{"record":{"id":"3c2e6c987bd56563","repo":"BookStackApp/BookStack","slug":"exception-getmessage-3c2e6c","errorCode":null,"errorMessage":"{$exception->getMessage()}","messagePattern":"\\{\\$exception->getMessage\\(\\)\\}","errorType":"exception","errorClass":"OidcException","httpStatus":null,"severity":"error","filePath":"app/Access/Oidc/OidcService.php","lineNumber":228,"sourceCode":"            throw new OidcException(trans('errors.oidc_no_email_address'));\n        }\n        if (empty($userDetails->name)) {\n            $userDetails->name = $userDetails->externalId;\n        }\n\n        $isLoggedIn = auth()->check();\n        if ($isLoggedIn) {\n            throw new OidcException(trans('errors.oidc_already_logged_in'));\n        }\n\n        try {\n            $user = $this->registrationService->findOrRegister(\n                $userDetails->name,\n                $userDetails->email,\n                $userDetails->externalId\n            );\n        } catch (UserRegistrationException $exception) {\n            throw new OidcException($exception->getMessage());\n        }\n\n        if ($this->config()['fetch_avatar'] && !$user->avatar()->exists() && $userDetails->picture) {\n            $this->userAvatars->assignToUserFromUrl($user, $userDetails->picture);\n        }\n\n        if ($this->shouldSyncGroups()) {\n            $detachExisting = $this->config()['remove_from_groups'];\n            $this->groupService->syncUserWithFoundGroups($user, $userDetails->groups ?? [], $detachExisting);\n        }\n\n        $this->loginService->login($user, 'oidc');\n\n        return $user;\n    }\n\n    /**\n     * @throws OidcException","sourceCodeStart":210,"sourceCodeEnd":246,"githubUrl":"https://github.com/BookStackApp/BookStack/blob/18f8469a1c72f8cc8497e9372635e6dea5028071/app/Access/Oidc/OidcService.php#L210-L246","documentation":"During OIDC login, BookStack calls registrationService->findOrRegister() to match or create the local user. If that throws a UserRegistrationException (registrations disabled, email domain not allowed, user already exists with different credentials, theme prevention, etc.), it is rethrown here as an OidcException with the same message.","triggerScenarios":"processAccessTokenCallback -> findOrRegister(name, email, externalId) throws UserRegistrationException; this wrapper forwards $exception->getMessage() as an OidcException.","commonSituations":"REGISTRATION_ENABLED=false with a user whose email doesn't match an existing account, APP/registration email-domain restrictions (.env REGISTRATION_CONFIRM... / email domain whitelist) rejecting the domain, an existing BookStack user already has that email but signed in via different credentials, or a theme plugin hooking AUTH_PRE_REGISTER returning false.","solutions":["Read the wrapped message in logs — it indicates the underlying registration failure","If users should auto-provision, set REGISTRATION_ENABLED=true (or rely on external auth auto-registration path)","Check email domain restrictions (APP via RegistrationService ensureEmailDomainAllowed config) allow the IdP user's domain","If the email already exists locally, merge/rename the existing user or align credentials","Check custom themes for AUTH_PRE_REGISTER handlers returning false"],"exampleFix":"// before (.env)\nREGISTRATION_ENABLED=false\n// after (allow OIDC auto-registration)\nREGISTRATION_ENABLED=true","handlingStrategy":"try-catch","validationCode":"// Pre-check the conditions registerUser enforces:\n// 1) registration allowed, 2) email domain allowed, 3) no existing user with email\n$existing = \\BookStack\\Users\\UserRepo::new()->getByEmail($email);\nif ($existing !== null) { /* account conflict — resolve before login */ }\n// Confirm REGISTRATION_ENABLED=true if auto-provisioning is expected","typeGuard":null,"tryCatchPattern":"try {\n    auth()->attemptOidcLogin();\n} catch (BookStack\\Access\\Oidc\\OidcException $e) {\n    Log::warning('OIDC registration rejected', ['reason' => $e->getMessage()]);\n    return redirect('/login')->withErrors(['oidc' => $e->getMessage()]);\n}","preventionTips":["Enable REGISTRATION_ENABLED if new users must auto-provision","Keep email-domain restriction lists in sync with your IdP domains","Audit themes/plugins hooking AUTH_PRE_REGISTER for accidental vetoes","Pre-provision or link accounts for users known to exist locally"],"tags":["oidc","registration","provisioning"],"backgroundTag":"user-registration-blocked","analyzedSha":"18f8469a1c72f8cc8497e9372635e6dea5028071","analyzedAt":"2026-09-02T19:49:33.068Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}