https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims

We already set the name claim as the users display name if the profile scope is requested. We can set the preferred_username claim as well, though sub is already set to this. If harbor really expects name to be the username it's ignoring the specification though as far as I can tell.

Also it looks like in the harbor 2.4 docs that there should be a configuration attribute named "Username Claim" when you configure automatic onboarding. Try setting this to sub.

Ah nice, maybe it's worth clarifying somewhere which claims Authelia supports out of the box? Maybe somewhere here? https://github.com/authelia/chartrepo/blob/master/charts/authelia/values.yaml#L975

It's already clearly outlined in the docs: https://www.authelia.com/docs/configuration/identity-providers/oidc.html#scope-definitions

@laurivosandi just letting you know we added the preferred_username claim which should be available in the next patch/minor release.

I guess the root problem here was being newcomer to OIDC in general (scopes vs claims). Thanks for clarifying anyway :)

No drama at all! @laurivosandi just a forward warning, based on some intense reading of the spec, it's expected sub will change in the future.

I noticed that sub seems to insert now some (user?) UUID?

Yes, it's an opaque identifier in the form of a UUID v4.