) when UpdateRolesForUser returns any errors while assigning DefaultRoles to a freshly created OIDC user. Role assignment is the first default step; if it fails, Kavita aborts default provisioning rather than leaving the user half-configured.

Source

Thrown at Kavita.Services/OidcService.cs:316

        await unitOfWork.CommitAsync();

        return user;
    }

    /// <summary>
    /// Assign configured defaults (libraries, age ratings, roles) to the newly created user
    /// </summary>
    private async Task SetDefaults(OidcConfigDto settings, AppUser user)
    {
        if (settings.SyncUserSettings) return;

        logger.LogDebug("Assigning defaults to newly created user; Roles: {Roles}, Libraries: {Libraries}, AgeRating: {AgeRating}, IncludeUnknowns: {IncludeUnknowns}",
            settings.DefaultRoles, settings.DefaultLibraries, settings.DefaultAgeRestriction, settings.DefaultIncludeUnknowns);

        // Assign roles
        var errors = await accountService.UpdateRolesForUser(user, settings.DefaultRoles);
        if (errors.Any()) throw new KavitaException("errors.oidc.syncing-user");

        // Assign libraries
        await accountService.UpdateLibrariesForUser(user, settings.DefaultLibraries, settings.DefaultRoles.Contains(PolicyConstants.AdminRole));

        // Assign age rating, or bypass if admin
        if (await userManager.IsInRoleAsync(user, PolicyConstants.AdminRole))
        {
            user.AgeRestriction = AgeRating.NotApplicable;
            user.AgeRestrictionIncludeUnknowns = true;
        }
        else
        {
            user.AgeRestriction = settings.DefaultAgeRestriction;
            user.AgeRestrictionIncludeUnknowns = settings.DefaultIncludeUnknowns;
        }

        await unitOfWork.CommitAsync();
    }

View on GitHub (pinned to 9c3e540000)

Solutions

1. Check the OIDC DefaultRoles setting — every role name listed must exist in the role store (LoginRole, AdminRole, etc.).
2. Ensure role seeding ran so Kavita's built-in roles exist.
3. Remove or fix any DefaultRoles entry that doesn't map to a real role.
4. If SetDefaults partially applied before the throw, verify the user's roles/libraries after fixing and re-saving.

var roleErrors = await accountService.UpdateRolesForUser(user, settings.DefaultRoles);
if (roleErrors.Any())
    return Conflict($"Could not assign roles: {string.Join(", ", roleErrors)}");

try { var user = await oidcService.LoginOrCreate(Request, principal, ct); }
catch (KavitaException ex) when (ex.Message == "errors.oidc.syncing-user")
{ /* audit OIDC DefaultRoles against existing roles in the store */ }

When it happens

Trigger: New OIDC user just created via CreateNewAccount; SetDefaults runs; accountService.UpdateRolesForUser(user, settings.DefaultRoles) returns a non-empty errors list — e.g. a DefaultRole name that doesn't exist in the role store, or the role manager rejected the assignment.

Common situations: An OIDC DefaultRoles setting references a role that was renamed/removed; DefaultRoles contains a typo; role seeding didn't run so PolicyConstants-named roles are missing; the user was created but role store is inconsistent.

Related errors

• errors.oidc.role-not-assigned
• errors.oidc.no-account
• errors.oidc.failed-to-update-email
• User is not authenticated
• errors.oidc.no-account

AI-assisted analysis of Kareadita/Kavita@9c3e540000 (2026-08-13). Data as JSON: /api/errors/d5142f2e5a8c0f3c. Report an issue: GitHub.