{"record":{"id":"d5142f2e5a8c0f3c","repo":"Kareadita/Kavita","slug":"errors-oidc-syncing-user","errorCode":null,"errorMessage":"errors.oidc.syncing-user","messagePattern":"errors\\.oidc\\.syncing-user","errorType":"exception","errorClass":"KavitaException","httpStatus":null,"severity":"error","filePath":"Kavita.Services/OidcService.cs","lineNumber":316,"sourceCode":"\n        await unitOfWork.CommitAsync();\n\n        return user;\n    }\n\n    /// <summary>\n    /// Assign configured defaults (libraries, age ratings, roles) to the newly created user\n    /// </summary>\n    private async Task SetDefaults(OidcConfigDto settings, AppUser user)\n    {\n        if (settings.SyncUserSettings) return;\n\n        logger.LogDebug(\"Assigning defaults to newly created user; Roles: {Roles}, Libraries: {Libraries}, AgeRating: {AgeRating}, IncludeUnknowns: {IncludeUnknowns}\",\n            settings.DefaultRoles, settings.DefaultLibraries, settings.DefaultAgeRestriction, settings.DefaultIncludeUnknowns);\n\n        // Assign roles\n        var errors = await accountService.UpdateRolesForUser(user, settings.DefaultRoles);\n        if (errors.Any()) throw new KavitaException(\"errors.oidc.syncing-user\");\n\n        // Assign libraries\n        await accountService.UpdateLibrariesForUser(user, settings.DefaultLibraries, settings.DefaultRoles.Contains(PolicyConstants.AdminRole));\n\n        // Assign age rating, or bypass if admin\n        if (await userManager.IsInRoleAsync(user, PolicyConstants.AdminRole))\n        {\n            user.AgeRestriction = AgeRating.NotApplicable;\n            user.AgeRestrictionIncludeUnknowns = true;\n        }\n        else\n        {\n            user.AgeRestriction = settings.DefaultAgeRestriction;\n            user.AgeRestrictionIncludeUnknowns = settings.DefaultIncludeUnknowns;\n        }\n\n        await unitOfWork.CommitAsync();\n    }","sourceCodeStart":298,"sourceCodeEnd":334,"githubUrl":"https://github.com/Kareadita/Kavita/blob/9c3e5400007f8a0282f7d883f2ad5e71716e514d/Kavita.Services/OidcService.cs#L298-L334","documentation":"Thrown in SetDefaults (note: this runs only when settings.SyncUserSettings is false, per the early return) when UpdateRolesForUser returns any errors while assigning DefaultRoles to a freshly created OIDC user. Role assignment is the first default step; if it fails, Kavita aborts default provisioning rather than leaving the user half-configured.","triggerScenarios":"New OIDC user just created via CreateNewAccount; SetDefaults runs; accountService.UpdateRolesForUser(user, settings.DefaultRoles) returns a non-empty errors list — e.g. a DefaultRole name that doesn't exist in the role store, or the role manager rejected the assignment.","commonSituations":"An OIDC DefaultRoles setting references a role that was renamed/removed; DefaultRoles contains a typo; role seeding didn't run so PolicyConstants-named roles are missing; the user was created but role store is inconsistent.","solutions":["Check the OIDC DefaultRoles setting — every role name listed must exist in the role store (LoginRole, AdminRole, etc.).","Ensure role seeding ran so Kavita's built-in roles exist.","Remove or fix any DefaultRoles entry that doesn't map to a real role.","If SetDefaults partially applied before the throw, verify the user's roles/libraries after fixing and re-saving."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"var roleErrors = await accountService.UpdateRolesForUser(user, settings.DefaultRoles);\nif (roleErrors.Any())\n    return Conflict($\"Could not assign roles: {string.Join(\", \", roleErrors)}\");","typeGuard":null,"tryCatchPattern":"try { var user = await oidcService.LoginOrCreate(Request, principal, ct); }\ncatch (KavitaException ex) when (ex.Message == \"errors.oidc.syncing-user\")\n{ /* audit OIDC DefaultRoles against existing roles in the store */ }","preventionTips":["Validate every entry in OIDC DefaultRoles maps to a real role name.","Ensure role seeding ran so built-in roles exist.","Re-verify the user's roles/libraries after fixing DefaultRoles and re-saving."],"tags":["oidc","account-provisioning","roles","configuration"],"backgroundTag":null,"analyzedSha":"9c3e5400007f8a0282f7d883f2ad5e71716e514d","analyzedAt":"2026-08-13T19:06:05.897Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}