OIDC + passkey registration flow with username as identity

[Pedr0Rocha]

Hello,
I'm considering Kratos to build an authentication service. I want to use passkey and most likely Social (Google/Discord) as well.

Everything works great when using email as identity, but I'm having trouble implementing the same flow using username instead.

There are no configuration changes on kratos.yml from the version that fully works to the one that doesn't, only identity.schema.json changes.

---

Email identity schema

passkey ✅
google sign in (registration) ✅
google sign up ✅

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "Test",
  "type": "object",
  "properties": {
    "traits": {
      "type": "object",
      "properties": {
        "email": {
          "type": "string",
          "format": "email",
          "title": "Email",
          "ory.sh/kratos": {
            "credentials": {
              "passkey": {
                "display_name": true
              }
            }
          }
        }
      },
      "required": ["email"],
      "additionalProperties": false
    }
  }
}

This one works perfectly. One click to sign in/up with Google, passkey sign up asks for an email and it works great. But I would like to avoid asking for email address, so I changed it to username instead.

---

Username identity schema

passkey ✅
google sign in (registration) ❌
google sign up ❌

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "Test",
  "type": "object",
  "properties": {
    "traits": {
      "type": "object",
      "properties": {
        "username": {
          "type": "string",
          "title": "Username",
          "ory.sh/kratos": {
            "credentials": {
              "passkey": {
                "display_name": true
              }
            }
          }
        }
      },
      "required": ["username"],
      "additionalProperties": false
    }
  }
}

It still works with passkey, I fill in the username and sign up. But Google sign in/up is completely broken.

When I attempt to sign in with Google (unregistered), I get a different registration page from when I click sign up.

I assume this is a Social specific registration flow UI since it doesn't show the passkey option, which makes sense because I tried to login with Google. But why is it rendering a pre-filled non-required editable email field?

After filling the details, it fails to register at /self-service/registration/flows?id=123... with a 403, security_csrf_violation.

The complete flow is:
-> UI registration
-> self-service registration
-> Google oauth2
-> self-service callback from Google
-> UI registration
-> self-service registration (403)

I can also see this in selfservice_registration_flows.ui table:

{"meta": {}, "type": "input", "group": "default", "messages": [{"id": 4000001, "text": "additionalProperties \"email\" not allowed", "type": "error", "context": {"reason": "additionalProperties \"email\" not allowed"}}]

I have "additionalProperties": false configured.

I tried a third identity configuration option, but it's even more confusing:

---

Email and Username identity schema

passkey ✅
google sign in (registration) ✅
google sign up ❌

  {
      "$schema": "http://json-schema.org/draft-07/schema#",
      "title": "Person",
      "type": "object",
      "properties": {
        "traits": {
          "type": "object",
          "properties": {
            "username": {
              "type": "string",
              "title": "Username",
              "ory.sh/kratos": {
                "credentials": {
                  "passkey": {
                    "display_name": true
                  }
                }
              }
            },
            "email": {
              "type": "string",
              "format": "email",
              "title": "Email"
            }
          },
          "required": ["username"],
          "additionalProperties": false
        }
      }
    }

With this config, passkey still works. Registering by clicking on Google sign in works and I get email and username as traits, but Google sign up still doesn't work and throws the same 403.
This configuration asks for email in passkey sign up, which I was trying to avoid.

Is email required as a trait when using Socials even if I specified username as my identity? If so, can I allow it in oidc but hide for passkey?
When registering with Google without adding email as identity, I was expecting to have something like traits: { username: 'Pedro' }, identity: google:123456781111222233334

Am I missing something regarding identities for oidc or passkey?

[Pedr0Rocha]

Apparently the issue is in the data mapper, but the error is not clear.
On Ory Network, it triggers a redirect to the same page on sign up. It's stuck in this loop without error messages in the UI or anything. When self-hosted, the same happens but it returns a 403 from the redirects as I pointed above.

If I only have username on my identity, I can have this data mapping from Social email -> username and it works again.

local claims = {
  email_verified: true,
} + std.extVar('claims');

{
  identity: {
    traits: {
      [if 'email' in claims && claims.email_verified then 'username' else null]: claims.email,
    },
  },
}

[Pedr0Rocha]

It was documented here: https://www.ory.sh/docs/troubleshooting/troubleshooting-social-sign-in#redirect-loops-after-successful-registration