diff --git a/changelog/unreleased/fix-idp-sub-recreation.md b/changelog/unreleased/fix-idp-sub-recreation.md
new file mode 100644
index 0000000000..af724c69ec
--- /dev/null
+++ b/changelog/unreleased/fix-idp-sub-recreation.md
@@ -0,0 +1,10 @@
+Bugfix: Use UUID attribute for computing "sub" claim in lico idp
+
+By default the LDAP backend for lico uses the User DN for computing the "sub"
+claim of a user. This caused the "sub" claim to stay the same even if a user
+was deleted and recreated (and go a new UUID assgined with that). We now
+use the user's unique id (`owncloudUUID` by default) for computing the `sub`
+claim. So that user's recreated with the same name will be treated as different
+users by the IDP.
+
+https://github.com/owncloud/ocis/issues/904
diff --git a/services/idp/pkg/config/defaults/defaultconfig.go b/services/idp/pkg/config/defaults/defaultconfig.go
index c996b42795..dc6f2ebede 100644
--- a/services/idp/pkg/config/defaults/defaultconfig.go
+++ b/services/idp/pkg/config/defaults/defaultconfig.go
@@ -122,7 +122,7 @@ func DefaultConfig() *config.Config {
 			LoginAttribute:       "uid",
 			EmailAttribute:       "mail",
 			NameAttribute:        "displayName",
-			UUIDAttribute:        "uid",
+			UUIDAttribute:        "ownCloudUUID",
 			UUIDAttributeType:    "text",
 			Filter:               "",
 			ObjectClass:          "inetOrgPerson",
diff --git a/services/idp/pkg/service/v0/service.go b/services/idp/pkg/service/v0/service.go
index beaa125297..871aa92f94 100644
--- a/services/idp/pkg/service/v0/service.go
+++ b/services/idp/pkg/service/v0/service.go
@@ -197,6 +197,7 @@ func initLicoInternalLDAPEnvVars(ldap *config.Ldap) error {
 		"LDAP_EMAIL_ATTRIBUTE":     ldap.EmailAttribute,
 		"LDAP_NAME_ATTRIBUTE":      ldap.NameAttribute,
 		"LDAP_UUID_ATTRIBUTE":      ldap.UUIDAttribute,
+		"LDAP_SUB_ATTRIBUTES":      ldap.UUIDAttribute,
 		"LDAP_UUID_ATTRIBUTE_TYPE": ldap.UUIDAttributeType,
 		"LDAP_FILTER":              filter,
 	}