diff --git a/docker-compose-dev.yml b/docker-compose-dev.yml
index 6741e9d8..8fbd0bb6 100644
--- a/docker-compose-dev.yml
+++ b/docker-compose-dev.yml
@@ -55,6 +55,7 @@ services:
       # - OIDC_ISSUER=
       # - OIDC_CLIENT_ID=
       # - OIDC_CLIENT_SECRET=
+      # - OIDC_USE_OAUTH_CALLBACK=true
       # - OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG=
       # - OIDC_USERINFO_SIGNED_RESPONSE_ALG=
       # - OIDC_SCOPES=openid email profile
diff --git a/docker-compose.yml b/docker-compose.yml
index 3ab7d175..199c5823 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -73,6 +73,7 @@ services:
       # - OIDC_CLIENT_SECRET=
       # Optionally store in secrets - then OIDC_CLIENT_SECRET should not be set
       # - OIDC_CLIENT_SECRET__FILE=/run/secrets/oidc_client_secret
+      # - OIDC_USE_OAUTH_CALLBACK=true
       # - OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG=
       # - OIDC_USERINFO_SIGNED_RESPONSE_ALG=
       # - OIDC_SCOPES=openid email profile
diff --git a/server/.env.sample b/server/.env.sample
index 888bfd57..a5a64d0e 100644
--- a/server/.env.sample
+++ b/server/.env.sample
@@ -46,6 +46,7 @@ SECRET_KEY=notsecretkey
 # OIDC_ISSUER=
 # OIDC_CLIENT_ID=
 # OIDC_CLIENT_SECRET=
+# OIDC_USE_OAUTH_CALLBACK=true
 # OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG=
 # OIDC_USERINFO_SIGNED_RESPONSE_ALG=
 # OIDC_SCOPES=openid email profile
diff --git a/server/api/helpers/users/get-or-create-one-with-oidc.js b/server/api/helpers/users/get-or-create-one-with-oidc.js
index 0e97645c..c0590917 100644
--- a/server/api/helpers/users/get-or-create-one-with-oidc.js
+++ b/server/api/helpers/users/get-or-create-one-with-oidc.js
@@ -34,16 +34,29 @@ module.exports = {
 
     let tokenSet;
     try {
-      tokenSet = await client.callback(
-        sails.config.custom.oidcRedirectUri,
-        {
-          iss: sails.config.custom.oidcIssuer,
-          code: inputs.code,
-        },
-        {
-          nonce: inputs.nonce,
-        },
-      );
+      if (sails.config.custom.oidcUseOauthCallback) {
+        tokenSet = await client.oauthCallback(
+          sails.config.custom.oidcRedirectUri,
+          {
+            iss: sails.config.custom.oidcIssuer,
+            code: inputs.code,
+          },
+          {
+            nonce: inputs.nonce,
+          },
+        );
+      } else {
+        tokenSet = await client.callback(
+          sails.config.custom.oidcRedirectUri,
+          {
+            iss: sails.config.custom.oidcIssuer,
+            code: inputs.code,
+          },
+          {
+            nonce: inputs.nonce,
+          },
+        );
+      }
     } catch (error) {
       sails.log.warn(`Error while exchanging OIDC code: ${error}`);
       throw 'invalidCodeOrNonce';
@@ -93,7 +106,6 @@ module.exports = {
             if (configRoles.includes('*')) {
               return true;
             }
-
             return configRoles.some((configRole) => claimsRolesSet.has(configRole));
           },
         );
@@ -148,7 +160,7 @@ module.exports = {
       identityProviderUser = await IdentityProviderUser.qm.createOne({
         userId: user.id,
         issuer: sails.config.custom.oidcIssuer,
-        sub: claims.sub,
+        sub: claims.sub || `${user.id}@${sails.config.custom.oidcIssuer}`,
       });
     }
 
diff --git a/server/config/custom.js b/server/config/custom.js
index 9d5e7f4b..997fb4ec 100644
--- a/server/config/custom.js
+++ b/server/config/custom.js
@@ -64,6 +64,7 @@ module.exports.custom = {
   oidcIssuer: process.env.OIDC_ISSUER,
   oidcClientId: process.env.OIDC_CLIENT_ID,
   oidcClientSecret: process.env.OIDC_CLIENT_SECRET,
+  oidcUseOauthCallback: process.env.OIDC_USE_OAUTH_CALLBACK === 'true',
   oidcIdTokenSignedResponseAlg: process.env.OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG,
   oidcUserinfoSignedResponseAlg: process.env.OIDC_USERINFO_SIGNED_RESPONSE_ALG,
   oidcScopes: process.env.OIDC_SCOPES || 'openid email profile',
diff --git a/server/package-lock.json b/server/package-lock.json
index eb3001eb..13b22ccb 100644
--- a/server/package-lock.json
+++ b/server/package-lock.json
@@ -7809,9 +7809,9 @@
       }
     },
     "node_modules/oidc-token-hash": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.1.0.tgz",
-      "integrity": "sha512-y0W+X7Ppo7oZX6eovsRkuzcSM40Bicg2JEJkDJ4irIt1wsYAP5MLSNv+QAogO8xivMffw/9OvV3um1pxXgt1uA==",
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.1.1.tgz",
+      "integrity": "sha512-D7EmwxJV6DsEB6vOFLrBM2OzsVgQzgPWyHlV2OOAVj772n+WTXpudC9e9u5BVKQnYwaD30Ivhi9b+4UeBcGu9g==",
       "license": "MIT",
       "engines": {
         "node": "^10.13.0 || >=12.0.0"