# OpenID Connect and sub mismatch

**URL:** https://meta.discourse.org/t/openid-connect-and-sub-mismatch/342029
**Category:** SSO
**Tags:** openid-connect
**Created:** [December 12, 2024, 8:29am UTC](https://meta.discourse.org/t/openid-connect-and-sub-mismatch/342029 "2024-12-12T08:29:45Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Jagster](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jagster/32/192154_2.png) [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [December 12, 2024, 8:29am UTC](https://meta.discourse.org/t/openid-connect-and-sub-mismatch/342029/1 "2024-12-12T08:29:45Z")

</div>

A user can log in to provider (WordPress if than plays any roll) and when that user returns to Discourse, it waits a bit and tells it didn’t happen. I see this in logs:

`openid_connect_sub_mismatch: OmniAuth::Strategies::OpenIDConnect::SubVerifyError, OIDC `sub` mismatch.`

Provider and Discourse hasn`t too many settings and I’m decently sure everything is as should be, but my feelings aren’t important now. So, is there something I can do?

Sub has a value, same as user ID is in WordPress and Discoure in my user’s case.

---

<div class="post-metadata">

### Author: ![dotnich](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dotnich/32/487172_2.png) [@dotnich](https://meta.discourse.org/u/dotnich)
#### Post date: [February 24, 2025, 11:54pm UTC](https://meta.discourse.org/t/openid-connect-and-sub-mismatch/342029/2 "2025-02-24T23:54:36Z")

</div>

Yup, I got the same error just now when using Clerk as the provider.

---

<div class="post-metadata">

### Author: ![dotnich](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dotnich/32/487172_2.png) [@dotnich](https://meta.discourse.org/u/dotnich)
#### Post date: [February 25, 2025, 6:14am UTC](https://meta.discourse.org/t/openid-connect-and-sub-mismatch/342029/3 "2025-02-25T06:14:53Z")

</div>

In my case, it’s because the user info response doesn’t include a `sub` key, only `user_id`.

EDIT: I raised this with Clerk and they have since fixed it ❤
