Impersonation doesn't work with OIDC on /account

dani · August 21, 2026, 10:05am

Issue Description

When using an external OIDC as directory, it seems we can’t use impersonation on the /account web-ui

Expected Behavior

Using target@domain%admin@domain on the /account login form should redirect me to my OIDC auth page, where I can login as admin@domain, and then I should be logged as target@domain

Actual Behavior

Using target@domain%admin@domain on the /account login form, I’m correctly redirected to my OIDC auth page, where I login as admin@domain. Then I’m redirected back on the /account web-ui, but logged in as admin@domain instead of target@domain

Reproduction Steps

Configure an external OIDC as directory
Try to login on /account using impersonation format target%admin
Once authenticated on the external OIDC, you’re back on the /account Web UI, but as admin instead of target

Stalwart Version

v0.16.x

Installation Method

Docker

Database Backend

PostgreSQL

Blob Storage

PostgreSQL

Search Engine

PostgreSQL

Directory Backend

OIDC

I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.

on

I have searched this support forum (open and closed topics) and confirm this is not a duplicate.

on

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

stalwart · August 21, 2026, 12:48pm

Impersonation is not supported in OIDC, you have to use the recovery admin for impersonating unfortunately.

dani · August 21, 2026, 12:53pm

Apart from being inconvenient, it’s not working either. When using the recovery admin (so target@domain%stalwart) on the login form of /account, it’s redirecting me to my OIDC login page instead of prompting for the recovery password. It’s working correctly if using only the recovery admin login (“stalwart” in my case), I’m correctly prompted for the recovery password. But not when using a impersonation target@domain%stalwart as login

stalwart · August 23, 2026, 6:49pm

The impersonation with the recovery admin has been fixed in v0.16.19 (yet to be released).

dani · August 25, 2026, 9:21am

It’s somehow better, but still not working. With 0.16.19, when I enter target@domain%admin I’m now correctly prompted for the recovery password. But, when entering the recovery password, instead of being logged in as target@domain, I’m prompted for a basic auth

Topic		Replies	Views
Web UI sends "[email protected]%[email protected]" as username to OIDC provider when trying to impersonate user Issues	3	75	June 7, 2026
Domain based authentication directory Questions	12	150	June 20, 2026
Admin panel OIDC Questions	11	258	May 18, 2026
OIDC directory and service mailbox Questions	1	21	August 23, 2026
Trying to assign OIDC provider to domain Questions	5	107	July 26, 2026

Impersonation doesn't work with OIDC on /account

Issue Description

Expected Behavior

Actual Behavior

Reproduction Steps

Stalwart Version

Installation Method

Database Backend

Blob Storage

Search Engine

Directory Backend

I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.

I have searched this support forum (open and closed topics) and confirm this is not a duplicate.

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

Related topics