Social logins: Set user to "Internal" only on given condition?

[fdcastel]

Following #11386, how can I set the user as 'Internal' only under certain conditions — for example, when the Google account belongs to the @contoso.com domain?

[dewi-tik]

Hi @fdcastel. An OAuth source property mapping should achieve what you're after. Something like this:

from authentik.core.models import UserTypes

email_name, email_domain = info["email"].rsplit("@", 1)
is_matching_domain = email_domain.endswith("contoso.com")

user_type = UserTypes.INTERNAL if is_matching_domain else UserTypes.EXTERNAL

return {
    "type": user_type,
}

[fdcastel]

@dewi-tik The code looks great to me at first glance. However, when I tested it using an account from "@contoso.com", I initially received a "Server Error" message. On the second attempt, it went through—but the user ended up being registered as "External".

Any suggestions on how I can go about debugging this?

[dewi-tik]

I think you'd be better off using ak_logger.info than ak_logger.warning. That way you can just pass the structured data rather than breaking it up. Trace mode shouldn't be necessary.

This might also be useful for you: https://docs.goauthentik.io/docs/users-sources/sources/protocols/oauth/#expression-data

[fdcastel]

Thanks for the pointers, @dewi-tik!

Just to clarify: should the ak_logger output appear in the Docker Compose logs? or is it being written to a separate log file?

I’m asking this because I haven’t been able to see any of my ak_logger outputs anywhere. 😅

[dewi-tik]

No problem. We have a guide on how to capture logs here: https://docs.goauthentik.io/docs/troubleshooting/logs

If you're running on docker the output will just be in the docker logs of for your authentik server container.

[fdcastel]

Found the issue! I totally skipped step 5 from the Create a custom source property mapping: 🤦🏻

5. In the source configuration, select the newly created property mapping as a User property mapping if it applies to users, or Group property mapping if it applies to groups.

After assigning it correctly, @dewi-tik’s original code worked like a charm.

Huge thanks again, @dewi-tik, for your time and super helpful guidance!

[dewi-tik]

Happy to help and glad that it's working for you