Invalid email claim for github user

[bo0tzz]

When logged into tailscale via github, the email claim provided by tsidp isbo0tzz@github, which ends up being rejected by some applications. I'm not sure whether this is -actually- invalid (or whether downstream is too strict), but I figured I'd bring it up anyways. I can't find any way to change this on the tailscale end.

[stevetrease]

I see the same when using a Tailscale keypads user. Is shows as steve@keypass and is rejected by some applications as an invalid email address.

[mostlygeek]

I asked internally and for Github and passkey authenticated users the email address is not available to tsidp. When we call the api to get the identify of the requester we get user@github and user@keypass in place of an actual email address.

We're still looking into this.

My current thinking is since tsidp can't provide a real email in GH/passkey users, it should respond with an error when email is requested in the scopes to /authorize.

[stevetrease]

How about an option for TSIDP to allow me to add a custom suffix to the user@github or user@keypass identities' email to make it at least look like a valid email address when passed?

So I could turn them into something like user@github.notanemail or user@keypass.notanemail.mytailnet which would then be accepted by the application as a "valid" email address.

Not sure if the various standards that define OIDC allow for something like this...

[ztmr]

How about an option for TSIDP to allow me to add a custom suffix to the user@github or user@keypass identities' email to make it at least look like a valid email address when passed?

So I could turn them into something like user@github.notanemail or user@keypass.notanemail.mytailnet which would then be accepted by the application as a "valid" email address.

Not sure if the various standards that define OIDC allow for something like this...

What a brilliant idea! And fairly straightforward to implement... People would just configure a subdomain handling all of this *@{github,passkey}.mydomain stuff!

It does not solve my issue with pre-existing users using emails from various domains and different usernames, but still a great improvement.

[bo0tzz]

That seems like the most straightforward fix (it crossed my mind too), but might cause a mess downstream if an app actually tries to send email to this address.

[mostlygeek]

How about an option for TSIDP to allow me to add a custom suffix to the user@github or user@keypass identities' email to make it at least look like a valid email address when passed?

I'm not proposing this as the solution we'll implement. However, if we do go this route using user@github.my-tailnet.ts.net or user@keypass.my-tailnet.ts.net seems better than what tsidp is currently doing.

Technically, since tsidp doesn't actually have an email address for these users it should not send the email and email_verified (#62) claims at all.

[sherif-fanous]

@mostlygeek I see you made #62 a child issue here so I'll comment here

1. I authenticate to Tailscale using Google and tsidp does actually send my full GMail email address in the email claim

2. tsidp supports sending custom claims using the extraClaims key in the app capabilities.

   "extraClaims": {
     "email_verified": true,
   },

   This "works" as in tsidp attempts to add the claim but unfortunately the tsidp implementation in addClaimValue supports very specific data types for claims and bool specifically isn't one of them, so when I tried adding the email_verified claim I got the following message in tsidp logs

   2025/09/27 00:13:01 WARN unsupported claim type claim=email_verified value=true type=bool

[mostlygeek]

Hi @sherif-fanous,

PR #64 adds email_verified to the standard set of oidc claims that we send and should close #62. I made #62 a child issue of this one because there's a decision to be made about what we with the invalid emails we send for github and passkey users.

Update:

We decided #68, supporting email_verified: true as in the extraClaims application capabilities grant was a better approach than #64.

[ztmr]

How about an option for TSIDP to allow me to add a custom suffix to the user@github or user@keypass identities' email to make it at least look like a valid email address when passed?

I'm not proposing this as the solution we'll implement. However, if we do go this route using user@github.my-tailnet.ts.net or user@keypass.my-tailnet.ts.net seems better than what tsidp is currently doing.

my-tailnet.ts.net is a good default, but people should be able to override it (via TSIDP_DOMAIN maybe) so that people can actually make an MX record for these subdomains -- which is one of the main benefits of this proposal.

[bo0tzz]

I hadn't considered the option of appending a full domain instead of just a (dummy) TLD, that sounds great to me!