Provider auth with registration disabled

[martinounap]

What happened?

With self‑registration disabled and only third‑party provider auth enabled (e.g., Google), accounts created by our local “create user” script are unable to sign in because their provider field is set to "local". As a workaround I ran:
db.users.updateOne({ email: "$USER_EMAIL"},{ $set: { provider: "$PROVIDER" } })

Until the admin panel is ready, we should add a simple migration script that updates the provider field for a given user or a list of users.

Version Information

ghcr.io/danny-avila/librechat v0.8.0-rc2 78a279684768 17 hours ago 1.17GB ghcr.io/danny-avila/librechat-rag-api-dev-lite v0.6.0 fdceac10490b 8 days ago 1.48GB ghcr.io/danny-avila/librechat v0.8.0-rc1 25d757180cb4 8 days ago 1.17GB ghcr.io/virtuos/librechat_exporter main 3012a75299b4 2 months ago 283MB

Steps to Reproduce

1. create user with script
2. try to log in with Google
3. Log show log:
   {"level":"info","message":"[googleLogin] User $USER_EMAIL already exists with provider local","timestamp":"2025-08-13T07:52:31.581Z"}

What browsers are you seeing the problem on?

Safari

Relevant log output

{"level":"info","message":"[googleLogin] User $USER_EMAIL already exists with provider local","timestamp":"2025-08-13T07:52:31.581Z"}

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[martinounap]

Users sometimes need to change their authentication method (e.g., moving from Microsoft to Google). If multiple providers are enabled, we should support switching after login to avoid manual admin intervention.

[danny-avila]

Users sometimes need to change their authentication method (e.g., moving from Microsoft to Google).

This feature was removed for security reasons as highlighted here:
#8980

This allows for account takeover if someone signs in with a Microsoft account with one email. An attacker can register a Google account under that email if the user has not already done so themselves, and get access to their LibreChat private chats.

There should be an account-linking feature to allow multiple OAuth providers to be used for one account, and it's currently planned.

For now, if you have a specific user wanting one provider over the other, you can manually change the "provider" field in their user document in the DB.

[martinounap]

Is it possible to update documentation, on the same page, where is example for creating ADMIN user, so others could find this info also. ;)

[kosmydel]

I can confirm that if you want to use only the Google provider, and you have existing "local" users, you can perform the query below to fix the above issue:

use LibreChat

db.users.updateMany(
  { provider: "local" },
  { $set: { provider: "google" } }
)