|
|
Hello,
It means SOGo properly fecth the user profile but didn't find the mail inside. A basic user profile looks is a dict like this
{
"sub":"70a3e6a1-37cf-4cf6-b114-6973aabca86a",
"email_verified":false,
"name":"Foo Bar",
"preferred_username":"myuser",
"given_name":"Foo",
"family_name":"Bar",
"email":"myuser@user.com"
}
To set which key is the mail one, you can set this parameter in your sogo.conf
SOGoOpenIdEmailParam = "email";
Can you add this to your sogo.conf to get more logs? It will show the user profile result.
SOGoOpenIDDebugEnabled = YES; |
|
|
In the log I see the following:
2025-09-05 10:20:57.207 sogod[25732:25732] OpenId perform request: GET https://sso.example.com/adfs/userinfo
2025-09-05 10:20:57.207 sogod[25732:25732] OpenId perform request, headers {authorization = "Bearer <token>"; "content-type" = "application/x-www-form-urlencoded"; }
2025-09-05 10:20:57.207 sogod[25732:25732] OpenId perform request, body raw (null)
2025-09-05 10:20:57.277 sogod[25732:25732] OpenId perform request: response is: <SimpleOpenIdResponse> <status: 200>, <headers: HTTP/2 200
content-length: 0
content-type: text/html; charset=utf-8
server: Microsoft-HTTPAPI/2.0
strict-transport-security: max-age = 31536000
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
date: Fri, 05 Sep 2025 07:20:56 GMT
, <content: >
Sep 05 10:20:57 sogod [25732]: [ERROR] <0x55ac8a247670[SOGoOpenIdSession]:(null)> Can't get user email from profile because: no mail found
The token contains the following information:
{
"aud": "microsoft:identityserver:385de95b-52a2-4db2-ad60-6d326cb0bd05",
"iss": "http://sso.example.com/adfs/services/trust",
"iat": 1757060637,
"nbf": 1757060637,
"exp": 1757064237,
"email": "sobyaninyd@example.com",
"upn": "sobyaninyd@example.com",
"preferred_username": "sobyaninyd",
"apptype": "Confidential",
"appid": "385de95b-52a2-4db2-ad60-6d326cb0bd05",
"authmethod": "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
"auth_time": "2025-09-05T08:23:52.144Z",
"ver": "1.0",
"scp": "allatclaims email profile openid"
}
Also in the logs there is an access_token which contains the same thing as in authorization = "Bearer <token>
id_token:
{
"aud": "385de95b-52a2-4db2-ad60-6d326cb0bd05",
"iss": "https://sso.example.com/adfs",
"iat": 1757060639,
"nbf": 1757060639,
"exp": 1757064239,
"auth_time": 1757060632,
"sub": "yiB7NrFulQsF/RRA4CjktR0yPUVuEyRyzhI2fyiqYMk=",
"unique_name": "DOMAIN\sobyaninyd",
"sid": "S-1-5-21-1587453395-1195599393-282800124-1103",
"upn": "sobyaninyd@example.com",
"email": "sobyaninyd@example.com",
"preferred_username": "sobyaninyd",
"apptype": "Confidential",
"appid": "385de95b-52a2-4db2-ad60-6d326cb0bd05",
"authmethod": "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
"ver": "1.0",
"scp": "allatclaims email profile openid"
}
i.e. this is the information received when accessing https://sso.example.com/adfs/oauth2/token (see screenshot) |
