From a46132e410858bc54df2a0c8743a43d35cfdb84d Mon Sep 17 00:00:00 2001
From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com>
Date: Thu, 30 Apr 2026 17:22:00 +0200
Subject: [PATCH]  OIDC: Fix recovery admin access

---
 CHANGELOG.md                             | 3 ++-
 crates/common/src/auth/authentication.rs | 6 +-----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1968dd9b..71cd4e45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,7 +14,8 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 ## Fixed
 - Directory: 
   - Invalidate caches when group memberships change on an external directory.
-  - Return OIDC errors instead of "failed to decode token".
+  - OIDC: errors instead of "failed to decode token".
+  - OIDC: Recovery admin access.
   - User impersonation.
 - Tasks:
   - Delete locked tasks.
diff --git a/crates/common/src/auth/authentication.rs b/crates/common/src/auth/authentication.rs
index 45416bc3..96c03e45 100644
--- a/crates/common/src/auth/authentication.rs
+++ b/crates/common/src/auth/authentication.rs
@@ -342,11 +342,7 @@ impl Server {
                             return self.build_directory_token(result, req.remote_ip).await;
                         }
                         Err(err) => {
-                            if !err.matches(trc::EventType::Auth(trc::AuthEvent::Failed)) {
-                                return Err(err);
-                            } else {
-                                external_error = Some(err);
-                            }
+                            external_error = Some(err);
                         }
                     }
                 }