{"record":{"id":"785286e0f58cf757","repo":"Kareadita/Kavita","slug":"errors-oidc-no-account","errorCode":"errors.oidc.no-account","errorMessage":"errors.oidc.no-account","messagePattern":"errors\\.oidc\\.no-account","errorType":"exception","errorClass":"KavitaException","httpStatus":400,"severity":"error","filePath":"Kavita.Server/Helpers/OpenIdConnectEventsHelper.cs","lineNumber":143,"sourceCode":"            ctx.HandleResponse();\n        }\n    }\n\n    /// <summary>\n    /// Called after the redirect from the OIDC provider, tries matching the user and update the principal\n    /// to have the correct claims and properties. This is required to later auto refresh; and ensure .NET knows which\n    /// Kavita roles the user has\n    /// </summary>\n    /// <param name=\"ctx\"></param>\n    private static async Task OidcClaimsPrincipalConverter(TicketReceivedContext ctx)\n    {\n        if (ctx.Principal == null) return;\n\n        var oidcService = ctx.HttpContext.RequestServices.GetRequiredService<IOidcService>();\n        var user = await oidcService.LoginOrCreate(ctx.Request, ctx.Principal);\n        if (user == null)\n        {\n            throw new KavitaException(\"errors.oidc.no-account\");\n        }\n\n        var claims = await OidcService.ConstructNewClaimsList(ctx.HttpContext.RequestServices, ctx.Principal, user);\n\n        var identity = new ClaimsIdentity(claims, ctx.Scheme.Name);\n        var principal = new ClaimsPrincipal(identity);\n\n        ctx.HttpContext.User = principal;\n        ctx.Principal = principal;\n\n        ctx.Success();\n    }\n\n}\n","sourceCodeStart":125,"sourceCodeEnd":158,"githubUrl":"https://github.com/Kareadita/Kavita/blob/9c3e5400007f8a0282f7d883f2ad5e71716e514d/Kavita.Server/Helpers/OpenIdConnectEventsHelper.cs#L125-L158","documentation":"Thrown as KavitaException with key 'errors.oidc.no-account' by OpenIdConnectEventsHelper.OidcClaimsPrincipalConverter when OidcService.LoginOrCreate returns null — the provider's identity could not be matched to an existing user and a new account could not be created. HandleTicketReceived catches it and redirects the browser to /login?skipAutoLogin=true&error=... rather than surfacing a 500.","triggerScenarios":"OIDC login completes but LoginOrCreate cannot match (no matching oidc id / email) and account creation is disabled or fails. Common sub-causes: missing 'sub' (caught earlier as missing-external-id), email already in use by an OIDC account, email not verified when required, or account-creation gated off.","commonSituations":"First login by a user whose email is not in Kavita and 'create accounts on login' is off; provider does not send an email claim; email claim matches a user already owned by another OIDC id.","solutions":["Enable automatic account creation in OIDC settings if new users should self-register.","Pre-create the Kavita account with the same email the provider sends.","Ensure the provider emits a stable subject id and an email claim; require email verification only if the provider enforces it.","Resolve the 'errors.oidc.email-in-use' / missing-email cases shown earlier in OidcService.LoginOrCreate."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (await oidcService.LoginOrCreate(request, principal, ct) is null)\n    return Redirect(loginWithNoAccountError);","typeGuard":null,"tryCatchPattern":"try { await OidcClaimsPrincipalConverter(ctx); }\ncatch (KavitaException ex)\n{ ctx.Response.Redirect(login + \"?error=\" + Uri.EscapeDataString(ex.Message)); ctx.HandleResponse(); }","preventionTips":["Enable auto-account-creation in OIDC settings if users self-register.","Pre-create accounts matching provider emails.","Ensure the provider sends a stable subject id and email claim."],"tags":["oidc","authentication","sso","account","config"],"backgroundTag":null,"analyzedSha":"9c3e5400007f8a0282f7d883f2ad5e71716e514d","analyzedAt":"2026-08-13T19:06:05.897Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}