Delete OIDC credential resulting "You can't remove first factor credentials."

[luanfrv9]

I'm implementing a dashboard that enables admins to unlink an associated social sign in (made by the user through /public/self-service).

Tried using the endpoint DELETE /admin/identities/{id}/credentials/oidc?identifier={identifier} (doc link) but it fails with the reason message in the title.

Is it not possible to implement OIDC remotion by this way?

[vinckr]

Hey @luanfrv9
you should be able to remove OIDC credentials if there are other credentials (e.g. password) present on the identity using that API.

Could you provide a simple reproducible test case, maybe in a repo that I could clone to confirm?

Alternatively you could maybe start a settings flow on behalf of the user to unlink a social sign-in

[luanfrv9]

@vinckr thanks for your attention!
For sure. I'll you replicate the exactly configs used in a new repo and send it there as fast as possible. I may find some point of my configuration that is turning admin prohibited from doing this tho.

cheers

[vinckr]

Sure, also see this PR #4304 - but its not really related to OIDC which should already be possible.