Question: OIDC + local user

[D10n1x]

Question

How can a local user be made an external OIDC user?

I had to change the local user's email, otherwise I would get these errors

[+]time="2025-10-02T17:10:41+06:00" level=error msg="OIDC user 'admin' conflicts with local user"[/+]
[+]time="2025-10-02T17:12:11+06:00" level=error msg="OIDC user 'adm' conflicts with local user"[/+]
[+]time="2025-10-02T17:13:08+06:00" level=error msg="OIDC user 'adm1' conflicts with local user"

Related to

No response

[WorkDal]

I think you have to delete the local user and then log in with OIDC.
But you will need another local user to set the correct permissions on the newly created OIDC user.

[tjleach98]

I was able to use my existing account with Authentik after flipping 'External' to true in the 'user' table. I haven't noticed any issues after doing so but I'll update here if anything comes up.

api/login.go#L753 seems to be where it complains about existing users. I can understand why it would behave this way but maybe a config option to override this would be helpful. Something like SEMAPHORE_OIDC_ALLOW_EXISTING set to true could allow using the existing user even if they aren't currently 'External'.

- if !user.External {
+ if !util.Config.OidcAllowExisting && !user.External {

[JuliansLab]

I had the same issue and needed to rename my original local semaphore user to be able to login with my prefered Authentik user. After the succesful login, i logged out again, logged in with the original semaphore user to give the Authentik user admin rights and deleting the semaphore user. Now i am able to login with my Authentik user as admin.

[D10n1x]

I did the same, only through phpmyadmin I directly set it in the database that the admin can be an external user, but the ability to log in with a local login password was lost, which is not good, you never know what will happen to the oidc.