From 87aab5d88ab4eb0febe178cbb58b29540bc27e73 Mon Sep 17 00:00:00 2001 From: giriparus Date: Mon, 22 Jun 2026 22:20:20 +0530 Subject: [PATCH] fix: update OIDC hooks and clear traits for registration flow --- docker/kratos/kratos.yml | 3 ++- pkg/kratos/service.go | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/docker/kratos/kratos.yml b/docker/kratos/kratos.yml index bccecbaf2..310339c9c 100644 --- a/docker/kratos/kratos.yml +++ b/docker/kratos/kratos.yml @@ -60,7 +60,8 @@ selfservice: - hook: session oidc: hooks: - - hook: session + - hook: show_verification_ui + - hook: session webauthn: hooks: - hook: session diff --git a/pkg/kratos/service.go b/pkg/kratos/service.go index 5a3d19c32..080a4b111 100644 --- a/pkg/kratos/service.go +++ b/pkg/kratos/service.go @@ -1001,6 +1001,11 @@ func (s *Service) ParseRegistrationFlowMethodBody(r *http.Request) (*kClient.Upd if err := parseBody(r.Body, &body); err != nil { return nil, err } + // Traits for OIDC registration must come from IdP-verified claims + // (docker/kratos/schema.jsonnet), never from client input. Without this, + // the identifier-first email (xxx@email.com) overrides the provider email + // (yyy@gmail.com) and the account registers under an unproven address. + body.Traits = nil ret = kClient.UpdateRegistrationFlowWithOidcMethodAsUpdateRegistrationFlowBody(&body) default: return nil, fmt.Errorf("unknown method: %s", method)