Problem using Zoho as an OAuth source

[bligneri]

I am trying to have Authentik use Zoho as a federated sources.

I have the redirect toward Zoho, accept the permission and then redirect to the Authentik server callback.

But then, I am still not authenticated. I did comment on this (closed) issue: #9973

What I have is a property mapping:

email = info.get("Email") or ""
username = email.split("@")[0] if "@" in email else "unknown"
name = info.get("Display_Name") or email or "Unknown User"

return {
    "email": email,
    "uid": username,
    "name": name,
    "username": username,
}

I have created a user with the correct user name.
I tried to have the user in the default users path as well as goauthentik.io/sources/my-slug but it ends up identically
=> After the zoho redirect I am back to the login screen and in the URL params I have state=yyy&code=xxx&location=us&accounts-server=https%3A%2F%2Faccounts.zoho.com

Any help welcome to make this work ;-)

I am new to Authentik. If it can help, I have a go app that use OAUth with Zoho. I used this to create the mapping above.

The relevant func() is :

func (p *ZohoProvider) FetchUser(session goth.Session) (goth.User, error) {
	sess, ok := session.(*Session)
	if !ok {
		return goth.User{}, fmt.Errorf("invalid session type")
	}
	if sess.AccessToken == "" {
		return goth.User{}, fmt.Errorf("no access token found")
	}

	// Call Zoho's user info endpoint.
	req, err := http.NewRequest("GET", "https://accounts.zoho.com/oauth/user/info", nil)
	if err != nil {
		return goth.User{}, err
	}
	req.Header.Set("Authorization", "Bearer "+sess.AccessToken)

	client := &http.Client{}
	resp, err := client.Do(req)
	if err != nil {
		return goth.User{}, err
	}
	defer resp.Body.Close()

	// Decode the JSON response.
	var data map[string]interface{}
	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		return goth.User{}, err
	}

	// Create a user and populate its fields.
	user := goth.User{
		Provider:    p.Name(),
		AccessToken: sess.AccessToken,
		RawData:     data,
	}

	// Optionally, if the data contains specific keys, map them:
	if email, ok := data["Email"].(string); ok {
		user.Email = email
	}
	if firstName, ok := data["Display_Name"].(string); ok {
		user.FirstName = firstName
	}
	if lastName, ok := data["Last_Name"].(string); ok {
		user.LastName = lastName
	}

	if !hasValidDomain(user.Email) {
			return goth.User{}, fmt.Errorf("Error: user %s does not have a valid domain %s",user.Email, validDomain)
	}

	return user, nil
}